Welcome! Thank you for all of your work in support of the LGBTQ+ community worldwide. We want to make sure that you have all of the knowledge to stay safe online and minimize risk of exposure.
Every scenario in this anonymous quiz is built from a real, documented incident — things that have actually happened to LGBTQ+ people and organizations.
This isn’t a test you pass or fail. It’s a walk through of decisions other people in our community have actually faced, with a chance to think through your move before you’re the one facing it. We’ll explain not just what the safer choice was, but why the other options are still worth understanding.
Start here, and then make your way to the various sections of the website.
You’ve been chatting with someone on a dating app for a few days. The conversation feels easy, their profile seems real, and you’re starting to trust them. They suggest meeting up, but instead of a coffee shop, they ask if you’d rather come to their apartment since it’s “more private and relaxed.” What do you do?
A private location on a first meeting removes every safety net you have — no witnesses, no easy exit, no one else who knows where you are. It doesn't mean the person is lying about who they are, but you have no way to verify that yet, and "private and relaxed" is also exactly what someone with bad intentions would say. A busy public place plus a friend who knows your plan costs you nothing if the date is genuine, and protects you completely if it isn't.
You attend a community event. You don’t post anything yourself, but a friend tags you in a group photo, and someone else uploads a short video of the event. A few days later, strangers start commenting on your public accounts referencing the event. What went wrong, and what should you check before this happens again?
You can control your own posts, but you can't control what friends post — you can control whether their tags automatically attach to your profile, and whether your account is public enough that a stranger stitching together a few posts can build a picture of your life. "I didn't post it" doesn't make you invisible if the platform lets other people post you. Check out the section of the website called Two-Factor Authentication if you want to get started.
An intimate video from a past relationship ends up with someone outside that relationship, who now recognizes you in it. They message you: pay, or they send it to your family, your employer, and list several relatives by name to prove they mean it. What’s the right first move?
Paying doesn't make the files disappear — there's no guarantee, and it can mark you as someone who will pay, inviting more demands. Negotiating keeps you in a conversation that only benefits the blackmailer. The move that actually protects you is disengaging, keeping the evidence (you'll want it for support organizations and possibly legal routes later), and getting guidance from people who've handled this before you decide whether to involve law enforcement — which may or may not be safe depending on where you live.
Your organization runs a public website and social pages to share resources and attract donors. A hostile account starts a campaign naming LGBTQ+-friendly organizations, using screenshots from your own public site and event photos, and encourages followers to "report" or "confront" you. Individually, none of this info seemed sensitive when you posted it. What’s the underlying failure here?
Nothing here required a technical breach — the attackers just collected what was already public and combined it. That's the core lesson: information that looks harmless in isolation (a staff bio, a location tag, a group photo) becomes a targeting map once someone assembles it. Regular audits of what's publicly discoverable about your org are what catch this before an attacker does.
Your Programme Manager gets an email that looks exactly like it's from a donor you've worked with before — right logo, right tone, even the name of a real programme officer. It says a new emergency grant closes in 48 hours, with a link to "log in and download the application." What should have happened before anyone clicked “log in”?
Urgency is the tell, not a reason to move faster — real donors don't typically create 48-hour panic windows. Replying to the email or clicking through keeps you inside the attacker's system, where even a "legit-looking" reply could come from them. The only verification that actually counts is one that uses a channel you already trust, independent of anything the email told you to use.
Overnight, your team gets several password reset emails for the org's Facebook, Google Workspace, and website admin accounts. The next day, someone calls the Executive Director claiming to be from your hosting provider, saying "urgent maintenance" requires the admin password right now. What’s the correct response to the phone call?
No legitimate hosting provider, and no legitimate Meta/Google/Microsoft rep, needs your password read to them over the phone — that's not how account recovery works on any real platform. The password reset emails plus the phone call plus the fake "copyright violation" login page were all part of one coordinated attempt. The fix is refusing in the moment and verifying independently, every time — not partially complying to "test" it.
A staff member uses the same password for their personal email and the org's Canva account. Months earlier, that personal email address was part of an unrelated data breach they never heard about. Attackers later test that leaked password against hundreds of other sites automatically — and it works on Canva, Mailchimp, your website, and a cloud storage account. What single practice could have prevented this entire chain?
Length alone doesn't help if the same password is reused elsewhere and leaked in a breach you don't even know happened — this is credential stuffing, and it works precisely because people reuse passwords across services. A password manager makes unique passwords realistic to maintain, and MFA is what actually stopped the attackers from reaching the org's financial systems in the real version of this case.
A staff member's personal phone — used for years for both personal and work purposes — is stolen while traveling. It had beneficiary names and contacts, WhatsApp conversations with community members, grant agreements, financial spreadsheets, and passwords saved in browser notes. It only had a basic PIN. What’s the organizational failure, separate from the theft itself?
A stronger PIN helps, but it's a single point of failure fix for a systemic problem: nobody had decided what should and shouldn't live on a personal device, so sensitive files, saved passwords, and beneficiary data just accumulated there over years, unreviewed. The real fix is architectural — keep sensitive info in cloud systems people access rather than download, and define that in a BYOD policy — not just "lock your phone better."