Security awareness training for small-business teams
Short, practical scam-spotting practice for everyone on your team: phishing emails, fake websites, invoice fraud and payment traps. You get a record of who completed what.
What your team practices
Cybersecurity training for employees built around the scams that reach a small office. Every example uses fictional companies and shows exactly which details gave it away.
Read the address
Work out who really owns a web address or email sender, and spot the tricks that fake it.
Phishing emails
Credential-harvest lures, risky attachments, MFA prompts and consent traps.
Fake websites and brand impersonation
Lookalike login pages, fake pages on real hosts, sponsored-ad traps and fake shops.
Money movement and invoice fraud
Vendor bank changes, gift-card requests, payroll diversion and the call-back-on-file rule.
Subscription and billing traps
Free-trial enrollment, pre-checked boxes, fake renewals and business-directory solicitations.
Safe card and payment use
Credit versus debit, wallets and virtual cards, checkout judgment and payment-method red flags.
How it works
- Set up your team. Create a free account and invite staff by email.
- Everyone practices. Five-minute modules on any phone or computer. Each answer comes with the tells and what to do instead.
- Keep proof of training. See who has finished each module and which tricks the team missed most.
Phishing training without the slideshow
Most cyber awareness training is a long video and a quiz nobody remembers. ScamSmarts is practice: real-looking emails, texts, websites and invoices, some of them legitimate, so people learn to check the address, the channel and the process rather than guess.
Want a quick read on your team first? Run a free phishing test for employees: eight examples, no accounts for staff, and an anonymous team score.
Scam guide
How the common scams work, with an example of each to try.
Vendor bank-detail change
Email says the vendor's bank details changed; payments get redirected.
Executive gift-card request
Impersonated boss asks you to buy gift cards.
Credential-harvest email
Email sends you to a fake Microsoft 365, Google or bank sign-in page.
Lookalike login page
Cloned sign-in page on a domain the provider does not own.
Fake renewal invoice (callback scam)
Email says you were charged for a renewal and gives a number to call.
Typosquat domain
Sender or site domain is the real brand with a swapped, dropped or lookalike character (rn for m, 1 for l).
Questions
- Is it really free?
- Yes, for teams of up to 25 people, with every core module and completion records. Larger teams and extras are paid.
- Do you send fake phishing emails to my staff?
- No. Everyone practices on realistic examples inside ScamSmarts. Nothing lands in your inboxes and there is nothing for IT to allowlist.
- What do I get for my records?
- A dashboard of who has finished each module and when, so you can show that your team has been trained.
- How long does it take?
- Each module is about five minutes and works on a phone. People can do one between other tasks.
Free security awareness training for your whole team
Start with the eight-question quiz, or set up your team now.