Could you spot a fraudulent email?
Phishing is still one of the main ways attackers get into businesses. Ten realistic messages, based on scams common in France: tell us whether each one is genuine or fraudulent, and see the clues to look for after every answer.
Personalise the test (optional)
You can make the examples more realistic by entering your email address or your domain. Genuine internal messages will then use your real domain; fraudulent messages keep fictitious domains.
Nothing is sent or stored: personalisation happens only in your browser.
Question 1 of 10
Is this email genuine or fraudulent?
Action required: your password expires today
Microsoft 365 Security
<no-reply@microsoft-account-security.com>
Today, 08:12
Hello,
The password for your Microsoft 365 account expires today. If you do not take action within 24 hours, your mailbox will be suspended and your emails deleted.
To keep your current password, confirm your sign-in details below.
Keep my passwordWhat to look out for
- The sender's real address does not belong to Microsoft: “microsoft-account-security.com” is a made-up domain that imitates the brand.
- Hovering over the link shows the same fake domain, not your company's usual sign-in page.
- The threat and the urgency (“24 hours”, “emails deleted”) are there to make you act without thinking.
What to do: Do not click. To check your account, open Outlook or the Microsoft 365 portal yourself from your bookmarks, then report the message to your IT team.
Learn more: Phishing ›
Question 2 of 10
Is this email genuine or fraudulent?
Context: In a meeting on Tuesday, you asked Julie from the purchasing team to send you the 2027 budget.
Julie Martin shared “2027 Budget - Purchasing.xlsx” with you
Julie Martin
<julie.martin@company-example.fr>
Wednesday, 10:41
Julie Martin shared a file with you.
“Here's the budget we talked about yesterday. Let me know if you have any questions.”
OpenWhat to look out for
- The sender is a colleague using your company's usual address, and the message follows up on something you asked for.
- Hovering over the link shows your own company's SharePoint site.
- There is no urgency, and no request for sign-in details or payment.
What to do: You can open the file. If a page asks for your password again when you are already signed in, stop and check with Julie.
Question 3 of 10
Is this email genuine or fraudulent?
Context: Supplier Example is one of your regular suppliers; its emails usually come from an @supplier-example.fr address.
Update to our bank details
Accounts - Supplier Example
<accounts@supplier-example-fr.com>
Thursday, 16:58
Attachment: New_RIB_Supplier_Example.pdf
Dear Sir or Madam,
Following a change of bank, our bank details have been updated. Please pay our outstanding invoices into the new account shown in the attached RIB, today if possible, to avoid any late payment penalties.
The old account has been closed. We would be grateful if you could handle this request discreetly.
What to look out for
- The sender's domain looks like the supplier's but is not the right one: “supplier-example-fr.com” instead of “supplier-example.fr”.
- A change of bank details (the RIB, the standard French bank details form) announced by email, with a request for prompt payment, is the classic payment fraud scenario.
- The urgency and the request for discretion are meant to stop you checking.
What to do: Never change bank details on the strength of an email alone: call the supplier on a number you already have (not the one in the message) before making any payment.
Learn more: CEO / wire-transfer fraud ›
Question 4 of 10
Is this text message genuine or fraudulent?
Context: You are not expecting any parcels at the moment.
+33 7 00 00 00 00
La Poste: your parcel no. 6A0284 is on hold. A redelivery fee of €1.99 must be paid within 24 hours, otherwise it will be returned to the sender.
https://suivi-colis-laposte-fr.info/r/8F2K
What to look out for
- The message comes from an ordinary mobile number, and the link leads to a domain that does not belong to La Poste, the French postal service.
- A small sum to pay urgently is a way of getting hold of your card number.
- You are not expecting a parcel: the message does not match anything real.
What to do: Do not click. To track a real parcel, open the carrier's website or app yourself and use the tracking number you received when you ordered.
Learn more: Phishing ›
Question 5 of 10
Is this email genuine or fraudulent?
Context: Thomas, your manager, holds this catch-up with the sales team every Monday.
Weekly sales catch-up - Monday 09:30
Thomas Bernard
<thomas.bernard@company-example.fr>
Friday, 17:20
Hi everyone,
As usual, we will go through current deals on Monday at 09:30. Please update your forecasts before the meeting.
Microsoft Teams meeting - Join on your computer or mobile app.
Join the meetingWhat to look out for
- The sender is your manager, using your company's address, and the meeting is a known routine.
- Hovering over the link shows a standard Teams meeting link.
- The message does not ask for sign-in details, payment or an attachment to be opened.
What to do: You can accept. If you are unsure about an unexpected invitation, check that it appears in your calendar or ask the organiser.
Question 6 of 10
Is this email genuine or fraudulent?
