Examples library
Learn the patterns.
Fictional messages that show common tactics, plus one ordinary message for comparison. Load any of them into the analyzer.
Showing 15 of 15 examples
- BankingSMSFictional
Bank OTP request
Northwind Bank ALERT: Unusual login detected on your account. To stop the transaction, share the OTP sent to your phone with our security team within 10 minutes or your account will be blocked.
- Asks for a code, PIN or password
- Creates time pressure
- Threatens account loss or legal trouble
- Claims to be from an organization or authority
Combines a request for a one-time code with a short deadline and a threat. A bank's real security team never needs your OTP.
Do not reply. Call the number on the back of your card or open the official bank app.
- DeliverySMSFictional
Parcel redelivery fee
Dear customer, QuickParcel could not deliver your package due to an unpaid redelivery fee of $1.99. Pay now at http://192.0.2.44/parcel-release within 24 hours to avoid return to sender.
- Requests money or an unusual payment
- Creates time pressure
- Link has unusual characteristics
- Uses a generic greeting
A tiny fee and a numeric web address are classic signs of a delivery scam designed to collect card details.
Check the order in the retailer's app or the courier's official site using the tracking number from your order confirmation.
- PrizesSMSFictional
Surprise prize notification
Congratulations! You have been selected as the winner of a free iPhone in our anniversary lucky draw. To release your prize, pay a small processing fee of $4.99 using a gift card. Offer expires tonight!
- Offers an unexpected prize, refund or job
- Requests money or an unusual payment
- Creates time pressure
You cannot win a draw you never entered. Paying a fee, especially with a gift card, to receive a prize is a hallmark of advance-fee fraud.
Ignore and delete it. Do not reply, as replies confirm your number is active.
- AccountsEmailFictional
Account suspension threat
Your Contoso Mail account has been suspended due to unusual activity. Verify your password at https://contoso-mail-verify-login.example/secure within 24 hours or your mailbox will be permanently deleted. Contoso Support Team
- Threatens account loss or legal trouble
- Asks for a code, PIN or password
- Creates time pressure
- Link has unusual characteristics
- Claims to be from an organization or authority
Asks for your password through a link whose domain only looks official, under the threat of losing your mailbox.
Open your mail app or type the provider's address yourself and check for alerts there.
- WorkplaceChatFictional
Colleague asks for gift cards
Hi, it's Priya from finance. I'm in a meeting and can't talk. I need you to buy 5 Steam gift cards of $100 each for a client today and send me the codes. Keep this between us until it's done, I'll reimburse you.
- Requests money or an unusual payment
- Discourages normal checks
- Asks you to keep it secret
Business requests never involve gift cards. Being unreachable plus secrecy stops you from checking with the real person.
Contact Priya through a channel you already use with her, or ask your manager, before doing anything.
- JobsEmailFictional
Internship with an upfront fee
Congratulations! You've been shortlisted for a remote Data Entry Internship at Fabrikam Labs. Earn $500 per week, no experience needed. To confirm your seat, pay a refundable registration fee of $49. Reply only to this number.
- Offers an unexpected prize, refund or job
- Requests money or an unusual payment
- Discourages normal checks
Real employers pay you, not the other way round. High pay for little experience plus a fee is a common student-targeted scam.
Look up the company's careers page yourself and ask your college placement office before responding.
- Tech supportChatFictional
Help desk remote access
This is the IT Help Desk. We detected a virus on your laptop. Please install AnyDesk immediately and tell us the 9-digit ID so our technician can fix it remotely.
- Asks you to install an app or share your screen
- Claims to be from an organization or authority
- Creates time pressure
Remote-access tools give a stranger control of your device. Unsolicited support contact plus urgency is a known tech-support scam pattern.
Do not install anything. Contact your organization's IT team through its usual portal or phone number.
- ShoppingEmailFictional
Look-alike payment page
Your Northwind Shop payment failed. Please update your card details at https://nоrthwind-shop.example/billing to keep your order.
- Requests sensitive personal details
- Link has unusual characteristics
- Uses hidden or look-alike characters
The “o” in the link is a Cyrillic letter that looks identical to a Latin one, so the address only resembles the real shop.
Open the shop's app or type its address yourself and check your order status there.
