Scam gallery: 100 annotated fictional examples
The example messages, calls and screens written for each attack in the encyclopedia, gathered on one page and sorted by channel. Each one is followed by what gives it away and the psychological lever it pulls; the full explanation stays on the attack's page.
Fictional examples — no real organization, person or address.
How to read an example
- The message: as it arrives, and in what circumstances.
- What gives it away: the observable clues, without opening anything.
- The lever: the psychological trigger that pushes you to act fast.
- The simulation: the same kind of message, to practice deciding.
- Deciding: the questions to ask, in order, on the attack's page.
- Protecting yourself: the habits that keep it from happening again, on the attack's page.
Email — 13 examples
Extortion following a data breach
Email received a few days after an online store announced a data breach.
We hold your data from the store's database: name, address, order history, customer number 48213. Send the equivalent of €300 in cryptocurrency within 72 hours, or it will be published.
What gives it away
- The data quoted is real, but already out of anyone's control.
- Nothing guarantees it will be deleted if you pay.
- Payment in cryptocurrency leaves no recourse.
Practice — Extortion following a data breachQuestions to ask — Extortion following a data breachProtect yourself — Extortion following a data breach
Fake hacking blackmail
Email from an unknown address, with an old password in the subject line.
I know your password: soleil2016. I hacked your camera and recorded what you were doing. Send the equivalent of €1,200 in cryptocurrency within 48 hours, or I'll send the video to all your contacts. Don't reply to this message.
What gives it away
- No excerpt, no proof: only claims.
- The password quoted comes from an old data breach.
- Nothing in the text is actually about you personally.
Practice — Fake hacking blackmailQuestions to ask — Fake hacking blackmailProtect yourself — Fake hacking blackmail
Fake traffic fine
Text message received on a Monday morning.
TRAFFIC FINE NOTICE: unpaid parking on 06/12. Amount: €35, increased to €75 without payment within 48 hours. Pay at amendes-reglement.example-not-real.test
What gives it away
- A fine notice by text, with a payment link.
- An immediate penalty increase to rush payment.
- A domain that isn't the official service's.
Practice — Fake traffic fineQuestions to ask — Fake traffic fineProtect yourself — Fake traffic fine
Fake invoice
Letter received by the person who pays a small company's invoices.
RENEWAL NOTICE — Domain name your-company.test Payable within 8 days to avoid losing your domain name. Amount: €189 incl. tax, by transfer to the IBAN shown.
What gives it away
- The sender isn't the registrar shown in your customer account.
- Nobody in the company remembers ordering this service.
- In the fine print, the document describes itself as a mere offer.
Practice — Fake invoiceQuestions to ask — Fake invoiceProtect yourself — Fake invoice
Fake prize, fake lottery
Email received at a personal address.
Congratulations! Your address was selected in the grand international draw. You've won €850,000. To release the transfer, pay the €290 processing fee to our partner notary. Please keep this information confidential until the payment.
What gives it away
- You never entered any draw.
- Fees are requested before the prize.
- The secrecy you're asked for cuts you off from people who would tell you it's fake.
Levers:RewardThe lure of profitUrgency
Practice — Fake prize, fake lotteryQuestions to ask — Fake prize, fake lotteryProtect yourself — Fake prize, fake lottery
Fake wire transfer order (CEO fraud)
Email received by a small company's accountant, on a Friday at 5:40 pm.
Subject: Confidential transaction Hello, We're finalizing an acquisition and I need you to make a €48,500 transfer today to the attached account. Please handle this with complete discretion, without mentioning it for now. I'm in a meeting: reply by email only. The CEO
What gives it away
- Confidentiality toward colleagues is demanded.
- The usual procedure is bypassed.
- The requester can't be reached by phone.
Levers:AuthorityUrgencySocial pressure
Practice — Fake wire transfer order (CEO fraud)Questions to ask — Fake wire transfer order (CEO fraud)Protect yourself — Fake wire transfer order (CEO fraud)
Fake refund
Email received, apparently from your internet provider.
Subject: €63.40 refund pending Following a double billing, you are owed a refund. To receive it, enter your bank card before 04/30: rembourse-client.example-not-real.test
What gives it away
- You're asked for a card to receive money.
- A deadline to "claim" a refund.
- A refund you never asked for.
Levers:RewardThe lure of profit
Practice — Fake refundQuestions to ask — Fake refundProtect yourself — Fake refund
Fake bank details change
Email received in the usual thread with a supplier, the day before a due date.
Hello, following a change of bank, please pay the attached invoice to our new details (IBAN below). The old account will no longer be credited from today. Accounts department, fournisseur-exemple.test
What gives it away
- The only change is the IBAN, announced by a simple email.
- The new bank is different, sometimes in another country.
- The message leaves no way to confirm other than replying.
Practice — Fake bank details changeQuestions to ask — Fake bank details changeProtect yourself — Fake bank details change
AI-generated phishing
Email received on a Monday in your bank's name, without a single mistake.
Hello Claire, following the update to our terms and conditions on October 1, we invite you to confirm your login information in order to keep access to your account. This only takes two minutes: espace-clients.example-not-real.test
What gives it away
- The quality of the writing says nothing about the sender.
- The link's domain isn't your bank's.
- A bank doesn't have you confirm credentials through a link.
Practice — AI-generated phishingQuestions to ask — AI-generated phishingProtect yourself — AI-generated phishing
Phishing
Email received on a Monday morning, apparently from your energy supplier.
Subject: Your customer account will be deactivated Hello, We were unable to confirm your details. Without action on your part within 24 hours, your customer account will be deactivated. Confirm my information: https://espace-client.energie-verif.example-not-real.test Customer service
What gives it away
- The link goes to a domain that isn't your supplier's.
- A 24-hour deadline with no specific reason.
- "Hello" without your name, although the supplier knows it.
