Security awareness training for small-business teams
Short, practical scam-spotting practice for everyone on your team: phishing emails, fake websites, invoice fraud and payment traps. You get a record of who completed what.
What your team practices
Cybersecurity training for employees built around the scams that reach a small office. Every example uses fictional companies and shows exactly which details gave it away.
Read the address
Work out who really owns a web address or email sender, and spot the tricks that fake it.
Phishing emails
Credential-harvest lures, risky attachments, MFA prompts and consent traps.
Fake websites and brand impersonation
Lookalike login pages, fake pages on real hosts, sponsored-ad traps and fake shops.
Money movement and invoice fraud
Vendor bank changes, gift-card requests, payroll diversion and the call-back-on-file rule.
Subscription and billing traps
Free-trial enrollment, pre-checked boxes, fake renewals and business-directory solicitations.
Safe card and payment use
Credit versus debit, wallets and virtual cards, checkout judgment and payment-method red flags.
How it works
- Set up your team. Create a free account and invite staff by email.
- Everyone practices. Five-minute modules on any phone or computer. Each answer comes with the tells and what to do instead.
- Keep proof of training. See who has finished each module and which tricks the team missed most.
Phishing training without the slideshow
Most cyber awareness training is a long video and a quiz nobody remembers. ScamSmarts is practice: real-looking emails, texts, websites and invoices, some of them legitimate, so people learn to check the address, the channel and the process rather than guess.
Scam guide
How the common scams work, with an example of each to try.
Vendor bank-detail change
Email says the vendor's bank details changed; payments get redirected.
Executive gift-card request
Impersonated boss asks you to buy gift cards.
Credential-harvest email
Email sends you to a fake Microsoft 365, Google or bank sign-in page.
Lookalike login page
Cloned sign-in page on a domain the provider does not own.
Fake renewal invoice (callback scam)
Email says you were charged for a renewal and gives a number to call.
Typosquat domain
Sender or site domain is the real brand with a swapped, dropped or lookalike character (rn for m, 1 for l).
Questions
- Is it really free?
- Yes, for teams of up to 25 people, with every core module and completion records. Larger teams and extras are paid.
- Do you send fake phishing emails to my staff?
- No. Everyone practices on realistic examples inside ScamSmarts. Nothing lands in your inboxes and there is nothing for IT to allowlist.
- What do I get for my records?
- A dashboard of who has finished each module and when, so you can show that your team has been trained.
- How long does it take?
- Each module is about five minutes and works on a phone. People can do one between other tasks.
Free security awareness training for your whole team
Start with the eight-question quiz, or set up your team now.