Are these real screenshots from safeonweb.be?

No. They are text recreations of the pattern these scams follow, built for this tool, with no real logos, images or working links. safeonweb.be is the CCB’s public site for this kind of warning, cited as the general source [1].

Why are some rounds genuine messages?

Because the goal is not to make you suspicious of everything. A real bpost tracking SMS or a real bank security notice looks calm, names specifics, and never asks for a PIN or a one-time code. Recognising those matters as much as catching the fakes.

What should I do if I get a message like one of the fake ones?

Don’t click, don’t reply, don’t scan. Contact the company or person through a channel you already know (the number on your card, the app, a phone call to a colleague), never through anything in the message itself. Then report it if your organisation has a way to do that.

Does training actually help against this?

Yes. It is one of the CyFun Basic controls (PR.AT-01.1): regular, documented training on spotting phishing. The CyFun readiness quiz checks whether that training happens at all. This tool is the practice itself.

Is there a course that covers this in more depth?

Yes. The first module of the Foundation course covers exactly this: spotting phishing by email, text and phone, and an invoice with a changed bank account.

← Free tools

FREE TOOL

How do you spot a phishing message?

Play 10 rounds of real-or-fake, each recreating a common Belgian scam: a fake bpost SMS, a fake itsme alert, a tax refund email, CEO fraud, invoice fraud and a QR code scam, plus a few genuine messages. After each round you see your score and the tells.

Round 1 of 10

SMS · "bpost"

bpost: Your package could not be delivered. Pay EUR 1.49 customs fee to reschedule: bpost-trace-delivery.com

Real or fake?

By Tom Janssens · Founder, Easy Cyber Protection · Last reviewed 3 November 2026 · How we write this

What should make you suspicious of a message?

Three things show up again and again in the scams that safeonweb.be, the public awareness site of the Centre for Cybersecurity Belgium, warns about [1]. Urgency: a countdown, a threat to block something. A request that should never arrive this way: a PIN, a one-time code, a changed bank account by email alone. And a sender address or domain that is close to the real one but not the same.

None of the messages in this tool is a screenshot of a real, dated warning. They recreate the pattern, with no real logo, image or working link, so you practise spotting the pattern instead of memorising one message.

See also the page on phishing and security awareness training.

What do real Belgian scam messages look like?

A fake "bpost" SMS asking for a small customs fee to release a package you never ordered. A fake "itsme" text with a countdown to confirm your identity through a link, when itsme confirmations only ever happen inside its own app. An email posing as the tax authority, asking for your card number to pay out a refund it would otherwise send to the account it already has on file. All three have the same shape: urgency, a request that shouldn’t arrive this way, and a sender that doesn’t quite match.

CEO fraud and invoice fraud have the same shape, by email instead of SMS: a lookalike domain, a request to skip the normal check (a phone call, a second signature), and a reason the usual process can’t be followed right now. The after-the-attack scenario shows what happens once one of these lands.

See the scenario Your Monday after the attack, and check with the CyFun readiness quiz whether your training is already in place.

Put the expected behaviour in writing with the free Acceptable Use Policy template, including the duty to report a suspicious message.

Frequently asked questions

Are these real screenshots from safeonweb.be?: No. They are text recreations of the pattern these scams follow, built for this tool, with no real logos, images or working links. safeonweb.be is the CCB’s public site for this kind of warning, cited as the general source [1].
Why are some rounds genuine messages?: Because the goal is not to make you suspicious of everything. A real bpost tracking SMS or a real bank security notice looks calm, names specifics, and never asks for a PIN or a one-time code. Recognising those matters as much as catching the fakes.
What should I do if I get a message like one of the fake ones?: Don’t click, don’t reply, don’t scan. Contact the company or person through a channel you already know (the number on your card, the app, a phone call to a colleague), never through anything in the message itself. Then report it if your organisation has a way to do that.
Does training actually help against this?: Yes. It is one of the CyFun Basic controls (PR.AT-01.1): regular, documented training on spotting phishing. The CyFun readiness quiz checks whether that training happens at all. This tool is the practice itself.
Is there a course that covers this in more depth?: Yes. The first module of the Foundation course covers exactly this: spotting phishing by email, text and phone, and an invoice with a changed bank account.

Related free tools

Phishing basics · Security awareness training

Use this with your clients

#CYBERLEARN

Train the team: Foundation

See the course →

Sources

safeonweb.be (CCB), public awareness site