Spot the Phish: Cyber Safety at Work

A mail from "IT": your password expires in 1 hour, log in here to keep it. Your first move?

• Reply asking if it is genuine
• Report it to IT through official channels
• Click the link and update quickly
• Forward it to your whole team

Answer: Report it to IT through official channels. A ticking clock plus a login link is the phisher's favourite combo. Report it through IT's own channel; never click or reply.

IT wants a stronger password from you. Which of these would a cracking tool take longest to break?

• Password@123
• correct-lamp-river-mango
• qwerty!!
• Rahul1990

Answer: correct-lamp-river-mango. Length beats cleverness. Four random words outlast short passwords with predictable @ and 123 swaps.

A "Google" sign-in page sits at accounts.google.com.secure-login.in. Whose domain is it really?

• login.in
• secure-login.in
• google.com
• accounts.google.com

Answer: secure-login.in. Read a domain from the right. Everything before secure-login.in is decoration its owner typed in.

A pen drive marked "Salary Revisions" is lying in the office car park. Your move?

• Share the files with HR
• Plug it in to find the owner
• Take it home for later
• Hand it to IT or security, unplugged

Answer: Hand it to IT or security, unplugged. Dropping tempting drives in car parks is an old, tested attack. Curiosity does the plugging in.

Fraudsters paste their own stickers over the real ones on parking meters and café tables. "Quishing" relies on what?

• A QR code
• A barcode on an invoice
• An NFC payment tag
• A fingerprint reader

Answer: A QR code. Quishing is QR-code phishing. The fake code sends you to a lookalike payment or login page.

Your "CEO" emails from a meeting: buy gift cards quietly, send the codes, don't call. What kind of scam is this?

• Business email compromise
• A spam filter error
• A routine purchase request
• A software update notice

Answer: Business email compromise. Impersonating a boss to rush a payment is called business email compromise, or CEO fraud. Gift cards plus "don't call me" is the tell: verify on a number you already have.

11 pm: your phone keeps buzzing with login approvals you never asked for. What's going on?

• IT is testing the network
• Someone has your password and hopes you tap Approve
• A routine app sync
• Your phone needs an update

Answer: Someone has your password and hopes you tap Approve. It's MFA fatigue. The attacker already has your password and is betting you'll tap Approve just to stop the buzzing.

India's CERT-In directions give organisations how long to report certain cyber incidents after they notice them?

• 6 hours
• 24 hours
• 72 hours
• 7 days

Answer: 6 hours. The April 2022 directions set a 6-hour clock, far tighter than the GDPR's 72 hours for telling a regulator about a breach.

There's a padlock next to the web address. What does it actually tell you about the site?

• It is genuine and safe
• The connection is encrypted
• The government has approved it
• It has no viruses

Answer: The connection is encrypted. The padlock only means your connection is private. Plenty of phishing sites have one too, so still check the domain.

Money just left your account through a fake UPI request. Why does reporting it to the national cyber fraud helpline within minutes matter?

• Banks can freeze the money before it moves on
• The scammer gets an automatic warning
• Your UPI ID changes by itself
• It cancels every payment you made today

Answer: Banks can freeze the money before it moves on. Complaints on 1930 go straight to banks, which can put a hold on stolen money before it is withdrawn. The longer you wait, the further it travels.

A caller from your "bank" says your card will be blocked unless you read out the OTP just sent to your phone. What do you do?

• Read it out to save your card
• Read only the first three digits
• Hang up; banks never ask for OTPs
• Ask them to call back later

Answer: Hang up; banks never ask for OTPs. The RBI says banks and genuine payment companies never ask for your OTP, PIN, CVV or password. Urgency is the scammer's main tool.

A video caller in police uniform says you are under "digital arrest" and must transfer money to clear your name. What is the truth?

• Stay on the call until it ends
• Pay the fine online quickly
• Indian law has no such thing as a digital arrest
• Only the CBI can do this to you

Answer: Indian law has no such thing as a digital arrest. Police, CBI, ED and customs never arrest anyone over a video call. Hang up and report it on 1930 or cybercrime.gov.in.

A stranger carrying boxes slips in behind you through the office's swipe-card door. What is this trick called?

• Shoulder surfing
• Spoofing
• Baiting
• Tailgating

Answer: Tailgating. Politeness is the weak spot: people hold doors open. Ask visitors to sign in at reception instead.

Which government portal's Chakshu feature lets you report suspected fraud calls, SMS and WhatsApp messages?

• DigiLocker
• UMANG
• Sanchar Saathi
• MyGov

Answer: Sanchar Saathi. The Department of Telecommunications runs it and can cut off numbers used for fraud. If you have already lost money, call 1930.

Your laptop keeps asking to install a security update. Why should you do it soon?

• It frees up storage space
• It makes the screen brighter
• It resets your passwords
• It fixes holes attackers could use

Answer: It fixes holes attackers could use. Once a flaw is made public, attackers race to use it on machines that haven't updated. The UK's NCSC advises installing updates as soon as possible.