How scoring works
Every score is calculated by fixed rules, so the same answer always earns the same points.
Each incident is worth 100 points
| Part | Points | What earns it |
|---|---|---|
| Finding red flags | 55 | Each real flag you find adds to this. Each false alarm takes away half a flag, so ticking everything does not work. |
| Right call | 15 | You chose Phishing or Legitimate correctly. |
| Your reasoning | 25 | You wrote a short, specific reason for each flag you found. Vague notes earn half; specific ones earn full marks. |
| Honest confidence | 5 | High confidence when you are right, and low when you are unsure, earns the most. |
Calling a genuine message phishing scores zero: real alerts matter too.
XP, ranks and the daily mission
Every incident earns XP from your score, the difficulty and whether your call was right. Six ranks: Recruit, Analyst, Hunter, Sentinel, Warden and Phish Master. A new daily mission appears each day; finishing it adds bonus XP.
Difficulty adapts: a strong recent average unlocks harder, more convincing incidents.
Certificate
Complete all five attack types with an average best score of at least 70. Research participants also finish the final check. The certificate has a QR code that anyone can scan to verify it.
How the AI is used
Gemini writes the incidents and can rate how specific your written reasons are. It never decides the points on its own: the score is computed by the app, and if the AI is offline a built-in set of incidents and a rule-based check take over.