Where Links Really Go
Link text is a costume. The real destination underneath is the truth, and checking it takes one second.
Free Tool · Phishing IQ Test
Could you spot the email that robs your business?
Most breaches start with one convincing email and one busy person. Take the 2-minute test: eight realistic messages, some genuine, some attacks. Every answer teaches you the tell, and your score shows how your whole team might fare.
📧 8 Realistic Emails
🎯 Learn the Tells
🔒 Private & Free
★ By Orca IT
2 minutes, instant feedback on every answer · your score stays in your browser until you send it
The Tells
What the test trains you to see
Phishing works on patterns, and patterns can be learned. These are the tells the eight emails are built around.
Lookalike Senders
acrne is not acme, and the CEO does not email from Gmail. Tiny sender details expose big lies.
Manufactured Urgency
Expires today, act now, keep this quiet: pressure exists to switch off the checking part of your brain.
Money & Credentials
New bank details, gift cards, or sign in with your password to view: the asks that should trigger a phone call.
Expected vs Out of the Blue
A document you were expecting from a consistent sender is normal. The same email out of nowhere is not.
Calm Verification
The winning habit is boring: slow down, check the domain, and verify money requests on a known phone number.
Why This Matters
One email is all it takes
The attacks in this test are not exotic. They are the everyday patterns behind most real business losses.
The fake invoice
A lookalike vendor domain and new bank details, and the payment leaves. Verification by phone stops it cold.
The gift card boss
Executive impersonation needs no malware, just authority, urgency and secrecy. Recognizing the pattern beats it.
The password harvest
Fake login pages capture credentials in seconds. MFA plus link-checking makes them useless.
One click, whole network
A single credential or infected machine can become ransomware everywhere. People are the first firewall.
Filters are not enough
Good email filtering matters, and the best attacks are engineered to slip past it. Trained eyes catch what software misses.
Training actually works
Teams that practice on realistic examples report more and click less. It is one of the highest-return security investments there is.
How It Works
From clickers to catchers
01
Test Yourself
Take the 8-email test above and learn the tells.
02
Baseline the Team
We run a safe, realistic phishing simulation across your staff.
03
Train
Short, practical sessions built on real examples, not boring compliance videos.
04
Measure
Follow-up simulations show click rates falling and reporting rising.
Your team is either the weakest link or the best filter.
A 2-minute test today, and training that turns every inbox into a checkpoint.
Why Orca
Why teams train with Orca
The test is free because trained people are the security layer we believe in most.
Realistic, not theoretical
Simulations and training built from the attack styles actually hitting businesses now.
Engaging, not eye-rolling
Short sessions with live examples, because training only works if people stay awake.
Measurable results
Baseline, train, re-test. You see click rates fall and reporting rise on paper.
Part of real security
Training pairs with MFA, email security and protection, so one layer never stands alone.
20+ years of experience
Two decades watching exactly how businesses get fooled, distilled into what to teach.
Remote anywhere, onsite in Phoenix
Training delivered remotely to teams anywhere, and in person across the Phoenix area.
Questions
Phishing training, answered
How realistic are the test emails?
They mirror the most common real-world patterns: credential harvests, lookalike vendor domains, executive gift card requests and fake delivery fees, alongside genuinely legitimate messages, because knowing what is normal matters too.
Do you see my score?
Not unless you send it. The test runs in your browser, and your score reaches us only if you submit the form to ask about team training.
What is a good score?
Eight of eight with humility. Anything less means specific attack styles would likely work on you, and those are exactly what training targets. Most people miss at least one.
What does team training involve?
A safe baseline phishing simulation, short practical training sessions on the tells, and follow-up simulations that measure improvement. We keep it engaging and blame-free, since reporting matters more than shame.
How often should staff be trained?
A baseline plus short refreshers through the year beats one annual marathon. Attack styles evolve, and so should the examples.
Is training enough by itself?
No single layer is. Training pairs with MFA, email authentication and managed protection, so a mistake by one person on one day cannot sink the business. We set up all of it.
Can you train remote and multi-location teams?
Yes. Simulations and training are delivered remotely to teams anywhere in the country, with onsite sessions available across the Phoenix area.
Free Tools
More free tools from Orca
No email walls, no tricks. Useful tools that run right in your browser.
Team Training
Find out how your team scores.
Send your score and we will set up a safe baseline simulation and a training plan sized to your team. Free consultation, no pressure. Or just call.
(602) 677-0779For Arizona businesses · Training delivered remotely anywhere and onsite across the Phoenix area
Get team training details
A few details and we’ll get right back to you to help.