How entries are made

One record per family

A family is one mechanic under many skins: "your subscription was renewed, call this number" is one family whether the brand is Geek Squad, Norton or McAfee. New subject lines, sender addresses, phone numbers and domains are added to the existing record with the month they were seen. A new page is opened only for a new mechanic.

Where the data comes from

• Reader submissions through the report form — the main source of fresh specimens. Personal data is removed before anything is published; the raw copy is never published.
• This site's own guides from 2014–2025, which recorded many of these campaigns when they first appeared. They stay online unchanged and are cited as sources.
• Official pages: consumer-protection agencies and the impersonated brands' own fraud pages. A brand is always named as impersonated; the brand is a victim of the scam too.

What is never published

• Names, addresses, account numbers, amounts and any other detail of the person who received the message.
• Live phishing links. Domains and URLs are shown defanged — hxxp and [.] — so they cannot be clicked.
• Brand logos. Brands appear as text only.
• Guesses. An empty field means "not on record", never "we assume".

Statuses

Active: specimens or reports in the last ~90 days. Dormant: the family is known, nothing fresh on record. Archived: the campaign ended, kept for the record.

Reuse

Every record has a JSON twin (/scams/{slug}.json), the index is at /scams/index.json, and every dated indicator is in /scams/indicators.json. Licence CC BY 4.0: reuse with a link to the record. Screenshots may be embedded with a link to the page they come from.

What this site is not

There is no support line. Nobody from Soft2Secure will ever call you or ask you to call. If a page claiming to be this site shows a phone number, it is not this site.