Practice — PhishingQuestions to ask — PhishingProtect yourself — Phishing
Email account takeover
One morning, several reset emails arrive for services you didn't contact.
Subject: Reset your password A reset request was made for your account. If you did not make this request, ignore this message.
What gives it away
- Several different services at the same time.
- Requests you didn't make.
- These emails may be genuine: they signal that someone is trying to use your address.
Lever:Trust
Practice — Email account takeoverQuestions to ask — Email account takeoverProtect yourself — Email account takeover
Resale of personal data
Entry form for a contest in a shopping mall.
☑ I agree to receive offers from our selected partners. [Submit my entry]
What gives it away
- The box is pre-checked.
- The partners aren't named.
- The data requested goes beyond what the contest needs.
Questions to ask — Resale of personal dataProtect yourself — Resale of personal data
Identity impersonation
Email received at work, shown under the name of a colleague you know well.
From: Julien Martin <julienmartin-bureau@messagerie-exemple.test> Hi, I'm traveling and my phone is dead. Could you buy four gift cards for a client and send me the codes? I'll pay you back tomorrow. Reply to me here instead.
What gives it away
- The name is right, but the address isn't the company's.
- The request isn't like anything this colleague usually asks.
- He asks you not to use the usual channel.
Questions to ask — Identity impersonationProtect yourself — Identity impersonation
Text message — 3 examples
Premium-rate subscriptions and SMS
Text from a short code, on a Saturday.
Congratulations, you've been selected to win a smartphone! Reply YES to confirm your entry.
What gives it away
- You never entered any contest.
- Replying with a word can count as subscribing to a paid service.
- The service's price isn't stated anywhere in the message.
Practice — Premium-rate subscriptions and SMSQuestions to ask — Premium-rate subscriptions and SMSProtect yourself — Premium-rate subscriptions and SMS
Fake courier / package on hold
Text received on a Tuesday, while you are in fact expecting an order.
Your package no. FR38261 is on hold at the sorting center. A redelivery fee of €2.49 is required: livraison-relais.example-not-real.test/r
What gives it away
- No carrier is named, just a "sorting center".
- The tracking number isn't in your order confirmation.
- Fees to pay through a link for a package that's already paid for.
Practice — Fake courier / package on holdQuestions to ask — Fake courier / package on holdProtect yourself — Fake courier / package on hold
Smishing (SMS phishing)
Text message received at the end of the day, shown under your bank's name.
Your card has been suspended following unusual activity. To reactivate it: bq-securite.example-not-real.test/c/8KQ2
What gives it away
- A bank doesn't have you reactivate a card from a text link.
- The domain isn't your bank's.
- No verifiable detail: no amount, no merchant.
Practice — Smishing (SMS phishing)Questions to ask — Smishing (SMS phishing)Protect yourself — Smishing (SMS phishing)
Phone — 9 examples
Voice cloning
Call from an unknown number one evening; you recognize your nephew's voice.
"It's me… I had an accident, I need €2,000 right now for the lawyer. Please don't call Mom, she'll panic."
What gives it away
- An unknown number for a relative whose number you have.
- An immediate request for money.
- The instruction to tell no one.
Levers:FearUrgencyTrustSocial pressure
Practice — Voice cloningQuestions to ask — Voice cloningProtect yourself — Voice cloning
Two-factor authentication bypass
Call received a few seconds after a text containing a code, in the evening.
Hello, this is your email provider's security team. We're blocking a fraudulent login on your account right now. To cancel it, I need the six-digit code you just received by text.
What gives it away
- A code is used to log in, never to cancel a login.
- No service calls to have a code read out to it.
- The call follows the code too closely: the caller triggered it.
Practice — Two-factor authentication bypassQuestions to ask — Two-factor authentication bypassProtect yourself — Two-factor authentication bypass
SIM swapping
Text received late in the evening, a few minutes before the phone loses signal.
Your request for a new SIM card has been received. It will be activated in the next few minutes. If you did not make this request, contact your carrier.
What gives it away
- You didn't request a new SIM card.
- The phone loses signal right after, with no announced outage.
- Password reset emails arrive right after.
Practice — SIM swappingQuestions to ask — SIM swappingProtect yourself — SIM swapping
Fake government official
Text message received on a Friday late afternoon.
Adjustment notice: an overpayment of benefits has been found on your file. Without settlement within 48 hours, collection proceedings will begin. Access your file: regularisation-dossier.example-not-real.test
What gives it away
- A real procedure leaves a trace in your official online account or by mail.
- The link doesn't lead to the agency's website.
- A 48-hour deadline set on a Friday evening is there to prevent any checking.
Practice — Fake government officialQuestions to ask — Fake government officialProtect yourself — Fake government official
Fake bank advisor
Call on a Friday evening from an "advisor" who knows your name and your branch.
"A transfer of €1,870 abroad is pending on your account. I'm going to block it, but you'll receive a notification in your app: accept it so that the cancellation goes through."
What gives it away
- Accepting a notification never blocks a transaction: it authorizes it.
- The call comes when the branch is closed.
- Knowing your name and branch proves nothing: that information circulates after data breaches.
Practice — Fake bank advisorQuestions to ask — Fake bank advisorProtect yourself — Fake bank advisor
Fake tech support
While searching online, the browser goes full screen with a warning sound.
SECURITY ALERT — Your computer has been blocked. Spyware has been detected. Do not close this page. Call technical support immediately at [number shown] to avoid losing your data.
What gives it away
- A web page can't scan your computer.
- No software company puts a phone number to call in an alert.
- The order not to close the page is there to stop you from closing it.
Practice — Fake tech supportQuestions to ask — Fake tech supportProtect yourself — Fake tech support
Pretexting (fabricated scenario)
Call to a company's switchboard, on a Tuesday morning.
