// KNOWLEDGE BASE

LEARN THE SIGNALS

Build practical habits you can use before you ever need to identify a specific attack name.

Verify identity

Confirm who is actually making the request. Display names, polished writing and familiar branding are not proof of identity.

Practice messaging →

Inspect destinations

Look at the real hostname or destination before trusting a link, QR code or sign-in page.

Practice links & domains →

Use independent channels

For consequential requests, verify through a known phone number, bookmarked portal or established workflow.

Practice workplace judgment →

Common patterns

PHISHING

Messages that manipulate a person into taking an unsafe action.

SPEAR PHISHING

Targeted phishing built with personal or organizational context.

SMISHING

Social engineering delivered through SMS or messaging apps.

QUISHING

QR codes used to conceal a destination or move an interaction to a phone.

BEC

Business email compromise abuses trusted relationships, process and authority.

MFA FATIGUE

Repeated authentication prompts attempt to wear down a target.

LOOKALIKE DOMAINS

Small hostname or domain changes can make an attacker appear familiar.

HTTPS ≠ TRUST

Encryption protects the connection; it does not prove who operates the site.

OSINT

Public information can provide context for convincing pretexts.

AI IMPERSONATION

AI can improve personalization, voice, imagery and writing quality.

URGENCY

Artificial deadlines reduce the time people spend verifying a request.

SAFE VERIFICATION

Use a known independent route rather than contact details supplied by the request.

// TRAINING_METHODOLOGY.TXT□ ×

PHREAKSAFE teaches judgment, not automatic distrust.

The challenge library deliberately mixes normal, uncertain and suspicious situations. A legitimate high-consequence request may still deserve verification, while a routine request with strong corroborating context may be safe to process normally.

TEST YOUR JUDGMENT →

// HOW DIFFICULTY IS CALIBRATED

Difficulty is based on context, not a rotating label.

Email scenarios use the same core ideas emphasized by the NIST Phish Scale: observable cues and how strongly the premise aligns with the recipient's work context. For other channels, PHREAKSAFE applies the same human-risk principle to cue salience, context alignment, consequence, and ambiguity.

Beginner scenarios have high-salience evidence. Intermediate scenarios use common plausible workflows. Advanced scenarios have stronger premise alignment or fewer obvious cues. Expert scenarios combine strong context, consequential requests, and competing evidence.

MFA lessons reinforce that unexpected prompts and authentication codes require caution, while phishing-resistant methods such as FIDO/WebAuthn provide stronger protection than push or SMS-based MFA.