THINK YOU CAN SPOT A SCAM?

10 real scenarios. 3 minutes.

Find out if your instincts would catch what's actually hitting Canadian businesses right now.

CLICK NEXT TO START THE QUIZ ↓

Question Title

1.

An email lands from your CEO's exact name and photo:

"I'm in a confidential meeting and can't talk. I need you to purchase $2,000 in gift cards for a client gift, urgently. Send the codes to this email. I'll explain later."

The email address appears to be correct.

What's the right response?

Buy the gift cards. The CEO said it was urgent and confidential

Reply to ask for more details

Verify through a separate, known channel (call the CEO directly, or use an internal chat you know is real) before doing anything

Forward it to a coworker to check

Question Title

2.

True or false:

AI-generated phishing emails can be polished and convincing, making old advice like “look for bad grammar” less reliable.

True

False

Question Title

3.

You receive a call at work:

"Hi, this is IT Support, we're seeing suspicious login attempts on your account. I need to verify your identity, can you confirm your password and the MFA code that was just texted to you?"

What should you do?

Provide the info. It's IT, and it sounds urgent

Give the password but not the MFA code

Ask the caller for their employee ID first, then proceed

Hang up and contact IT through a known internal number to verify

Question Title

4.

An employee scans a QR code on a flyer taped to the office printer:

"Scan to complete your mandatory security awareness training."

It leads to a login page asking for their work email and password.

What's the risk here?

None. QR codes on internal flyers are always safe

QR codes can lead anywhere, including a fake login page designed to steal

Only a risk if the flyer looks unprofessional

Only a risk on personal phones, not work devices

Question Title

5.

True or false:

If your business backs up its data regularly, ransomware isn't a serious threat; you can just restore from backup and move on.

True

False

Question Title

6.

You get a notification: someone just approved a login to a company account from a new device, after 6 rapid MFA push notifications were sent and one was eventually approved.

This pattern is best described as:

A normal glitch in the MFA app

A sign the employee's phone is broken

"MFA fatigue", an attacker spamming approval requests hoping someone taps "approve" by accident or to make it stop

Nothing to worry about since MFA was used

Question Title

7.

Which of these is the most common way small businesses are actually breached right now?

A hacker manually cracking a password

Stolen or reused credentials and legitimate remote-access tools, no malware involved at all

A physical break-in

A virus on a USB stick

Question Title

8.

Your business uses a third-party vendor for payroll. That vendor gets breached, your business never opened a bad email or clicked a bad link.

Is your business at risk?

Yes — a growing share of small business incidents now start with a compromised vendor or supplier, not a direct attack

No — the breach wasn't your fault or your system

Only if the vendor tells you, which they're not required to

Only if you use the same password as the vendor

Question Title

9.

True or false:

If your business does experience a ransomware or breach incident, having an incident response plan in place before it happens makes a measurable difference in how much it costs you.

True

False

Question Title

10. You've made it to the final question!

Match each letter of the P.A.U.S.E. acronym to its correct cybersecurity action.

P - Pause before clicking

P - Post about it

A - Always click the link if a colleague sent it

A - Ask yourself if this was expected

U - URL check

U - Update your software

S - Send it to IT and move on

S - Share with care

E - Escalate if it feels off

E - Erase the email immediately

Question Title

11. Ready to see your Defence Score?

Enter your information below to get your score and see how your cybersecurity instincts stack up. (Required.)

First Name

Last Name

Question Title

12. Consent Required (Required.)

Yes, I'd like to receive more information from Fortinet about cybersecurity awareness, training resources, and solutions for my business, by email. I understand I can withdraw my consent at any time.

THINK YOU CAN SPOT A SCAM?

Question Title

1. An email lands from your CEO's exact name and photo: "I'm in a confidential meeting and can't talk. I need you to purchase $2,000 in gift cards for a client gift, urgently. Send the codes to this email. I'll explain later." The email address appears to be correct.What's the right response?

Question Title

2. True or false:AI-generated phishing emails can be polished and convincing, making old advice like “look for bad grammar” less reliable.

Question Title

3. You receive a call at work: "Hi, this is IT Support, we're seeing suspicious login attempts on your account. I need to verify your identity, can you confirm your password and the MFA code that was just texted to you?"What should you do?

Question Title

4. An employee scans a QR code on a flyer taped to the office printer: "Scan to complete your mandatory security awareness training." It leads to a login page asking for their work email and password.What's the risk here?

Question Title

5. True or false: If your business backs up its data regularly, ransomware isn't a serious threat; you can just restore from backup and move on.

Question Title

6. You get a notification: someone just approved a login to a company account from a new device, after 6 rapid MFA push notifications were sent and one was eventually approved.This pattern is best described as:

Question Title

7. Which of these is the most common way small businesses are actually breached right now?

Question Title

8. Your business uses a third-party vendor for payroll. That vendor gets breached, your business never opened a bad email or clicked a bad link.Is your business at risk?

Question Title

9. True or false:If your business does experience a ransomware or breach incident, having an incident response plan in place before it happens makes a measurable difference in how much it costs you.

Question Title

10. You've made it to the final question!Match each letter of the P.A.U.S.E. acronym to its correct cybersecurity action.

Question Title

11. Ready to see your Defence Score?Enter your information below to get your score and see how your cybersecurity instincts stack up. (Required.)

Question Title

12. Consent Required (Required.)

1.

An email lands from your CEO's exact name and photo:

"I'm in a confidential meeting and can't talk. I need you to purchase $2,000 in gift cards for a client gift, urgently. Send the codes to this email. I'll explain later."

The email address appears to be correct.

What's the right response?

2.

True or false:

AI-generated phishing emails can be polished and convincing, making old advice like “look for bad grammar” less reliable.

3.

You receive a call at work:

"Hi, this is IT Support, we're seeing suspicious login attempts on your account. I need to verify your identity, can you confirm your password and the MFA code that was just texted to you?"

What should you do?

4.

An employee scans a QR code on a flyer taped to the office printer:

"Scan to complete your mandatory security awareness training."

It leads to a login page asking for their work email and password.

What's the risk here?

5.

True or false:

If your business backs up its data regularly, ransomware isn't a serious threat; you can just restore from backup and move on.

6.

You get a notification: someone just approved a login to a company account from a new device, after 6 rapid MFA push notifications were sent and one was eventually approved.

This pattern is best described as:

7.

Which of these is the most common way small businesses are actually breached right now?

8.

Your business uses a third-party vendor for payroll. That vendor gets breached, your business never opened a bad email or clicked a bad link.

Is your business at risk?

9.

True or false:

If your business does experience a ransomware or breach incident, having an incident response plan in place before it happens makes a measurable difference in how much it costs you.

10. You've made it to the final question!

Match each letter of the P.A.U.S.E. acronym to its correct cybersecurity action.

11. Ready to see your Defence Score?

Enter your information below to get your score and see how your cybersecurity instincts stack up. (Required.)