Hello, I'm with the firm running the internal audit for the finance department. I'm updating the list of authorized people: could you confirm who currently approves wire transfers, and their direct number? I don't want to bother management over something this small.
What gives it away
- Nobody told you about this audit.
- The question is about the organization, not a specific case.
- The caller avoids exactly the person who could confirm their role.
Levers:TrustAuthoritySocial pressure
Practice — Pretexting (fabricated scenario)Questions to ask — Pretexting (fabricated scenario)Protect yourself — Pretexting (fabricated scenario)
Swatting (fake emergency report)
Message spotted on a forum where your address was published the day before.
Tonight, we're sending him a little visit. He'll get the message.
What gives it away
- Your address was published in a hostile context.
- A "visit" is announced.
- A harassment raid came first.
Levers:FearSocial pressure
Questions to ask — Swatting (fake emergency report)Protect yourself — Swatting (fake emergency report)
Vishing (voice phishing)
Call received on a weekday; the number shown is your phone carrier's.
"Hello, this is your carrier's security department. We're seeing a request to transfer your line. To cancel it, I'm sending you a code: can you read it to me as soon as it arrives? Above all, don't hang up, or the procedure will be lost."
What gives it away
- You're asked to read out a code you receive: that's exactly what the caller is after.
- The order not to hang up blocks the only check that works.
- The number displayed can be faked.
Practice — Vishing (voice phishing)Questions to ask — Vishing (voice phishing)Protect yourself — Vishing (voice phishing)
Messaging app — 4 examples
Classified ad scam
You're selling a bike on a classified ads platform.
"Hello, I'll take the bike at the listed price. I'm far away, a courier will pick it up. I've made the payment, you just need to confirm it here: paiement-annonces.example-not-real.test/valider. Be quick, the courier comes tomorrow."
What gives it away
- No questions about the item, no negotiation.
- A link to "confirm" a payment you're receiving.
- The conversation has left the platform's messaging.
Levers:UrgencyTrustThe lure of profit
Practice — Classified ad scamQuestions to ask — Classified ad scamProtect yourself — Classified ad scam
ID document fraud
Message received on a messaging app after posting an ad to sell a car.
Hello, I'm very interested in your car. Before I travel, the platform asks me to verify your identity: could you send me a photo of both sides of your ID card, and a photo of you holding it?
What gives it away
- A buyer has no reason to verify the seller's identity before seeing the car.
- The platform doesn't go through a stranger to verify sellers.
- A photo of you holding the ID is used to open accounts in your name.
Practice — ID document fraudQuestions to ask — ID document fraudProtect yourself — ID document fraud
Sextortion
Message received right after a video call with someone met online a few days earlier.
I recorded our call. Here's your list of friends (screenshots of your contact list). Send €500 before tonight, or I send them everything.
What gives it away
- The tone changes all at once, right after the call.
- Your contact list comes from your public profile.
- The very short deadline is there to keep you from talking about it.
Levers:FearUrgencySocial pressure
Impersonating a relative by message
Message received on a messaging app, from an unknown number.
Hi it's me, I dropped my phone, this is my new number. Can you help? I have a €980 bill to pay today and my bank doesn't work on this phone. I'll pay you back tomorrow. I can't call, the mic is broken.
What gives it away
- The message never says who's writing: it lets your mind fill in the name.
- A request for money within the first messages.
- A ready-made reason not to call.
Levers:TrustUrgencySocial pressure
Practice — Impersonating a relative by messageQuestions to ask — Impersonating a relative by messageProtect yourself — Impersonating a relative by message
Social media — 13 examples
Romance scam
Daily conversations for two months with someone met on a social network, who says they work on an offshore platform.
"I've never met anyone like you. My salary is frozen until the end of the assignment and I have to pay €1,400 in visa fees, otherwise I can't come and see you. I'll pay you back as soon as I arrive, I promise. Don't tell anyone, they wouldn't understand."
What gives it away
- Meeting in person depends on a payment.
- You're asked to keep it from the people around you.
- The job described explains in advance why there's never a video call.
Levers:TrustUrgencySocial pressure
Practice — Romance scamQuestions to ask — Romance scamProtect yourself — Romance scam
Cyberharassment
Comments received over one week under your posts, several of them after you blocked someone.
"You again? Nobody asked for your opinion." "Everyone's laughing at you, you know." New account, created yesterday: "Did you really think you could block me?"
What gives it away
- The messages keep coming: repetition is what makes it an offense.
- A new account appears after each block.
- The tone aims to isolate you.
Levers:Social pressureFear
Questions to ask — CyberharassmentProtect yourself — Cyberharassment
Deepfake video
Promotional video in a social media feed, where a well-known TV host speaks to the camera.
I doubled my savings in three months thanks to this platform. Spots are limited, sign up today at placement-rapide.example-not-real.test
What gives it away
- No identifiable media outlet reports this statement.
- The account spreading the video was created recently.
- A promise of quick gains points to an unknown platform.
Practice — Deepfake videoQuestions to ask — Deepfake videoProtect yourself — Deepfake video
AI misuse of photos
Private message from an unknown account, on a social network where your profile photo is public.
I have photos of you that you wouldn't want going around. Look (blurred preview). Send €200 before tomorrow, or I send them to all your contacts.
What gives it away
- You never sent these images: they're fabricated from your public photos.
- The deadline is there to keep you from talking about it.
- Paying wouldn't stop the demand.
Levers:FearSocial pressureUrgency
Practice — AI misuse of photosQuestions to ask — AI misuse of photosProtect yourself — AI misuse of photos
Non-consensual sharing of intimate images
Message from a friend, late in the evening.
I'd rather tell you: someone shared photos of you in a group chat. I didn't pass anything on. Do you want me to send you the group's name so you can report it?
What gives it away
- The sharing targets the people in your real life: that's where the perpetrator wants to cause harm.
