Recreated examples of real scams, clearly labeled, with the warning signs annotated. Every example on this page is a recreation for education — we never publish a real forwarded email without permission and full redaction.
Scammers reuse the same emotional hooks: fear, urgency, small fees, and impersonation of institutions you already trust. Below are three of the most common patterns we see. Each one is rewritten from scratch — no real victim's message is shown — and annotated with the specific details that give the scam away.
We detected a sign-in from a new device. To keep your account safe, please verify your identity within 24 hours or your account will be locked. Verify now: http://chase-verify-account.co/login
Why it's a scam
Sender domain is chasebank-verify.com, not chase.com
Countdown ('24 hours') to pressure a fast click
Link goes to a lookalike domain, not to chase.com
Threat of account lockout — real banks freeze first and notify you inside the app
Example — recreated
The fake package delivery
From:
USPS Delivery <notice@usps-parcel.help>
Subject:
Your package could not be delivered — action required
Your parcel is being held at our facility. A $2.99 redelivery fee is required. Update your address and pay the fee here: http://usps-redelivery.help/pay
Why it's a scam
USPS never emails asking for a redelivery fee
Sender domain ends in .help, not usps.com
Tiny fee ($2.99) is bait to capture card details, not to charge that amount
Your new Medicare card is ready — confirm delivery
A new Medicare card has been issued in your name. To confirm your address and prevent delays, call 1-877-555-0142 or reply with your Medicare number and date of birth.
Why it's a scam
Medicare will never ask for your Medicare number by email
Sender domain is medicare-updates.info, not medicare.gov
Asks for a callback to a number the scammer controls
Requests personal information (Medicare number, DOB) that real Medicare already has
If any email like these lands in your inbox, don't click, don't reply, and don't call the number in the message. Forward it to and we'll confirm in plain English whether it's a scam and what to do next.
