"Three messages. Three lures. Fourteen red flags hidden in plain sight. Click every highlighted span to reveal what makes each phish tick — and what should have stopped you from clicking."
The Inbox Trap
Click every highlighted span in each message to reveal the red flag hidden inside.
DMV-Notice: FINAL NOTICE — Your driver's license has been suspended due to unpaid tolls. Pay $49.00 within 24 hours to restore driving privileges. Click: dmv-renewal-portal.gov.com/pay
Dear Valued Customer,
We attempted delivery of your package (Tracking #: 7489-2341-9823-XX) but were unable to complete the delivery.
A redelivery fee of $3.99 is required to reschedule your delivery. Please update your delivery preferences before your package is returned to sender.
FedEx Customer Service | 1-800-463-3339
Hi [First Name],
I came across your profile and was impressed by your background. We have an urgent opening for a remote Senior Engineer role at Google — $145,000 base, full benefits, immediate start.
We're moving very quickly — I need to confirm your interest today. If you're open, please complete our brief screening form so I can submit your profile to the hiring team immediately.
Best,
Jennifer Walsh
Senior Technical Recruiter, Google
red flags remaining — click the highlighted spans above to find them all.
14 Red Flags. 3 Simple Rules.
Every phish in The Inbox Trap is stopped by one of three habits. Here's the full breakdown.
DMV texts, FedEx emails, LinkedIn InMail — none of them should have clickable links that take you to forms. Navigate directly: type dmv.ca.gov, fedex.com, or google.com/careers in a new browser tab.
The button says "Reschedule Delivery" — the URL says fedex-delivery-notify.com. The InMail says "Complete Screening Form" — the URL says careers-apply.net. The button text and the real URL are never the same in a phish.
"24 hours or your license is suspended." "Need your answer today." "Moving very quickly." Every phish uses urgency to bypass deliberation. The slower you go, the safer you are. Real government agencies and employers do not require decisions in hours.