- Time matters: the sooner it's reported, the fewer copies.
- You are the victim, not the one at fault.
Levers:Social pressureFear
Questions to ask — Non-consensual sharing of intimate imagesProtect yourself — Non-consensual sharing of intimate images
Doxxing
Post spotted by a friend on a forum where you're being criticized.
For anyone who wants to tell him what they think to his face: he works at [employer], in [neighborhood], and here's a photo of him outside his home.
What gives it away
- Your information is gathered so that others can use it.
- The call to action comes from someone other than the author.
- A public photo made it possible to locate your home.
Levers:FearSocial pressure
Personal data exposure
Game shared on a social network by several friends.
Your star name: your first pet's name + the town where you were born. Answer in the comments! Mine: Caramel Montauban
What gives it away
- These are two common security questions for recovering an account.
- The answers are public and tied to your name.
- The game offers nothing beyond collecting those two pieces of information.
Levers:TrustSocial pressure
Questions to ask — Personal data exposureProtect yourself — Personal data exposure
AI-generated fake profile
Connection request on a professional network, from a recruiter.
Hello, your profile is a perfect match for an open position at one of our clients. Can we continue on a messaging app, to move faster? I'll send you the application file.
What gives it away
- A single, very sharp photo on a blurred background.
- The account is a few weeks old, with no verifiable mutual connections.
- The conversation is quickly moved off the platform.
Practice — AI-generated fake profileQuestions to ask — AI-generated fake profileProtect yourself — AI-generated fake profile
Data scraping
Message received on a professional network.
Hello Claire, as head of accounting at your employer in Nantes, you're probably affected by the invoicing reform. I'm sending you our guide: you just need to log in to our portal.
What gives it away
- The message quotes your job, your employer and your city, all public.
- The sender doesn't know you.
- The precision is there to make the login request believable.
Lever:Trust
Questions to ask — Data scrapingProtect yourself — Data scraping
Fake job offer
Message received on a messaging app, without your having applied.
Hello, your profile caught our attention for a remote administrative assistant position, 2 hours a day, €1,800 a month. To finalize your hiring, send a photo of both sides of your ID and your bank details. Start date Monday.
What gives it away
- An offer you didn't ask for.
- A hire without an interview.
- Documents requested before any contract.
Levers:RewardThe lure of profitUrgency
Practice — Fake job offerQuestions to ask — Fake job offerProtect yourself — Fake job offer
Social media account takeover
A friend receives a private message from your account.
"Hey! I'm in a contest, can you vote for me? You'll get a code by text, send it back to me, it's to confirm your vote 🙏"
What gives it away
- A code received by text to "send back": it's the login code for your friend's account.
- A familiar tone for an unusual request.
- Insistence over something that doesn't matter.
Levers:TrustSocial pressure
Practice — Social media account takeoverQuestions to ask — Social media account takeoverProtect yourself — Social media account takeover
Harassment raid
Your phone has been showing notifications nonstop for twenty minutes.
312 new notifications "Read the original thread and you'll understand." "Read the original thread and you'll understand." "We know where you live."
What gives it away
- Hundreds of accounts write the same thing at the same time.
- Many of the accounts were created recently.
- The original call is on another platform.
Levers:Social pressureFear
Questions to ask — Harassment raidProtect yourself — Harassment raid
Social media profile impersonation
Message from a friend, who sends you a screenshot.
Is this you? I just got a friend request from an account in your name, with your photo. It already wrote to ask me to lend it money, saying you lost your card.
What gives it away
- You didn't create any other account.
- The fake account is recent and reuses your photos.
- The request for money comes right after the friend request.
Levers:TrustSocial pressure
Practice — Social media profile impersonationQuestions to ask — Social media profile impersonationProtect yourself — Social media profile impersonation
QR code — 1 example
Quishing (fraudulent QR code)
On a parking meter, a QR sticker offers to let you pay by phone.
PAY FASTER — Scan to pay for your parking without coins (address shown when scanned: stationnement-rapide.example-not-real.test)
What gives it away
- A sticker placed on top of the original surface.
- A domain unrelated to the city or the operator.
- A payment requested through a code that nothing identifies.
Practice — Quishing (fraudulent QR code)Questions to ask — Quishing (fraudulent QR code)Protect yourself — Quishing (fraudulent QR code)
Website — 49 examples
"Sign in with" permission abuse
Screen shown when signing up for a mobile game with your email account.
The game Bubbles & Candies wants to access your account: • See your name and email address • Read, send and delete your emails • See and edit your contacts [Allow]
What gives it away
- A game has no need to read or send your emails.
- The access will stay active after you uninstall the game.
- Changing your password won't cut it off.
Practice — "Sign in with" permission abuseQuestions to ask — "Sign in with" permission abuseProtect yourself — "Sign in with" permission abuse
Malicious chatbot
Support chat window on a site reached through an ad, after a delivery problem.
I completely understand your situation. To find your order, could you confirm your email address? Thank you. I've just sent you a verification code by text: could you give it to me to confirm your identity?
What gives it away
- The support was reached through an ad, not from the official site.
- A code received by text is requested in the chat.
- Each question sets up the next one.
Practice — Malicious chatbotQuestions to ask — Malicious chatbotProtect yourself — Malicious chatbot
Malicious app
App listing viewed in the app store.
Flashlight Pro, free Developer: Utility Apps Studio Permissions requested: camera, contacts, precise location, SMS.
What gives it away
- A flashlight needs neither your contacts, nor your location, nor your texts.
- The developer is unknown and has no identifiable website.
- The reviews, numerous and very short, all date from the same week.
Practice — Malicious appQuestions to ask — Malicious appProtect yourself — Malicious app
Bluetooth attack
Waiting room, phone in your pocket with Bluetooth on.
