Online quiz scams: how a fun personality test can be phishing
Quick answer
Some online quizzes are built to collect answers that double as security questions, like your first car or your school. Some are shared from hacked accounts and carry malware links. If you can't tell who runs a quiz, skip it, and report it at ReportFraud.ftc.gov.
- Comes by
- Social media, Website
- First reported
- Latest official alert
- (FTC)
- Last updated
How it works
The FTC describes two ways scammers use quizzes.
The first is answer harvesting. Personality tests and quick surveys ask things that look harmless: the model of your first car, your favorite hobby, the high school you attended. Those are also the questions many sites use as account security questions. Scammers use your answers to try to reset your accounts, which can give them access to your bank and other accounts.
The second is the hacked-friend route. Scammers take over a social media account and send malware links to the owner's friends, dressed up as a quiz to share.
Either way, the quiz is the bait. What they're after is account access and personal data, not a score.
Red flags
- A quiz that asks for answers you'd use as security questions: first car, school, mother's maiden name, first pet
- No clear information on who runs the quiz or what they do with your answers
- A quiz link sent by a friend whose account is acting strangely
- A quiz that asks you to log in, download something or install an extension
- Asking you to share the result so your friends can "take it too"
Example message
I just found out which Marvel character I am, and it was scary accurate! Take the quiz and see yours: [link]
What to do
- 1
Don't answer, or don't answer truthfully
The FTC's advice is to steer clear of online quizzes, or not answer them truthfully. Don't click the link, and tell the friend it may be a scam.
- 2
If you answered, change what the answers protect
If any answer doubles as a security question on an account, change that answer. The FTC suggests treating security questions like extra passwords: use random, long answers, and store them in a password manager.
- 3
If you logged in or downloaded something
Change the password for that account, and for any account that shares it. Turn on multi-factor authentication.
- 4
If your own account sent the quiz
Reset your password, turn on multi-factor authentication, and warn your friends not to open the link.
- 5
Report it
Tell a friend, then report the quiz at ReportFraud.ftc.gov.
Report it
Check if your details are exposed with Serus
Scammers find your number and address on data brokers and people-search sites. Serus removes them.
Why you got it
A quiz works best when the scammer already knows a little about you. Your name, email address and the people you're connected to are easy to find on people-search sites, and they turn up in breaches too. Serus finds the data brokers that list you and removes the listings, and alerts you when your details appear in a breach, so there's less for a scammer to start from. If you gave answers or a password to a quiz, our guide on what to do after a data breach covers the next steps.
Official alerts
Frequently asked
Are all online quizzes scams?
No. The FTC's point is that you often can't tell who is collecting your answers or what they'll do with them, and the more you share, the more you risk it being misused.
Why do quizzes ask about my first car or my school?
Those are common account security questions. The FTC says scammers use quiz answers to try to reset your accounts and steal bank and other account information.
A friend sent me a quiz. Is it safe?
Not necessarily. The FTC says scammers hack social media accounts and send malware links to the account holder's friends as a shared quiz. Check with your friend another way before you click.
How do I make security questions safer?
The FTC suggests treating them like extra passwords: give random, preferably long answers, or store a unique answer in a password manager.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
