Free · In this browser · Fictional
Choose Your Own Hack
You are the target. A text, a cafe network, a support call, or a phone that suddenly has no signal. Pick what you do. Each choice explains what the attacker was doing, and the ending recaps the path. Nothing is uploaded.
- Open it yourself The app or bookmark you already have beats the link in the message.
- Read the real name The site is the word just before the ending, not the brand painted on the page.
- Keep the code A one-time code is a key. It is not something you read aloud.
Pick a scenario
Endings found on this device load in this browser.
What do you do?
Arrow keys move between choices. Escape returns to the scenarios.
What this story is practicing
The hurry is the product. A charge you do not recognize, a file that locks tonight, a phone with no bars, a bill you meant to pay before a shift. Each of those is a reason to move fast, and moving fast is how a lookalike page gets a password. The four scenes here are fiction. Harborline, Northline, Cedar & Rye, Helio, and Pylon Mail are not real companies. The web addresses end in .example, which is reserved for examples, so there is no site on the other end and nothing to open.
The habit underneath all four is the same. Open the bank, the mail, or the biller from the app or the bookmark you already had. Read the site name just before the ending: in these scenes that ending is .example, and in ordinary life it is .com, .org, or a country ending. Extra words glued on, such as harborline-alert.example instead of harborline.example, are a different site that borrowed the brand. A phone number printed on a card or a bill was chosen before the message arrived. A number inside the message was chosen by the sender.
A code is a key
A six-digit code proves that a login can be finished. It does not prove that the person asking is the bank, the cafe, or you. Reading it to a caller, typing it into a page a text opened, or asking a friend to read one that arrived for them hands the key over. The story shows the result as an ending. It does not show how to request that code, because that is not the skill.
A support caller who can describe red lines in a log is describing something ordinary computers already have. The useful part of the call is the ask that comes next: open a site they spell, read a code, share the screen, or buy gift cards to return a refund that is too large. Gift card codes are cash. A refund you did not start, checked in the app you open yourself, is the way to see that the charge was never there.
What an ending means
You stayed safe means the password, the code, and the card never reached the person who wrote the message. A close call means you were on their page, or you had already typed something, and you stopped. In this story, they got in means the story treats the key as handed over. None of the three is a promise about the next real message. A real company can send a real deadline. When money or a password is involved, leave the message and open the service yourself.
Endings you reach are remembered only as ids in this browser. The path is not saved. When a real link shows up outside this page, the link checker reads the address without opening it. The phishing inbox practices the same cues on fictional mail. Tech Myth or Fact tests the claims people repeat about private browsing, public Wi-Fi, and passwords. The password you would have typed belongs in the password strength checker, which also stays on this device. The Password Habit Quiz scores reuse, a manager, and a second factor, and it never asks for a password.
FAQ
Does this upload my choices?
No. The story runs in your browser. The only thing saved is the list of ending ids you have reached, in this browser's local storage. The path, the lessons, and anything you might have imagined typing are not stored and are not sent.
Are the people and companies real?
No. Harborline, Northline, Cedar and Rye, Helio, and Pylon Mail are fictional. Every web address uses .example, which is reserved for examples and is not a live website. Phone numbers use the 555-01 exchange reserved for fiction.
Will this teach me how to attack someone?
No. You play the person being targeted. Each lesson names the trick in plain language, such as a link the sender wrote or a code a caller should never hear. It does not give steps, tools, or scripts for carrying an attack out.
Does an ending mean I would catch a real scam?
No. These are four fixed stories. A real message can be fake without these scenes, and a real company can send a deadline. When money, a password, or a one-time code is involved, open the service from an app or bookmark you already trust, or call the number printed on the card or the bill.
Where do discovered endings live?
Only in this browser, as a list of ending ids. Clearing site data for cyberscryb.com removes it. Replaying a scenario does not erase endings you already found. The choices on a path are forgotten when you leave or pick another story.