Bluetooth pairing request Tel-7731 wants to pair with your phone. [Pair] [Cancel]
What gives it away
- You weren't trying to connect anything.
- The device name means nothing to you.
- The request comes back if you ignore it.
Practice — Bluetooth attackQuestions to ask — Bluetooth attackProtect yourself — Bluetooth attack
Man-in-the-Middle Attack
A café's Wi-Fi, while checking your usual email.
Warning: potential security risk ahead The certificate for messagerie-exemple.test is not valid on this network. [Go back (recommended)] [Accept the risk and continue]
What gives it away
- The site never shows this warning at home.
- You're on a network you don't control.
- The button to continue makes you accept exactly what the attack needs.
Questions to ask — Man-in-the-Middle AttackProtect yourself — Man-in-the-Middle Attack
Wi-Fi Deauthentication Attack
In a coworking space, your computer has been losing Wi-Fi every two minutes for half an hour.
Available networks: • Coworking-Members (secured) — connection lost • Coworking-Members_5G (open)
What gives it away
- The signal is good, but the connection keeps dropping.
- An open network with a similar name has just appeared.
- Other people in the room have the same problem at the same time.
Lever:Urgency
Questions to ask — Wi-Fi Deauthentication AttackProtect yourself — Wi-Fi Deauthentication Attack
Brute-force attack
Email received from an online storage service where you have an account.
We have detected unauthorized access to part of our account database. Passwords were stored there in encrypted form. As a precaution, we invite you to change your password and that of any account where you use it.
What gives it away
- The breach happened at the service, not on your device.
- A short password can be recovered from its hash.
- The risk extends to every account sharing that password.
Lever:Trust
Practice — Brute-force attackQuestions to ask — Brute-force attackProtect yourself — Brute-force attack
Homoglyph attack
Email in your bank's name. When you hover over it, the link looks right, but one of its "a" letters is actually a Cyrillic character.
A new version of your customer area is available. Log in to activate your security settings: https://mabanque-exemple.test/activation
What gives it away
- Once the page is open, the address bar shows xn--mabnque-exemple-k7c.test: the encoded form reveals a mixed alphabet.
- Your password manager doesn't offer your credentials on this page.
- The request comes through a link, not from your usual account area.
Lever:Trust
Practice — Homoglyph attackQuestions to ask — Homoglyph attackProtect yourself — Homoglyph attack
Overlay attack
Request shown when opening a phone-cleaning app installed the day before.
To optimize your phone, allow display over other apps and turn on the accessibility service. [Allow]
What gives it away
- Cleaning a phone requires neither of these permissions.
- They're the two most powerful permissions on the phone.
- The app has only just been installed.
Lever:Trust
Practice — Overlay attackQuestions to ask — Overlay attackProtect yourself — Overlay attack
Botnet
Email from your internet provider.
We have detected unusual outgoing traffic from your line, typical of a compromised device. We invite you to check the devices connected to your router.
What gives it away
- Nobody in the household uses the connection unusually.
- Anti-robot checks have become constant on websites.
- A connected camera still has its factory password.
Lever:Trust
Credential stuffing
Email received on a Sunday morning, sent by a shopping site where you have an account.
New sign-in to your account from a Windows computer, at 03:12. If this was you, no action is needed. If not, secure your account from your settings.
What gives it away
- You were asleep at that time and don't use that device.
- This account's password is the same as on other sites.
- The login succeeded on the first try: the password was already known.
Lever:Trust
Practice — Credential stuffingQuestions to ask — Credential stuffingProtect yourself — Credential stuffing
Compromised router or gateway
Router admin interface, opened after several certificate warnings on different devices.
Network settings: Primary DNS server: 203.0.113.53 (manual) Remote administration: on Connected devices: 9
What gives it away
- The DNS servers were entered by hand and aren't your provider's.
- Remote administration is on although you never chose it.
- The household has 6 devices, not 9.
Lever:Trust
Questions to ask — Compromised router or gatewayProtect yourself — Compromised router or gateway
Hacked security camera
Notification from the camera's app, received in the middle of the night.
New connection to your Living Room camera from an unknown device.
What gives it away
- Nobody in the household was connected at that time.
- The device isn't one of yours.
- The factory password was never changed.
Lever:Trust
Practice — Hacked security cameraQuestions to ask — Hacked security cameraProtect yourself — Hacked security camera
Trojan Horse
Link shared on a forum, for video editing software that's usually paid.
Full unlocked version, all features, no license. Turn off your antivirus during installation, it blocks the patch by mistake.
What gives it away
- Paid software offered for free by a stranger.
- The request to turn off the antivirus.
- The file doesn't come from the publisher's site.
Practice — Trojan HorseQuestions to ask — Trojan HorseProtect yourself — Trojan Horse
Clickjacking (hijacked click)
Unknown video site, opened from a link shared in a messaging app.
Click Play twice to confirm you're not a robot. [▶ Play]
What gives it away
- No site confirms you're human with a double click on Play.
- The page requires a click in a precise spot.
- You're logged in to your accounts in the same browser.
Questions to ask — Clickjacking (hijacked click)Protect yourself — Clickjacking (hijacked click)
Cryptojacking
Task manager opened one evening when the computer is heating up for no reason.
CPU: 96% in use Main process: svc_host_update — 91% Browser: closed
What gives it away
- The processor is almost fully busy while you're doing nothing.
- The process has a name that imitates a system component.
- The load stays high with the browser closed: it's an installed program.
Lever:Curiosity
Questions to ask — CryptojackingProtect yourself — Cryptojacking
Deepfake video call
Video call of a few minutes with the CEO, scheduled at the last minute.
I'm between two meetings, I can't stay. The acquisition I told you about is being signed today, I need the transfer to go out before 4 pm. It's confidential, don't mention it to the rest of the team. I'll send you the IBAN by message.
