The categories above are descriptive rather than mutually exclusive. A single message often combines patterns from several at once: a "tax refund" lure (HMRC scam) delivered by SMS (smishing) impersonating a government brand (impersonation) and pointing to a fake login page (phishing) is one campaign, not four. The detection model treats the categories as overlapping signals rather than strict labels — what matters for the risk score is whether the message uses the techniques, not which heading we file it under.
If you've received something that doesn't fit any single category neatly, that's normal. Run it through the main ScamSupport tool, which scores the underlying patterns regardless of the cover story.
The Universal Tells
Across all 15 categories, four signals appear in roughly 90% of scam messages we see:
Manufactured urgency. "Within 24 hours", "immediately", "final notice". Real organisations don't pressure you in their first contactemail — they have escalation procedures that take weeks.
Sender / display-name mismatch. The friendly name says "PayPal" but the actual address is a Gmail account or a misspelt lookalike domain. Always check the right-hand side of the @ sign.
Off-platform action requested. "Click here to verify", "follow this link to log in". Genuine companies tell you to log in through their app or by typing the URL yourself, never through an embedded link.
A request that doesn't match the relationship. Your bank already has your address, your name, and your account number. If a "bank" email asks you to confirm them, the only thing it can be doing is collecting that data for the first time.
If a message clears all four of those, it's probably real. If it fails any one of them, treat it as suspect until you've verified through the company's normal channel.