{
  "generated": "2026-09-03",
  "licence": "CC BY 4.0",
  "count": 27,
  "families": [
    {
      "slug": "afterpay-account-suspension",
      "url": "https://soft2secure.com/scams/afterpay-account-suspension",
      "json": "https://soft2secure.com/scams/afterpay-account-suspension.json",
      "name": "Afterpay scam emails: account limited, someone else's phone",
      "family": "account-suspension",
      "family_label": "Account suspension / verification",
      "impersonates": "Afterpay",
      "status": "active",
      "channels": [
        "email",
        "sms"
      ],
      "first_seen": "2025-09",
      "last_seen": null,
      "specimens": 1,
      "updated": "2026-09-02"
    },
    {
      "slug": "amazon-account-alert-phishing",
      "url": "https://soft2secure.com/scams/amazon-account-alert-phishing",
      "json": "https://soft2secure.com/scams/amazon-account-alert-phishing.json",
      "name": "Amazon \"account-alert\" phishing emails",
      "family": "account-suspension",
      "family_label": "Account suspension / verification",
      "impersonates": "Amazon",
      "status": "dormant",
      "channels": [
        "email"
      ],
      "first_seen": "2019-08",
      "last_seen": "2019-08",
      "specimens": 1,
      "updated": "2026-09-02"
    },
    {
      "slug": "amazon-order-callback",
      "url": "https://soft2secure.com/scams/amazon-order-callback",
      "json": "https://soft2secure.com/scams/amazon-order-callback.json",
      "name": "Amazon \"order confirmation\" callback scam",
      "family": "fake-invoice-callback",
      "family_label": "Fake invoice, callback",
      "impersonates": "Amazon",
      "status": "active",
      "channels": [
        "email",
        "call"
      ],
      "first_seen": null,
      "last_seen": null,
      "specimens": 0,
      "updated": "2026-09-02"
    },
    {
      "slug": "apple-itunes-receipt",
      "url": "https://soft2secure.com/scams/apple-itunes-receipt",
      "json": "https://soft2secure.com/scams/apple-itunes-receipt.json",
      "name": "Fake iTunes Store receipt",
      "family": "account-suspension",
      "family_label": "Account suspension / verification",
      "impersonates": "Apple",
      "status": "dormant",
      "channels": [
        "email"
      ],
      "first_seen": "2016-11",
      "last_seen": "2016-11",
      "specimens": 1,
      "updated": "2026-09-02"
    },
    {
      "slug": "bec-supplier-bank-change",
      "url": "https://soft2secure.com/scams/bec-supplier-bank-change",
      "json": "https://soft2secure.com/scams/bec-supplier-bank-change.json",
      "name": "Supplier \"updated bank details\" (invoice redirect)",
      "family": "bec-invoice-redirect",
      "family_label": "Invoice redirect (BEC)",
      "impersonates": "a supplier or executive of your own company",
      "status": "active",
      "channels": [
        "email"
      ],
      "first_seen": null,
      "last_seen": null,
      "specimens": 0,
      "updated": "2026-09-02"
    },
    {
      "slug": "cra-tax-refund",
      "url": "https://soft2secure.com/scams/cra-tax-refund",
      "json": "https://soft2secure.com/scams/cra-tax-refund.json",
      "name": "Canada Revenue Agency refund and e-Transfer scams",
      "family": "prize-refund-tax",
      "family_label": "Prize, refund, tax, fine",
      "impersonates": "Canada Revenue Agency",
      "status": "archived",
      "channels": [
        "email",
        "sms",
        "call"
      ],
      "first_seen": "2016-08",
      "last_seen": "2016-08",
      "specimens": 1,
      "updated": "2026-09-02"
    },
    {
      "slug": "crypto-investment-platform",
      "url": "https://soft2secure.com/scams/crypto-investment-platform",
      "json": "https://soft2secure.com/scams/crypto-investment-platform.json",
      "name": "\"Guaranteed returns\" crypto investment platform",
      "family": "crypto-investment",