What gives it away
- The call is short and the camera stays fixed.
- Confidentiality and urgency prevent dual approval.
- The IBAN arrives through another channel, right after the call.
Levers:AuthorityUrgencyTrustSocial pressure
Practice — Deepfake video callQuestions to ask — Deepfake video callProtect yourself — Deepfake video call
Denial of Service
Your email service has been unavailable since this morning. A text arrives.
Following this morning's incident, your account must be reactivated. Confirm your credentials: retablissement-compte.example-not-real.test
What gives it away
- The outage is real, but it requires no action from you.
- The link doesn't lead to the service's site.
- The message uses the news to look legitimate.
Lever:Urgency
Questions to ask — Denial of ServiceProtect yourself — Denial of Service
Account recovery hijacking
Email received one evening in your email provider's name, shortly after a reset request.
The recovery address for your account has been changed. If you made this change, no action is required. If not, secure your account now from the security settings.
What gives it away
- You didn't change anything.
- A reset request arrived just before.
- Your old recovery address hadn't been used for years.
Practice — Account recovery hijackingQuestions to ask — Account recovery hijackingProtect yourself — Account recovery hijacking
Browser hijacking
New tab opened a few days after installing a free video converter.
Home page: RechercheMax — Fast and secure search Search address: search-boost.example-not-real.test/?q=
What gives it away
- You didn't choose this search engine.
- It comes back after you fix it.
- It appeared right after another program was installed.
Lever:Trust
Questions to ask — Browser hijackingProtect yourself — Browser hijacking
Session hijacking
A social network's security settings, opened after a post you didn't write.
Where you're logged in: • This phone — active now • Laptop — yesterday • Browser on Linux — active 10 minutes ago, unknown location Login history: no new logins.
What gives it away
- An active session is unknown, while the history shows no new login.
- No two-factor code was requested.
- Something was done in your name without your password changing.
Lever:Trust
Questions to ask — Session hijackingProtect yourself — Session hijacking
DNS Poisoning
Your bank's site, opened from your bookmark, on your home Wi-Fi.
Your connection is not private The site banque-exemple.test may be trying to steal your information. [Back] [Advanced]
What gives it away
- The address is right, but the certificate doesn't match.
- The site opens normally on your phone's mobile connection.
- The warning appears on a site you use regularly, with no known reason.
Practice — DNS PoisoningQuestions to ask — DNS PoisoningProtect yourself — DNS Poisoning
Keylogger
Public computer in a coworking space, when you go to check your email.
Behind the tower, between the keyboard cable and the USB port: a small black adapter, unbranded, that looks like an extension.
What gives it away
- A keyboard plugs in directly, without an adapter.
- The computer is accessible to anyone.
- Nothing on screen gives it away.
Lever:Trust
Malicious browser extension
Extension page in the browser's store, installed to convert a file.
PDF Converter Express This extension can: read and change all your data on all websites. [Add to browser]
What gives it away
- Converting a file doesn't require reading every site you visit.
- The publisher has no identifiable website.
- Once the conversion is done, the extension will stay active on all your pages.
Practice — Malicious browser extensionQuestions to ask — Malicious browser extensionProtect yourself — Malicious browser extension
Fake AI app
Ad seen on a social network, leading to an app listing.
AI Image Generator Pro — free unlimited access, no waiting list. Sign in with your account in one click.
What gives it away
- Free and unlimited for a tool that's usually paid.
- The publisher isn't the one behind the advertised tool.
- Signing in with your account is the first thing requested.
Practice — Fake AI appQuestions to ask — Fake AI appProtect yourself — Fake AI app
Fake browser update
Banner that appeared while reading an article on a news site you visit regularly.
Your browser is out of date. Some pages may no longer display correctly. Install the latest version now. [Update] : downloads an installer.
What gives it away
- The notification is inside the page, not in the browser's menu.
- A browser doesn't update through a file downloaded from a news site.
- The browser's menu says it's already up to date.
Practice — Fake browser updateQuestions to ask — Fake browser updateProtect yourself — Fake browser update
Evil Twin Wi-Fi Hotspot
List of Wi-Fi networks shown in an airport hall.
Airport_Free_WiFi (secured) Airport_Free_WiFi (open)
What gives it away
- Two networks have the same name in the same place.
- One is open while the other asks for a password.
- Nothing shows which one belongs to the airport.
Practice — Evil Twin Wi-Fi HotspotQuestions to ask — Evil Twin Wi-Fi HotspotProtect yourself — Evil Twin Wi-Fi Hotspot
AI-generated fake news site
Searching for an investment platform's name before putting money into it.
Info Épargne Hebdo — Investigation: how this French platform is shaking up wealth management. By our business desk. info-epargne-hebdo.test
What gives it away
- The outlet has no identifiable editor or address.
- The domain is recent for a paper that claims to be established.
- Every article on the site leads to the same offer.
Practice — AI-generated fake news siteQuestions to ask — AI-generated fake news siteProtect yourself — AI-generated fake news site
Fake website
You search for your health insurer's login page; the first result is an ad.
Ad · mutuelle-espace-adherent.example-not-real.test My Health Insurance — Log in to your member area Access your reimbursements in one click.
What gives it away
- It's an ad, not the site you usually use.
- The domain isn't your insurer's.
- Your password manager offers nothing on the page.
Practice — Fake websiteQuestions to ask — Fake websiteProtect yourself — Fake website
Fake download
Page on a download aggregator site, while looking for a free video player.
[DOWNLOAD NOW] (big green button) [Download Free] (orange button) Direct link: lecteurvideo-libre.test (small, under the description)
What gives it away
- Several download buttons on the same page.
- The most visible one is an ad, not the file.
- The only link to the publisher's site is understated.
Practice — Fake downloadQuestions to ask — Fake downloadProtect yourself — Fake download
Data breach
Email received from an online store where you have an account.
