Interactive Quiz

Phishing Quiz: Can You Spot a Scam in the Philippines?

Test your scam-spotting skills with our interactive quiz. Learn how to identify common PH phishing texts, from fake GCash alerts to job scams.

🎯 11 questions ✅ Pass with 9+ correct 🔀 Shuffled every attempt

No sign-up needed Based on real PH scam patterns

📖 First, a 90-second field guide: how to actually read a link Most people never learn this. Open it before you start.

The padlock and "https://" don't mean a site is safe

Any scammer can get a free HTTPS certificate for a fake site in minutes — it only encrypts the connection, it doesn't check whether the site is honest. A phishing page can have the padlock icon too. Stop trusting the lock; start reading the actual address.

Read a URL from the first "/" backward, not forward

In gcash-secure-verify.com/restore, the real domain is gcash-secure-verify.com — everything after the domain (like "restore") is just a made-up folder name and proves nothing. People skim left-to-right, see "gcash," and stop reading. Scammers count on that.

Know the four lookalike tricks

Extra words: gcash-secure-verify.com instead of gcash.com
Swapped letters/numbers: gcasłı.com, bp1.com.ph
Wrong ending: bpi.com.ph → bpi.net or bpi.ph-secure.com
Subdomain trick: gcash.com.verify-account.xyz — the real domain here is verify-account.xyz, not gcash.com, even though "gcash.com" appears first.

A one-time PIN (OTP) is safe to receive. Never safe to share.

Getting an OTP text is completely normal — it means you or someone else just tried to log in or pay. The danger is only ever in reading it out or typing it somewhere else. No bank, courier, or government agency will ever call or text asking you to send them your OTP.

When in doubt, don't tap — navigate yourself instead

Close the message. Open the official app you already have installed, or type the company's known website from memory. This one habit defeats almost every phishing format on this page, because it removes the fake link from the equation entirely.