1 / 15
Browser popup
VIRUS DETECTED — do not close this window
Your computer is infected with 5 threats and your banking passwords are exposed. Call certified support on +1 (555) 088-2104 immediately. Closing this page may damage your files.
Mock page — buttons and links do nothing
18s
Swipe left for scam, right for legit · answering early earns a bonus
How to play
- 1Read the message — a text, email, DM or browser popup.
- 2Call it before the bar runs out: swipe left for scam, right for legit.
- 3Answer in the first third of the time for a speed bonus.
- 4Fifteen messages, then the red flags in each one, laid out.
How this works
What this is actually testing
Fifteen messages a round — texts, emails, direct messages and browser pop-ups — and one question for each: is this a scam, or is it ordinary? You get enough time to read it properly, and afterwards the red flags you missed are laid out beside the message.
The skill is not spotting bad spelling. Modern fraud is well written, well designed, and frequently better presented than the genuine messages it imitates. What gives it away is structural: what it asks for, how quickly, through which channel, and what it does if you hesitate.
The flags that actually generalise
A scam does not have to contain all of these, and a legitimate message can contain one. The combination is what matters.
- Manufactured urgency: a deadline measured in minutes or hours, usually attached to a loss rather than a gain.
- A channel switch: a message that wants to move you to a different app, a phone call, or a link rather than letting you go to the organisation yourself.
- A request for something no real institution asks for — a full password, a one-time code, remote access to a device, or payment in a form that cannot be reversed.
- An address or sender that is almost right. A single character, a different top-level domain, or a display name that does not match the address behind it.
- A payment route with no recourse: transfers to a new account, gift cards, or cryptocurrency.
Why half of them are genuine
A round deliberately includes real messages as well as fraudulent ones, because a test made only of scams teaches the wrong lesson. If everything is a scam, the winning strategy is to suspect everything, and people who suspect everything eventually ignore the warning that mattered.
The harder and more useful skill is telling a real security alert from a fake one. That is why the genuine messages in the deck are not obviously genuine — they carry some of the same urgency and the same requests, because real ones do.
The one habit worth taking away
If a message asks you to act, do not act through the message. Go to the organisation the way you normally would — the app you already have, the number on the back of your card, the address you type yourself — and ask whether it is real.
This single habit defeats almost every scenario in the deck, including the ones that are extremely difficult to call from the message alone. It costs a minute and it does not require you to be right about anything.
Questions people ask
Are these based on real scams?
They are modelled on documented patterns — the techniques, the framing and the requests are drawn from fraud that has actually been reported. Names, numbers and addresses are invented, and nothing in the deck links anywhere real.
I got a legitimate message wrong. Does that matter?
It matters quite a lot, and it is the half of the test people overlook. Treating real alerts as fraud has its own cost: missed security warnings, ignored fraud checks, and eventually a habit of dismissing everything. The explanation will show what marked that message as genuine.
Why is there a time limit?
Because real messages arrive while you are busy, and the whole design of a scam is to catch you in the few seconds before you think. The limit is set to allow a proper read, not to rush you — it is there to stop the round becoming a forensic exercise nobody performs in real life.
What should I do if I think I have been scammed?
Contact your bank immediately through a number you look up yourself, not one from the message, and report it to your country’s fraud authority. Speed matters more than anything else: some transfers can be stopped or recalled within a short window. Nothing on this site can do that for you.
Method and figures last reviewed . Every worked example here is produced by the same calculation the page runs — enter the same inputs above and the numbers will match.