Recreated examples of real scams, clearly labeled, with the warning signs annotated. Every example on this page is a recreation for education — we never publish a real forwarded email without permission and full redaction.
Scammers reuse the same emotional hooks: fear, urgency, small fees, and impersonation of institutions you already trust. Below are three of the most common patterns we see. Each one is rewritten from scratch — no real victim's message is shown — and annotated with the specific details that give the scam away.
Example — recreated
The frozen-bank scare
- From:
- Chase Security <security-alert@chasebank-verify.com>
- Subject:
- Urgent: Unusual sign-in detected on your account
We detected a sign-in from a new device. To keep your account safe, please verify your identity within 24 hours or your account will be locked. Verify now: http://chase-verify-account.co/login
Why it's a scam
- Sender domain is chasebank-verify.com, not chase.com
- Countdown ('24 hours') to pressure a fast click
- Link goes to a lookalike domain, not to chase.com
- Threat of account lockout — real banks freeze first and notify you inside the app
Example — recreated
The fake package delivery
- From:
- USPS Delivery <notice@usps-parcel.help>
- Subject:
- Your package could not be delivered — action required
Your parcel is being held at our facility. A $2.99 redelivery fee is required. Update your address and pay the fee here: http://usps-redelivery.help/pay
Why it's a scam
- USPS never emails asking for a redelivery fee
- Sender domain ends in .help, not usps.com
- Tiny fee ($2.99) is bait to capture card details, not to charge that amount
- Link goes to a lookalike domain
Example — recreated
The Medicare 'new card' call-back
- From:
- Medicare Services <no-reply@medicare-updates.info>
- Subject:
- Your new Medicare card is ready — confirm delivery
A new Medicare card has been issued in your name. To confirm your address and prevent delays, call 1-877-555-0142 or reply with your Medicare number and date of birth.
Why it's a scam
- Medicare will never ask for your Medicare number by email
- Sender domain is medicare-updates.info, not medicare.gov
- Asks for a callback to a number the scammer controls
- Requests personal information (Medicare number, DOB) that real Medicare already has
If any email like these lands in your inbox, don't click, don't reply, and don't call the number in the message. Forward it to check@spamcheck.com and we'll confirm in plain English whether it's a scam and what to do next.