- InvestmentChat threadFictional
Wrong number that turns into investing
Mia: Hi! Is this Daniel? I was looking for my yoga teacher Me: Sorry, wrong number! Mia: Oh no, sorry! You seem so kind though. Where are you based? Me: I'm a student in Pune. Mia: Nice to meet you! I work in fashion, but my uncle is a financial analyst. Mia: Good morning dear, how was your day? Mia: My uncle showed me a crypto trading platform with 30% weekly returns. I made $4,000 last month! Mia: Let's move to Telegram, it's easier. Start with just $200 deposit at https://coinpeak-trade.example and I'll guide you.
- Builds trust first, then asks
- Pitches an investment or trading opportunity
- Requests money or an unusual payment
- Moves the conversation to another app
No single early message looks dangerous. The pattern is the build-up: an accidental contact, compliments and daily chat, then an investment pitch and a request to deposit money on an unfamiliar platform.
Stop replying and block the contact. Never invest through a platform suggested by someone you met online.
- UPIChatFictional
Marketplace buyer sends a QR “payment”
Hi, I am interested in your cycle and I have already paid. Please scan this QR code to receive Rs.8,500 in your account and enter your UPI PIN to confirm. I am in the Army so I cannot come today, please do it fast.
- Asks for your UPI PIN or to scan/approve a request
- Asks for a code, PIN or password
You never need to scan a QR code or enter your UPI PIN to receive money. The PIN only ever sends money out, so this “payment” would empty your account instead.
Decline the QR and any collect request. Only accept money that arrives in your account without you entering a PIN.
- BankingSMSFictional
KYC expiry message in Hindi
प्रिय ग्राहक, आपका बैंक खाता आज बंद हो जाएगा। तुरंत केवाईसी अपडेट करें: http://kyc-bank-update.example
- Asks you to update KYC or link PAN/Aadhaar
- Threatens account loss or legal trouble
- Creates time pressure
- Link has unusual characteristics
Written in Hindi to feel official and familiar. Banks do not close accounts by SMS or ask for KYC through a link; the link only imitates a bank's name.
Ignore the link. Check your KYC status inside your bank's official app or at a branch.
- UtilitiesSMSFictional
Electricity cut-off threat in Hinglish
Priy upbhokta, aapka bijli connection aaj raat 9:30 baje kat jayega kyunki pichhle mahine ka bill update nahi hua hai. Turant bijli officer se sampark karein.
- Threatens arrest, disconnection or a police case
- Threatens account loss or legal trouble
- Creates time pressure
A deadline tonight and a vague “bill not updated” reason push you to call an “officer” who will ask for payment or a remote-access app. Electricity boards send bills through official channels.
Check your bill in the electricity board's official app or website. Never call a number from such an SMS.
- GovernmentChat threadFictional
“Digital arrest” video-call script
Officer Sharma: This is Mumbai Cyber Crime branch. A parcel booked on your Aadhaar contains drugs and fake passports. Me: That is not mine! Officer Sharma: A case of money laundering is registered. You are under digital arrest. Stay on video call and do not tell anyone, even family. Officer Sharma: To prove you are innocent, transfer Rs.1,50,000 to the RBI verification account. It will be refunded after checking.
- Threatens arrest, disconnection or a police case
- Asks you to keep it secret
- Requests money or an unusual payment
“Digital arrest” does not exist in Indian law. Real police never keep you on a video call, demand secrecy, or ask you to transfer money to “verify” it.
End the call. Tell family, and report it to the national cyber-crime helpline (1930) or cybercrime.gov.in.
- EverydaySMSFictional
Appointment reminder
Hi Sam, this is a reminder that your appointment at Riverside Dental Clinic is on Thursday, 14 Nov at 3:30 PM. Reply C to confirm or call the clinic to reschedule. See you soon!
No warning signs expectedNo requests for money, codes or personal details, no links and no pressure. This is what an ordinary reminder looks like.
If you were expecting it, no action is needed. If you never booked, call the clinic using a number you look up yourself.
- BankingEmailFictional
Sign-in alert with mixed signals
Northwind Bank: A new device signed in to your account on 12 Nov. If this was you, no action is needed. If not, review your activity in the Northwind app or at http://northwind-account-review.example. We will never ask for your PIN or OTP.
- Link has unusual characteristics
It reads like a genuine alert and even warns you not to share your PIN. But the link uses plain http and a domain we cannot confirm. The safest path is the one it also offers: open the official app.
Ignore the link and check recent sign-ins inside the official app you already have installed.
All organizations, names, numbers and links in these examples are invented for training. Links use the reserved .example domain or documentation-only addresses and do not lead anywhere real.