Online Banking Security Lab: Spot the Fake Fraud Team
Set up your banking security, then handle a call from a "fraud team", a text with a link and a transfer you did not make. Each choice has a cost and a reason. Prefer to read first? Start with the online banking security checklist.
You are Priya Nair, tidying up how you bank online. Your friend Dan has just been caught by a fake "fraud team" call and says everyone should take this seriously. Across 12 decisions you set up the account, handle a call and a text that claim to be your bank, and respond when a transfer you did not make appears. Everything here is fictional and no bank is named. Each call is scored 0 to 10, with the reason based on the FBI, FTC, CFPB, Scamwatch and Take Five guidance. What protects you after a loss varies by country, so check your own regulator.
This is the guided version: a yellow flash shows where to click and a bar says what to do. Switch to Free play any time.
GuidedPress the highlighted Start button. You can edit the names above first, or keep the samples.
Make it yours
Replace the sample names so the scenario and the debrief you export are about your organisation.
TL;DRWhat this lab is
5 points
- A scenario lab: a fictional person secures online banking, then faces a fake "fraud team" call, a spoofed text and a transfer they did not make.
- You make 12 scored decisions: password and manager, second factor, alerts, bank-impersonation calls, text links, fake apps and sites, PINs and codes, public Wi-Fi, card controls, payment scams and the first steps after a loss.
- The reasoning follows the FBI IC3, the FTC, the CFPB, Scamwatch and Take Five (UK Finance). No bank is named or favoured.
- Free to play. You get a final score and grade, a shareable scorecard and next-step links. A downloadable debrief is available with a paid plan.
- Defensive and educational only. What protects you after a loss varies by country, so the lab points you to your regulator rather than promising anything.
Frequently asked questions
Is this connected to my real bank?
No. The people are fictional and no bank is named. Nothing connects to any account, and nothing you choose changes a real setting.
Where does the advice come from?
From the FBI Internet Crime Complaint Center account-takeover alert, the FTC, the CFPB, Australia's Scamwatch and Take Five from UK Finance. The blog checklist links each source.
Would my bank ever ask me to move money to a safe account?
Scamwatch says banks would never ask you to move money to a secure account. If someone asks, hang up and contact your bank on a number you find yourself.
Will I get my money back after a scam?
It depends on the country, the bank and how the payment was made, so the lab does not promise anything. Contact your bank at once and check your national regulator.
How is it scored?
Each decision scores 0 to 10 and the final score is the share of the maximum. Every answer comes with a short reason, so you learn why a choice helps or hurts.
More security tools
The tools people use most on PlayCISO.
Catch injected instructions hiding in content your AI agent should only read.
Score your readiness against the first international standard for AI security threats.
Critical CVEs across 21 major vendors, month by month — and what the 2026 surge means.
Build an ordered ruleset, replay labelled packets and catch shadowed and any-to-any rules.
Self-assess all six Functions, from Govern to Recover, and see your weakest one.
Search 172 threat actors across Microsoft, CrowdStrike, Mandiant and community names.