Inspiration
People around me, including classmates and family members, have fallen for phishing emails even though they had sat through security training. That training is usually a slideshow and a quiz, and it doesn't stick. What does stick is a physical habit, like checking who a message is really from before you trust it. I wanted to turn that habit into a motion your hands remember. An inbox full of messages became a tank full of fish, and some of those fish are trying to hook you.
What it does
Phish Tank is a seated, hands-only mixed reality game for Meta Quest. Your real laptop screen becomes a glowing inbox portal (when your room scan includes it), and every email swims out as a fish. Pinch a fish to catch it, and the email (sender, subject and message) floats above it. Turn your hand over to see the fish's belly, its "true colors": the real sender address and the true link destination, which are the clues scammers hide. Then throw the fish into the red SCAM net or the green SAFE inbox.
Correct sorts build combos up to 5x, and inspecting the belly first earns an inspector bonus. A mistake costs a life, and a feedback panel explains exactly which clue you missed. Five levels add harder, subtler fakes: lookalike domains, fake delivery notices and urgent bank warnings. Every correct sort grows your personal aquarium on your desk, unlocking new decorations and fish, so your progress is something you can see.
How I built it
I built Phish Tank in Unity 6 with the Meta XR SDK and OpenXR, using the Universal Render Pipeline and passthrough so you play in your own room.
- Interaction SDK: hand grabbing (close pinch-grab and distance grab), throwing, and pinch-to-press orb buttons.
- Mixed Reality Utility Kit (MRUK): reads the room scan. The nearest real screen becomes the inbox portal and a nearby table holds the aquarium, so your real room changes the game. Without a scan, the game falls back to a comfortable layout around the seated player.
- Content as data: the 24 emails live in a JSON file with a difficulty level, the clues and an explanation for each one, so new lessons can be added without code.
- No imported art or audio: the fish meshes, particle effects, sound effects and music are all generated in code.
- Testing: I tested in the Meta XR Simulator with webcam hand tracking, an editor test panel and automated full playthroughs of all five levels.
How hand interactions are implemented
Hands are the whole controller. Every action maps to a natural gesture:
- Pinch to catch. Each fish has a HandGrabInteractable for close pinches and a DistanceHandGrabInteractable, so you can grab fish slightly out of reach without leaning, which matters for seated play. The grab events open the email card.
- Turn your hand over to inspect. While you hold a fish, the game checks its orientation. Roll your wrist so the fish is belly-up and the card switches to TRUE COLORS, revealing the real address and link destination. This flip is the core teaching moment: it turns "check the sender before you trust it" into a gesture.
- Throw to decide. Throw the fish toward a net, or simply let go to the left (SAFE) or right (SCAM) of center: a throw assist reads where you released it and which way your hand was moving, then glides the fish into that net. That keeps sorting easy while seated, with no reaching down. Letting go in the middle puts the fish back. Fish that drift into a net by themselves never score.
- Pinch the orbs. The menus have no laser pointers: you pinch a glowing orb to start, continue or replay.
- Seated and in arm's reach. The play area recenters on your head when the game starts, and everything sits within a comfortable reach. The whole experience works without standing and without ever pairing a controller.
Challenges I ran into
This was my first VR project and my first time using Unity. TextMeshPro text first rendered invisibly in the stereo view, so I rebuilt the interface as 3D world-space panels. Fish also kept sorting themselves by swimming into the nets, so only fish you release can score. Precise throws were hard while seated, so I added the left/right throw assist. I also had to fit every panel into a seated field of view without anything overlapping.
Accomplishments that I'm proud of
The flip-to-reveal gesture. It makes a dry security habit feel like a discovery, and in my own playtests flipping before every throw quickly became a habit.
What I learned
How to design for hands instead of controllers, how mixed reality scene understanding works, and that a lesson sticks much better when there's a gesture attached to it.
What's next for Phish Tank
- More lesson packs: text-message scams (smishing), QR code scams and fake job offers
- A classroom mode, so teachers can load their own example emails
- A shared tank, where friends play together in mixed reality
- Localization, including Kyrgyz and Russian
- Launch on the Meta Horizon Store
What excites me about VR
VR lets you learn with your body, not just your eyes. When your hands do the lesson, by grabbing, flipping and throwing, you remember it. Mixed reality takes that further: the game happens on your own desk and comes out of your own laptop, the same place the real scams arrive. I'm excited that one headset can turn any room into a classroom that feels like play.
