Highlighted wordsare glossary terms — tap one for a plain-language definition.
Online quizzes, polls, and sweepstakes look like harmless fun — and that's exactly what makes them work. The answers feel trivial, but they can double as the answers to your account security questions, and a 'prize' that asks for a fee or your bank details is always a scam. [1, 2, 3]
Why quizzes harvest your data
Personality tests and 'What was your first car?' quizzes ask the same kinds of questions banks use to verify identity. The FTC warns that scammers phish for security-question answers through quizzes, then use them to reset your accounts and take over your email and bank logins. The more questions you answer truthfully, the more of your identity you hand over — and you rarely know who is collecting it or where it goes. [1]
- Treat every quiz question as public — never answer with anything a bank might use to verify you.
- Ask who built the quiz and what they get out of your answers before you start.
- A quiz that requires signing in with your email or social account is asking for more than fun.
Sweepstakes that ask you to pay
The FTC's prize-scam rules are simple: if you have to pay to get your prize, it's a scam; if you have to pay to increase your odds of winning, it's a scam; and if you have to give your financial or Personal informationWhat it means: Information that identifies or can be connected to a person.Example: Your full name together with your birthdate and home address.What to do: Share only the minimum a form actually requires.Important: Small details combined are enough for identity theft.What does this mean? to claim it, it's a scam. Real prizes are free — there is never a legitimate 'tax,' 'shipping fee,' or 'processing charge' you settle first, and no real sweepstakes needs your bank account or Social Security number to hand you a gift. [3]
- Real prizes are free — any fee before payout means walk away.
- Never give bank, card, or identity numbers to claim a prize.
- Didn't enter the contest? Then you didn't win — that message is bait.
How the game spreads
These scams lean on the same tools as every other con: a trusted sender (your friend's account, a brand you know), an urgent request ('only 3 spots left!'), and a link or attachment that does the damage. The FTC has also seen attackers hack social media accounts and send MalwareWhat it means: Software designed to damage, spy on, disrupt, or gain unauthorized access to a device.Example: A “free video player” download that quietly installs something else.What to do: Install apps only from official stores and keep automatic updates switched on.Important: Pop-ups warning that your device is infected are usually the scam itself.What does this mean? links to the account holder's friends under the guise of sharing a quiz — so a quiz link from someone you trust is not automatically safe. [1, 2]
- A quiz link from a friend can come from a hacked account — check before you tap.
- Urgency and 'everyone's doing it' are pressure tactics, not proof.
- Unexpected links and attachments in quiz results stay unopened.
Play, but play it safe
The FTC's advice is blunt: steer clear of online quizzes — or don't answer them truthfully. For accounts that genuinely use security questions, treat the answers like extra passwords: use random answers, and store them in your Password managerWhat it means: Software that generates, stores, and fills unique account passwords, and may also manage passkeys or other credentials.Example: The manager generating and filling a 20-character password you never have to recall.What to do: Set one up and move your email, banking, and cloud passwords into it first.Important: Protect it with one strong passphrase plus MFA, and never share that passphrase.What does this mean?. If you suspect a quiz is a PhishingWhat it means: A deceptive email or message designed to make you click, share information, send money, or give account access.Example: An “unpaid delivery fee” text with a link to a page that looks like the post office.What to do: Don't tap links in unexpected messages — open the company's app or type its address yourself.Important: Real companies never ask for your password or a login code by message.What does this mean? scam, don't share it, and report it to the FTC at ReportFraud.ftc.gov so the next person sees it sooner. [1, 3]
- Give fun quizzes fake answers — a superhero result doesn't need your real first car.
- Answer real security questions with random words you store in your password manager.
- Suspect a scam quiz? Report it at ReportFraud.ftc.gov instead of sharing it.
Why Hygi. recommends this — the guidance above follows these published sources:
FTC
Don't answer another online quiz question until you read this(opens in a new tab)Quiz answers phished for security-question data, malware spread via shared quizzes, and random answers for real security questions.
Microsoft
Protect yourself from online scams and attacks(opens in a new tab)The common anatomy of online scams: a trusted sender, an urgent request, and a link or attachment.
FTC
Fake Prize, Sweepstakes, and Lottery Scams(opens in a new tab)The three signs of a prize scam: pay to get the prize, pay to improve odds, or give financial or personal information.
Brought to you by NorthBridge
Unfamiliar term? Open the Digital Safety Glossary