Defensive reference
Fraud Flow and Fraud Map use the same trust → transfer → disconnect model. These fictional examples support defensive pattern recognition, not assumptions about intent.
Trust pattern / defensive taxonomy
A message or identity may appear connected to someone already trusted. The apparent connection can arise in different ways; identify what is observable without assuming who controls an account or who sent a message.
Examples are illustrative, not proof that fraud occurred. Labels such as "hacking" describe unauthorised access as a risk category, not a how-to guide.
Trust pattern / detail
Three distinct routes by which trust may be borrowed.
Deceptive messages or relationship-building may seek information, credentials or access. Phishing specifically refers to deceptive attempts to obtain sensitive information or prompt unsafe actions; not every attempt to influence someone is phishing.
Verify independentlyCopied names, images, profiles or public identity signals can make a separate profile appear connected to a trusted person or organisation. A copied profile is not evidence that its apparent owner controls it.
Notice the copied signalsUnauthorised access to a genuine account or identity—including one belonging to a public figure or known contact—may let another person send convincing requests. A real account can still be operated by someone unauthorised.
Secure an affected accountTrust-building may be brief or prolonged. One reported situation can combine several entry patterns. Consider only observable signals, independent checks and safe actions.
Established trust means confidence is built over time or borrowed from an existing relationship. That confidence can later be used to make unusual requests appear credible.
Warning: familiarity is offered instead of independent evidence. Verify the claim through a separate trusted source; pause any payment while checking.
Explore established trustAn unusually attractive financial, employment, investment, prize, romance or other opportunity is presented. Warning: promised benefits depend on an upfront payment or secrecy. Verify independently and decline payment until the claim is established.
Explore unbelievably good offersAn alleged danger, crisis, penalty or emergency creates pressure. Warning: an immediate deadline or demand not to check. Contact the affected person or claimed organisation independently; pause before paying.
Explore threat or emergency claimsRepeated cycles can continue until the victim recognises the pattern, runs out of resources, or disconnects. The sequence is abstract and defensive; pause further requests and seek support without blame.
Compare cycle patternsDefensive guidance
Use a known contact method or an official channel you locate independently. Do not rely on the link, number or reply route in the suspicious message. Confirm unusual requests directly with the person or organisation.
Impersonation is a false claim to another identity; spoofing copies identity signals; phishing uses deception to solicit information or unsafe action; account takeover involves unauthorised control of a genuine account. Stolen celebrity images or copied public profiles do not prove the real person is involved.
Keep messages, profile addresses, dates, screenshots, receipts and payment references without posting private information publicly. Report suspicious content to the relevant platform and seek guidance from the appropriate local reporting service.
Unexpected urgency, secrecy, requests for money, credentials or security codes, changed payment details, inconsistent profiles or an unusual message from a familiar account are reasons to pause and check—not proof on their own.
Pause before acting. Do not send money, share codes or credentials, or follow unexpected sign-in links. If money moved or an account may be affected, contact the provider through its official channel promptly.
Use official account-recovery guidance, change affected passwords, enable multi-factor authentication, review active sessions and alert contacts through a separate trusted route. Seek provider help if access cannot be secured.