      "family_label": "Crypto / investment",
      "impersonates": "an investment platform or a friendly stranger (no real brand)",
      "status": "active",
      "channels": [
        "social",
        "whatsapp",
        "web"
      ],
      "first_seen": null,
      "last_seen": null,
      "specimens": 0,
      "updated": "2026-09-02"
    },
    {
      "slug": "digitspro-delivery-fee",
      "url": "https://soft2secure.com/scams/digitspro-delivery-fee",
      "json": "https://soft2secure.com/scams/digitspro-delivery-fee.json",
      "name": "DigitsPro \"shipping costs have not been paid\" emails",
      "family": "package-delivery",
      "family_label": "Package delivery",
      "impersonates": "a delivery notification (no real brand)",
      "status": "archived",
      "channels": [
        "email"
      ],
      "first_seen": "2019-12",
      "last_seen": "2019-12",
      "specimens": 1,
      "updated": "2026-09-02"
    },
    {
      "slug": "docusign-document-waiting",
      "url": "https://soft2secure.com/scams/docusign-document-waiting",
      "json": "https://soft2secure.com/scams/docusign-document-waiting.json",
      "name": "DocuSign \"document to review and sign\" phishing",
      "family": "account-suspension",
      "family_label": "Account suspension / verification",
      "impersonates": "DocuSign",
      "status": "active",
      "channels": [
        "email"
      ],
      "first_seen": null,
      "last_seen": null,
      "specimens": 0,
      "updated": "2026-09-02"
    },
    {
      "slug": "everalbum-text-invites",
      "url": "https://soft2secure.com/scams/everalbum-text-invites",
      "json": "https://soft2secure.com/scams/everalbum-text-invites.json",
      "name": "Everalbum text invites",
      "family": "unsolicited-invite",
      "family_label": "Unsolicited invites",
      "impersonates": "Everalbum (the app itself, 2016)",
      "status": "archived",
      "channels": [
        "sms"
      ],
      "first_seen": "2016-09",
      "last_seen": "2016-09",
      "specimens": 1,
      "updated": "2026-09-02"
    },
    {
      "slug": "fedex-customs-fee",
      "url": "https://soft2secure.com/scams/fedex-customs-fee",
      "json": "https://soft2secure.com/scams/fedex-customs-fee.json",
      "name": "FedEx / DHL \"customs fee\" and \"shipment on hold\" messages",
      "family": "package-delivery",
      "family_label": "Package delivery",
      "impersonates": "FedEx (and other carriers)",
      "status": "active",
      "channels": [
        "email",
        "sms"
      ],
      "first_seen": null,
      "last_seen": null,
      "specimens": 0,
      "updated": "2026-09-02"
    },
    {
      "slug": "geek-squad-renewal-invoice",
      "url": "https://soft2secure.com/scams/geek-squad-renewal-invoice",
      "json": "https://soft2secure.com/scams/geek-squad-renewal-invoice.json",
      "name": "Geek Squad renewal invoice scam",
      "family": "fake-invoice-callback",
      "family_label": "Fake invoice, callback",
      "impersonates": "Geek Squad (Best Buy)",
      "status": "active",
      "channels": [
        "email"
      ],
      "first_seen": "2021-07",
      "last_seen": null,
      "specimens": 1,
      "updated": "2026-09-02"
    },
    {
      "slug": "hmrc-tax-rebate",
      "url": "https://soft2secure.com/scams/hmrc-tax-rebate",
      "json": "https://soft2secure.com/scams/hmrc-tax-rebate.json",
      "name": "HMRC tax rebate texts and emails",
      "family": "prize-refund-tax",
      "family_label": "Prize, refund, tax, fine",
      "impersonates": "HMRC",
      "status": "active",
      "channels": [
        "sms",
        "email",
        "call"
      ],
      "first_seen": null,
      "last_seen": null,
      "specimens": 0,
      "updated": "2026-09-02"
    },
    {
      "slug": "ikea-birthday-voucher",
      "url": "https://soft2secure.com/scams/ikea-birthday-voucher",
      "json": "https://soft2secure.com/scams/ikea-birthday-voucher.json",
