REAL EXPERIENCES. BETTER UNDERSTANDING.

What was the phishing message that almost fooled you?

We're collecting real phishing experiences to understand what makes deceptive messages convincing and to test whether better warnings could have helped.

You don't need to have lost money to take part. A message you spotted just in time matters too.

About 3 minutesNo account neededSharing publicly is your choice

Your experience can help

All questions are required unless marked optional. Choose the closest answer; there's no judgement here.

1. How did the phishing attempt reach you?

2. What made it look legitimate?

Choose all that apply.

3. Tell us what happened

What were you expecting? What made you pause or trust it? Use 20–4,000 characters, without identifying details.

0 / 4,000

4. What happened next?

5. Your permission

Public use may include Kickstarter campaign material or future policy discussions. Leaving the optional box unticked means your story is for internal research and product testing only. We review stories and remove identifying details before any permitted public use.

6. Contact email (Optional)

Contact email is optional and used only for agreed follow-up about your story. It won't be published or added to a marketing list.

Phishing-story collection notice — version 1.1

We collect stories to understand convincing phishing techniques and test warning approaches. You may submit anonymously. Analysis and research consent is required; publication consent is separate and optional.

Contact email is optional and used only for agreed follow-up about your story. It won't be published or added to a marketing list.

Do not submit passwords, credentials, card or bank details, account numbers, home addresses, active malicious links or unnecessary personal information about other people.

Hosting and security service providers may process or store submitted information.

You may request access to or correction of your information, or withdraw an unpublished story, using the privacy contact below. We cannot promise to recall material already publicly distributed. If you submit anonymously, we may need enough information to locate your story without collecting unnecessary personal details.

Our initial operational retention target for raw submissions is 180 days. Removal is managed through manual review, not automatic deletion. Contact email should be removed when no longer needed for agreed follow-up.

Publication permission does not mean immediate publication. A person must review the material and remove identifying details before publication.

Operator: Stephen McLeish, Phishing Trust Initiative

Privacy contact: privacy@phishtrust.com

Read the full privacy policy

Please check once more that you've removed sensitive details.

What was the phishing message that almost fooled you?

Your experience can help

Phishing-story collection notice — version 1.1

Your experience matters.