Context: Your company's CEO is Philippe Durand. His usual address is philippe.durand@company-example.fr.
Confidential matter
Philippe Durand
<p.durand.office@personal-mail-example.com>
Today, 11:47
Are you at your desk?
I need you to process an urgent transfer for an acquisition we are working on. This is strictly confidential: do not mention it to anyone, even internally, before the official announcement.
I am in meetings all day and cannot take calls. Reply to me by email only and I will send you the bank details.
What to look out for
- The display name is the CEO's, but the real address is a personal mailbox, not the company's.
- Urgency, confidentiality and an unusual transfer: the three ingredients of CEO fraud (known in France as “fraude au président”).
- The sender claims to be unreachable by phone to stop you checking through another channel.
What to do: Do not reply and do not make any transfer. Call the CEO or their assistant on the usual number, and alert your manager or the accounts team.
Learn more: CEO / wire-transfer fraud ›
Question 7 of 10
Is this email genuine or fraudulent?
Context: You order regularly from Supplier Example and are often in touch with Sophie, your contact there.
Summer closure of our warehouses
Sophie Leroy - Supplier Example
<s.leroy@supplier-example.fr>
Monday, 09:15
Hello,
Please note that our warehouses will be closed from 4 to 18 August. Orders placed before 31 July will be delivered before the closure; orders received during the closure will be processed as soon as we reopen.
I can still be reached by phone if you have any questions. Have a good day,
Sophie Leroy
What to look out for
- The real address matches the supplier's usual domain exactly, and you know the sender.
- The message is for information only: no link, no attachment, no request.
- The tone is normal, with no urgency or pressure.
What to do: Nothing to worry about here. Stay alert if a future message from this supplier asks for a payment or a change of details: check it by phone.
Question 8 of 10
Is this email genuine or fraudulent?
Context: You do not know this company and have never ordered anything from it.
REMINDER - Invoice no. FA-2026-10482 unpaid
Billing department
<billing@online-invoices-example.com>
Today, 07:34
Attachment: Invoice_FA-2026-10482.html
Hello,
Unless we are mistaken, the attached invoice remains unpaid. If payment is not received within 48 hours, the matter will be passed to our debt recovery department.
Please open the attachment to view the details and make your payment.
What to look out for
- An invoice is never an .html file (or a .zip): this kind of attachment often opens a fake sign-in page or installs malware.
- You have no dealings with this company, and the greeting “Hello,” does not use your name.
- The threat of debt recovery within 48 hours pushes you to open the attachment without thinking.
What to do: Do not open the attachment. Forward the message to your IT team or use the report button in your email software.
Learn more: Phishing ›
Question 9 of 10
Is this notification genuine or fraudulent?
Context: You have just switched on your new PC and entered your password in Outlook. The screen shows the number 47.
Approve sign-in?
Company Example - you@company-example.fr
App: Outlook. Location: Paris, France.
Enter the number shown to sign in.
What to look out for
- You started this sign-in yourself, a moment ago: the request matches exactly what you did.
- The number to enter is the one shown on your screen, and the app and location make sense.
- By contrast, a notification you did not trigger (often repeated, sometimes at night) means someone knows your password.
What to do: Only approve a request you have just triggered yourself. Otherwise, always deny it, even if it keeps coming back, and tell your IT team straight away.
Learn more: Multi-factor authentication (MFA) ›
Question 10 of 10
Is this email genuine or fraudulent?
Refund notice: €287.40 in your favour
impots.gouv - DGFiP
<remboursement@impots-gouv-avis.fr>
Yesterday, 21:03
Dear Sir or Madam,
Following the latest calculation of your tax, you are entitled to a refund of €287.40. To receive it, please confirm your bank details and your card number before the 31st of the month.
After this date, the refund will be cancelled.
Get my refundWhat to look out for
- Neither the address nor the link ends in “.gouv.fr”: “impots-gouv-avis.fr” is a made-up domain.
- The French tax office never asks for your card number by email, and a refund does not require you to “confirm” it.
- The lure of money combined with a deadline is a classic technique.
What to do: Do not click. Sign in to your account on impots.gouv.fr yourself (or ameli.fr for French national health insurance) by typing the address into your browser.
Learn more: Phishing ›
5 key habits
- Check the sender's real address, not just the display name.
- Hover over links before clicking to see where they really lead.
- Be wary of urgency, threats and requests for confidentiality.
- Check any request for payment or change of bank details through another channel (a phone number you already know).
- If a page asks for your password again after you followed a link from an email, that is a red flag. When in doubt, don't.
A single click is enough to compromise an account or trigger a fake transfer. Jesto can run simulated phishing campaigns and awareness training for your teams to make these habits stick.
Fictitious messages created for this test. Your answers stay in your browser: nothing is sent.