      "name": "IKEA \"75th birthday\" voucher message",
      "family": "prize-refund-tax",
      "family_label": "Prize, refund, tax, fine",
      "impersonates": "IKEA",
      "status": "archived",
      "channels": [
        "whatsapp",
        "email",
        "social"
      ],
      "first_seen": "2017-11",
      "last_seen": "2017-11",
      "specimens": 1,
      "updated": "2026-09-02"
    },
    {
      "slug": "irs-tax-refund",
      "url": "https://soft2secure.com/scams/irs-tax-refund",
      "json": "https://soft2secure.com/scams/irs-tax-refund.json",
      "name": "IRS refund and \"unpaid tax\" messages",
      "family": "prize-refund-tax",
      "family_label": "Prize, refund, tax, fine",
      "impersonates": "IRS",
      "status": "active",
      "channels": [
        "email",
        "sms",
        "call"
      ],
      "first_seen": null,
      "last_seen": null,
      "specimens": 0,
      "updated": "2026-09-02"
    },
    {
      "slug": "mcafee-renewal-invoice",
      "url": "https://soft2secure.com/scams/mcafee-renewal-invoice",
      "json": "https://soft2secure.com/scams/mcafee-renewal-invoice.json",
      "name": "McAfee renewal invoice scam",
      "family": "fake-invoice-callback",
      "family_label": "Fake invoice, callback",
      "impersonates": "McAfee",
      "status": "active",
      "channels": [
        "email"
      ],
      "first_seen": null,
      "last_seen": null,
      "specimens": 0,
      "updated": "2026-09-02"
    },
    {
      "slug": "microsoft-tech-support-popup",
      "url": "https://soft2secure.com/scams/microsoft-tech-support-popup",
      "json": "https://soft2secure.com/scams/microsoft-tech-support-popup.json",
      "name": "\"Your computer is infected, call Microsoft / Apple\" page",
      "family": "tech-support-popup",
      "family_label": "Tech-support pop-up",
      "impersonates": "Microsoft / Apple",
      "status": "active",
      "channels": [
        "web",
        "call",
        "email"
      ],
      "first_seen": null,
      "last_seen": null,
      "specimens": 0,
      "updated": "2026-09-02"
    },
    {
      "slug": "netflix-payment-failed",
      "url": "https://soft2secure.com/scams/netflix-payment-failed",
      "json": "https://soft2secure.com/scams/netflix-payment-failed.json",
      "name": "Netflix \"payment failed / account suspended\" phishing",
      "family": "account-suspension",
      "family_label": "Account suspension / verification",
      "impersonates": "Netflix",
      "status": "dormant",
      "channels": [
        "email"
      ],
      "first_seen": "2019-08",
      "last_seen": "2019-08",
      "specimens": 1,
      "updated": "2026-09-02"
    },
    {
      "slug": "norton-renewal-invoice",
      "url": "https://soft2secure.com/scams/norton-renewal-invoice",
      "json": "https://soft2secure.com/scams/norton-renewal-invoice.json",
      "name": "Norton renewal invoice scam",
      "family": "fake-invoice-callback",
      "family_label": "Fake invoice, callback",
      "impersonates": "Norton",
      "status": "active",
      "channels": [
        "email"
      ],
      "first_seen": null,
      "last_seen": null,
      "specimens": 0,
      "updated": "2026-09-02"
    },
    {
      "slug": "password-sextortion",
      "url": "https://soft2secure.com/scams/password-sextortion",
      "json": "https://soft2secure.com/scams/password-sextortion.json",
      "name": "\"I know your password\" sextortion emails",
      "family": "sextortion",
      "family_label": "Sextortion",
      "impersonates": null,
      "status": "active",
      "channels": [
        "email"
      ],
      "first_seen": "2018-10",
      "last_seen": null,
      "specimens": 3,
      "updated": "2026-09-02"
    },
    {
      "slug": "paypal-invoice",
      "url": "https://soft2secure.com/scams/paypal-invoice",
      "json": "https://soft2secure.com/scams/paypal-invoice.json",
