When the scam finally comes, it probably won’t come to you. It’ll come to your mom, mid-afternoon, from a number that looks like her bank. And she won’t call the bank. She’ll text you.

“Is this real? They need me to read them a code.”

You have about ninety seconds. Whatever you know about phishing, this is the moment it either works or it doesn’t.

We’ve been building toward this moment for a while. Spot the Scam taught the PUSHED+VERIFY framework – recognize the emotional push, verify before you reply. Security Champion went deeper into how attacks are built and why they work on smart people. Both end the same way: with you, the reader, as the person your family turns to.

But knowing the framework and using it while someone you love is on the phone with a scammer are different skills. The second one needs reps. There was nowhere to get them.

That’s the gap this closes.

Champion Sim is our new free training simulator. It’s a full phone in your browser – home screen, messages, phone, banking app, Venmo, Find My, camera, calculator, the works. Eight scenarios, each about five minutes. No account required, nothing to install.

How It Works

You pick up the phone and it’s an ordinary day. You can check the weather. You can poke around the music app. Then a message lands – and it’s not a quiz question, it’s your mom, and she’s already twenty minutes into a call with “the bank.”

Nobody announces that a scenario has started. That’s the point. Scams don’t schedule themselves, so neither does the sim.

From there, everything is a real lever:

  • Coach by text. Quick replies when seconds matter, or type your own words when the situation needs them.
  • Pick up the phone. Some scams can only be beaten by calling the real person – like the “grandson” who needs bail money, who you can verify with one call to the actual grandson.
  • Take direct action. Freeze the account in the banking app. Open Find My and sign her MacBook out of every session while the “technician” still has her screen.
  • Wait. Also a lever, and the one the scammer is counting on. Do nothing long enough and the scenario resolves without you.

Every scenario ends one of three ways – Saved, Partial, or Lost – followed by a debrief that walks through what the scam was, what the tells were, and what the fastest path to Saved looked like. Then you can run it again.

The Scenarios

The eight scenarios are the scams that actually reach families right now: the bank impersonation call, the one-time-code read-back, the AI-voice “grandkid in jail” call, the long-burn romance scam, the tech support popup with a screen-share, the fake-check gig job, the hacked friend asking for gift cards, and the refund-that-becomes-a-wire.

If you took our AI vs. Real Voice quiz, scenario three is that skill under pressure – the voice on Grandpa’s phone sounds exactly like his grandson, because that technology is here and cheap. And if you took Security Champion, you’ll recognize the machinery from Module 2 – the playbook, the cognitive shortcuts, the manufactured urgency – except now it’s aimed at someone else, and you’re the only one who can see it.

Why a Simulator

Every phishing attack has the same weakness: it needs its target to act before they think. That’s been our message since the first PUSHED post. But almost all security training – ours included – prepares you for the day you’re the target. Statistically, you’re more likely to be the responder: the family member with the security instincts, watching it happen to someone else over text, with partial information and a clock running.

Responding is a different skill than recognizing. You’re not evaluating a suspicious email in your own inbox. You’re coaching a scared person who is already halfway convinced, without making them feel stupid, fast enough to matter. The sim is deliberately built around that second-person pressure – real levers, real-time, no pause button.

Who It’s For

If you finished Spot the Scam or Security Champion, this is your capstone. You have the framework. Come find out if you can run it under pressure.

If you’re the family point person – the one who gets the “is this real?” texts – you can skip the coursework and start here. The debriefs will teach you as you go, and the courses will be waiting if you want the theory afterward.

If you’ve been trying to get a parent or partner to take this stuff seriously, run a scenario with them watching. Losing a simulated mom to a simulated bank call lands harder than any bullet-point list of warning signs.

Why It’s Free

Empowerment over dependence. Same principle the rest of this site is built on.

The goal is to make you capable, not to make you reliant on us. Everything runs locally in your browser. No data is collected. No account is needed. Your progress saves automatically, so you can leave and come back without losing your place.

Pick Up the Phone

The next scam your family sees won’t announce itself. Now your practice doesn’t either.