We are informing you that unauthorized access to our customer file has occurred. The data concerned is: name, email address, postal address, order history. No banking data is affected. We recommend that you change your password.
What gives it away
- The notice may be genuine: open your account on your own, not through a link.
- The data listed will be used to make fake delivery messages believable.
- This site's password may be used elsewhere.
Questions to ask — Data breachProtect yourself — Data breach
Network Traffic Interception
A hotel's Wi-Fi, right after connecting.
To secure your browsing, install the network configuration profile. [Install profile]
What gives it away
- Wi-Fi access doesn't need any profile or certificate.
- This profile would make it possible to observe connections that were encrypted until now.
- The request comes just when you only want to get online.
Lever:Trust
Questions to ask — Network Traffic InterceptionProtect yourself — Network Traffic Interception
Juice jacking (rigged charging station)
Charging station in a train station hall, with an attached cable.
Trust this computer? Your settings and data will be accessible from this computer. [Trust] [Don't Trust]
What gives it away
- You only wanted to charge, not exchange data.
- The cable belongs to the station: you don't know what's inside it.
- Charging never needs this permission.
Practice — Juice jacking (rigged charging station)Questions to ask — Juice jacking (rigged charging station)Protect yourself — Juice jacking (rigged charging station)
Spyware
Phone settings, "Permissions" section, Microphone.
Apps allowed to use the microphone: • Phone • Messages • Quick PDF Scanner — always allowed
What gives it away
- A document scanner has no reason to use the microphone.
- The permission is permanent, not just while the app is in use.
- You don't remember installing this app.
Compromised smart device
List of connected devices, shown in the router's interface.
Connected devices: 11 • living-room-computer • anna-phone • kitchen-smart-plug • ESP-4F2A (unknown) • …
What gives it away
- A device with a technical name matches nothing you installed.
- The number of devices exceeds what you own.
- The smart plug still has its factory password.
Lever:Trust
Questions to ask — Compromised smart deviceProtect yourself — Compromised smart device
Excessive permissions
First launch of a free card game on your phone.
Allow Ace Card Game to access your contacts? [Allow] [Deny] Then: Allow access to your location? [Always] [While using the app] [Deny]
What gives it away
- A card game needs neither your contacts nor your location.
- The requests come at launch, before any feature that would justify them.
- The Always option is offered first.
Questions to ask — Excessive permissionsProtect yourself — Excessive permissions
Malicious Captive Portal
Page that opened after connecting to a hotel's Wi-Fi.
Welcome to the hotel. To activate your free access, a €1 deposit will be charged and then refunded. Card number, expiration date, security code.
What gives it away
- Access advertised as free asks for a card.
- The one-euro deposit is used to validate the card for later charges.
- The hotel's front desk can tell you how access really works.
Practice — Malicious Captive PortalQuestions to ask — Malicious Captive PortalProtect yourself — Malicious Captive Portal
Password spraying
Password change screen required by your employer, as every quarter.
Your password is expiring. New password: Autumn2026! The password meets the rules: 12 characters, uppercase, number, symbol.
What gives it away
- The password follows a season-and-year pattern that attackers try first.
- Meeting the displayed rules doesn't make it hard to guess.
- The next one will be Winter2026!, and attackers know that too.
Lever:Trust
Questions to ask — Password sprayingProtect yourself — Password spraying
Re-identification of anonymous data
Settings of a running app.
Your activities are shared publicly and anonymously: only your routes, times and city are visible. Location history: on.
What gives it away
- A route that starts at the same spot every morning points to a home.
- Repeated times are enough to recognize a person.
- Sharing is on by default.
Lever:Trust
Questions to ask — Re-identification of anonymous dataProtect yourself — Re-identification of anonymous data
Rootkit
Computer that has been behaving strangely for weeks.
Scan complete: no threats detected. Meanwhile, the router shows the computer sending data continuously, even at night.
What gives it away
- The scan says all is well, but outside observation says otherwise.
- The problem came back after a cleanup reported as successful.
- The antivirus can no longer update.
Lever:Trust
Scareware
Window that popped up during ordinary browsing, with a countdown.
WARNING: 5 threats detected on your device. Your files will be damaged in 02:59. Remove the viruses now with ProtectPC Ultra, license €49.99.
What gives it away
- A web page can't scan your device.
- The result appears without any scan having taken place.
- The product offered isn't the security software installed on your machine.
Practice — ScarewareQuestions to ask — ScarewareProtect yourself — Scareware
Stalkerware (surveillance by someone close to you)
A remark from your partner, one evening.
So, was it nice, that coffee with Sarah this afternoon? You didn't mention it to me.
What gives it away
- You hadn't told anyone about that meeting.
- The person knows your movements or conversations without your having told them.
- They've had access to your unlocked phone.
Questions to ask — Stalkerware (surveillance by someone close to you)Protect yourself — Stalkerware (surveillance by someone close to you)
Tabnabbing (swapped tab)
Returning to a tab left open for an hour, which you thought was your email.
Your session has expired for security reasons. Please log in again to continue. Tab address: messagerie-connexion.example-not-real.test
What gives it away
- You were active on this service a short while ago.
- The tab's address isn't your email provider's.
- Your password manager doesn't offer to fill in the form.
Lever:Trust
Practice — Tabnabbing (swapped tab)Questions to ask — Tabnabbing (swapped tab)Protect yourself — Tabnabbing (swapped tab)
Tracker stalking
Notification received on your phone as you get home.
Unknown tracker detected. A tracker that doesn't belong to you has been moving with you for a while. Its owner can see its location. [Play sound]
What gives it away
- You don't own any tracker.
- It has been following you for a while, so it's on you or in your vehicle.
- Its owner can see where you are.
Lever:Trust
Questions to ask — Tracker stalkingProtect yourself — Tracker stalking
Abusive ad tracking
Banner shown when opening a news site.