      "name": "PayPal invoice / money-request scam",
      "family": "fake-invoice-callback",
      "family_label": "Fake invoice, callback",
      "impersonates": "PayPal",
      "status": "active",
      "channels": [
        "email"
      ],
      "first_seen": null,
      "last_seen": null,
      "specimens": 0,
      "updated": "2026-09-02"
    },
    {
      "slug": "qatar-airways-booking",
      "url": "https://soft2secure.com/scams/qatar-airways-booking",
      "json": "https://soft2secure.com/scams/qatar-airways-booking.json",
      "name": "Qatar Airways fake booking confirmation",
      "family": "account-suspension",
      "family_label": "Account suspension / verification",
      "impersonates": "Qatar Airways",
      "status": "archived",
      "channels": [
        "email"
      ],
      "first_seen": "2019-04",
      "last_seen": "2019-04",
      "specimens": 1,
      "updated": "2026-09-02"
    },
    {
      "slug": "telstra-bigpond-account-suspension",
      "url": "https://soft2secure.com/scams/telstra-bigpond-account-suspension",
      "json": "https://soft2secure.com/scams/telstra-bigpond-account-suspension.json",
      "name": "Telstra / BigPond bill, refund and suspension emails",
      "family": "account-suspension",
      "family_label": "Account suspension / verification",
      "impersonates": "Telstra (BigPond)",
      "status": "archived",
      "channels": [
        "email"
      ],
      "first_seen": "2016-12",
      "last_seen": "2017-04",
      "specimens": 2,
      "updated": "2026-09-02"
    },
    {
      "slug": "traffic-infringement-notice",
      "url": "https://soft2secure.com/scams/traffic-infringement-notice",
      "json": "https://soft2secure.com/scams/traffic-infringement-notice.json",
      "name": "Traffic infringement notice emails",
      "family": "prize-refund-tax",
      "family_label": "Prize, refund, tax, fine",
      "impersonates": "a traffic authority (varies by country)",
      "status": "archived",
      "channels": [
        "email"
      ],
      "first_seen": "2016-12",
      "last_seen": "2016-12",
      "specimens": 1,
      "updated": "2026-09-02"
    },
    {
      "slug": "usps-redelivery-fee-text",
      "url": "https://soft2secure.com/scams/usps-redelivery-fee-text",
      "json": "https://soft2secure.com/scams/usps-redelivery-fee-text.json",
      "name": "USPS \"package on hold\" text (smishing)",
      "family": "package-delivery",
      "family_label": "Package delivery",
      "impersonates": "USPS",
      "status": "active",
      "channels": [
        "sms"
      ],
      "first_seen": null,
      "last_seen": null,
      "specimens": 0,
      "updated": "2026-09-02"
    },
    {
      "slug": "whatsapp-part-time-job",
      "url": "https://soft2secure.com/scams/whatsapp-part-time-job",
      "json": "https://soft2secure.com/scams/whatsapp-part-time-job.json",
      "name": "WhatsApp \"part-time job\" task scam",
      "family": "job-task",
      "family_label": "Job offer / task",
      "impersonates": "a recruiter or HR team (no real brand)",
      "status": "active",
      "channels": [
        "whatsapp",
        "sms"
      ],
      "first_seen": null,
      "last_seen": null,
      "specimens": 0,
      "updated": "2026-09-02"
    },
    {
      "slug": "zeus-virus-detected-alert",
      "url": "https://soft2secure.com/scams/zeus-virus-detected-alert",
      "json": "https://soft2secure.com/scams/zeus-virus-detected-alert.json",
      "name": "\"Zeus Virus Detected\" Windows Defender alert page",
      "family": "tech-support-popup",
      "family_label": "Tech-support pop-up",
      "impersonates": "Microsoft (Windows Defender)",
      "status": "archived",
      "channels": [
        "web",
        "call"
      ],
      "first_seen": "2017-04",
      "last_seen": "2017-04",
      "specimens": 1,
      "updated": "2026-09-02"
    }
  ]
}