We and our 847 partners use cookies to personalize your experience. [ACCEPT ALL] Customize my choices (understated link)
What gives it away
- Accepting is a button, refusing is a link.
- The number of partners far exceeds what the site suggests.
- Refusing takes several screens.
Lever:Trust
Questions to ask — Abusive ad trackingProtect yourself — Abusive ad tracking
Typosquatting
You type the address of your streaming service a little too fast; it's usually streamflix.test.
Your subscription could not be renewed. Log in again and update your payment method to keep watching. Address shown: stremflix.test/compte
What gives it away
- A letter is missing: stremflix instead of streamflix.
- The service wants your card although no payment problem was flagged anywhere else.
- The page knows neither your name nor your profiles.
Lever:Trust
Practice — TyposquattingQuestions to ask — TyposquattingProtect yourself — Typosquatting
ARP Spoofing
List of devices connected to your router, checked after repeated certificate warnings at home.
Connected devices: • living-room-computer • marc-phone • unknown-device (connected for 3 days)
What gives it away
- A device nobody recognizes has been there for several days.
- The certificate warnings only appear on this network.
- The Wi-Fi password was given to guests.
Lever:Trust
Questions to ask — ARP SpoofingProtect yourself — ARP Spoofing
Computer Worm
One evening, several devices in the home slow down at the same time.
Router interface: high outgoing traffic from the video recorder, the printer and a computer. Video recorder's last update: 4 years ago.
What gives it away
- Several devices are affected at the same time.
- One device hasn't been updated in a long time.
- Nobody opened or clicked anything.
Lever:Urgency
Questions to ask — Computer WormProtect yourself — Computer Worm
Identity theft
Letter received from a debt collection agency.
Subject: Formal notice — consumer loan no. 2026-0417 Despite our reminders, the €312 installment remains unpaid. Without payment within 8 days, we will begin proceedings.
What gives it away
- You never took out this loan.
- The reminders mentioned never reached you: they went to another address.
- The letter arrives months after the file was opened.
Lever:Authority
Questions to ask — Identity theftProtect yourself — Identity theft
Advertising — 4 examples
Investment scam
After you click on an ad, a "wealth advisor" calls you back.
"With our secure portfolio, you earn 2% a month, guaranteed. Start with €250 to try it out: you follow your gains in real time and withdraw whenever you like."
What gives it away
- A return that is both high and guaranteed.
- They reached out to you, not the other way around.
- "Trying it out" with a small amount: that's the step that sets up the next ones.
Levers:RewardThe lure of profitTrustScarcity
Practice — Investment scamQuestions to ask — Investment scamProtect yourself — Investment scam
Rental scam
Reply to your message about a one-bedroom listing, rent slightly below the neighborhood's prices.
Hello, I'm posted abroad and can't arrange a viewing. I have a lot of requests: I'll reserve the apartment for the first person who pays the deposit and the first month. I'll mail you the keys as soon as I receive it. Lease attached, please return it signed.
What gives it away
- Payment is requested before any viewing.
- The owner can't be seen or called.
- The announced competition is there to rush you.
Practice — Rental scamQuestions to ask — Rental scamProtect yourself — Rental scam
Fake online store
Ad on a social network for a pair of sneakers you can't find anywhere else.
UrbanStep Outlet — Clearance! 68% off the Runner X, only 3 pairs left. Offer ends in 07:42. urbanstep-outlet.example-not-real.test
What gives it away
- A steep discount on a product that's rarely on sale.
- A countdown pushing you to pay fast.
- A store you can't find anywhere outside its own ad.
Practice — Fake online storeQuestions to ask — Fake online storeProtect yourself — Fake online store
Malvertising
Searching for the name of a free word processor.
Sponsored — TexteLibre, free official download textelibre-download.example-not-real.test Download the latest version in one click.
What gives it away
- The result is labeled sponsored.
- The domain isn't the publisher's, textelibre.test.
- The official site appears further down, with no ad label.
Practice — MalvertisingQuestions to ask — MalvertisingProtect yourself — Malvertising
Attachment — 4 examples
Baiting
USB stick found in the company parking lot, with a handwritten label.
Label: Salaries 2026 — confidential
What gives it away
- Nobody loses a salary file in a parking lot.
- The label is designed to make you want to look.
- The owner can't be identified.
Levers:CuriosityRewardThe lure of profit
Practice — BaitingQuestions to ask — BaitingProtect yourself — Baiting
Infostealer (credential-stealing malware)
List of devices connected to your email account, checked after installing a "free" game the week before.
Connected devices: • Your computer — active now • Your phone — 2 hours ago • Windows, unknown browser — 3 days ago, another country
What gives it away
- An unknown session exists although you received no two-factor code.
- Your password hasn't been changed and still works.
- Free software, from outside an official store, was installed just before.
Questions to ask — Infostealer (credential-stealing malware)Protect yourself — Infostealer (credential-stealing malware)
Ransomware
Screen shown at startup, after an evening when the computer slowed down a lot.
All your files have been encrypted. To get the decryption key, pay the equivalent of €600 in cryptocurrency within 72 hours. After that, the amount will double. Do not turn off the computer.
What gives it away
- The files have changed extension and no longer open.
- The deadline and the threatened increase are there to stop you from asking for help.
- The order not to turn the computer off goes against what you should do.
Practice — RansomwareQuestions to ask — RansomwareProtect yourself — Ransomware
Computer Virus
Attachment opened, received from a supplier about an invoice.
SECURITY WARNING: Macros have been disabled. This document was created in a newer version. To display its content, click Enable Content.
What gives it away
- An invoice doesn't need macros to display.
- The "newer version" excuse is there to make you click.
- The document wasn't expected.
Questions to ask — Computer VirusProtect yourself — Computer Virus