================================================================================
SCAM DETECTION CHATBOT — KNOWLEDGE BASE
Audience: General Consumers
Version: 1.0
================================================================================

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SECTION 1: UNIVERSAL RED FLAGS (Apply to ALL scam types)
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

These signals should raise suspicion regardless of the scam category:

- URGENCY PRESSURE: Phrases like "Act now," "Limited time," "You must respond
  within 24 hours," or "Your account will be suspended" are manipulation tactics
  designed to prevent you from thinking critically.

- REQUESTS FOR PERSONAL INFO: Legitimate organizations never ask for your Social
  Security number, bank account details, passwords, or PINs via email or chat.

- UNSOLICITED CONTACT: You did not initiate the conversation, yet they claim you
  owe money, won a prize, or need to verify something.

- TOO GOOD TO BE TRUE: Offers of large sums of money, guaranteed investment
  returns, or high-paying jobs with little work are classic lures.

- GRAMMATICAL ERRORS & AWKWARD PHRASING: Many scams originate overseas and
  contain spelling mistakes, odd punctuation, or unnatural sentence structure.

- REQUESTS FOR UNUSUAL PAYMENT: Gift cards, wire transfers, cryptocurrency, or
  Zelle are preferred by scammers because transactions are hard to reverse.

- SUSPICIOUS SENDER ADDRESS: The display name may look legitimate, but the
  actual email domain is misspelled or unrelated (e.g., support@amaz0n-help.net).

- LINKS THAT DON'T MATCH: Hovering over a link reveals a URL different from
  what the text says (e.g., text says "PayPal.com" but link goes to paypa1.xyz).

- SECRECY REQUESTS: "Don't tell your family," "This is confidential," or "Your
  bank won't understand" are major warning signs.

- IMPERSONATION OF AUTHORITY: Fake government agencies, banks, or well-known
  companies are used to manufacture trust and fear.

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SECTION 2: SCAM TYPE — EMAIL PHISHING
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

WHAT IT IS:
Phishing emails impersonate trusted brands (banks, Amazon, PayPal, Netflix,
the IRS, Microsoft, etc.) to trick users into clicking malicious links or
handing over login credentials and financial information.

COMMON PATTERNS:
- "Your account has been compromised. Verify now to avoid suspension."
- "You have a package held at customs. Pay a small fee to release it."
- "Unusual sign-in activity detected. Click here to secure your account."
- "Your payment failed. Update your billing information immediately."
- Fake invoice attachments (PDFs or Word docs containing malware).

SPECIFIC RED FLAGS:
- Sender domain doesn't match the company (e.g., paypal-service@gmail.com).
- Email asks you to click a link and enter your username/password.
- Greeting says "Dear Customer" or "Dear User" instead of your name.
- Logo looks slightly off, blurry, or pixelated.
- Link URL contains extra words or random characters (e.g., paypal.login-verify.com).
- Email threatens account closure, legal action, or financial penalty.

WHY IT'S DANGEROUS:
Clicking the link leads to a fake website that captures your credentials.
Attachments may install malware or ransomware on your device.

CHATBOT WARNING TO USER:
"This looks like a phishing email. Real companies will never ask for your
password or payment details by email. Do not click any links or open
attachments. Go directly to the company's official website by typing it
yourself, or call their official customer service number."

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SECTION 3: SCAM TYPE — ROMANCE SCAMS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

WHAT IT IS:
A scammer creates a fake identity on dating sites, social media, or apps to
build an emotional relationship with the victim over weeks or months, then
fabricates a crisis requiring money.

COMMON PROFILES USED:
- Military personnel deployed overseas.
- Doctors or engineers working on international projects.
- Widowed professionals raising a child alone.
- Attractive individuals with limited or inconsistent social media history.

COMMON PATTERNS:
- Moves very fast — declares love or deep connection unusually quickly.
- Claims to be working abroad and cannot meet in person (yet).
- Makes excuses for never being able to video call (camera broken, bad connection).
- Eventually hits a crisis: medical emergency, legal trouble, stuck at customs,
  needs money to return home.
- Asks for wire transfer, gift cards, or crypto — never a traceable method.
- After first payment, more "emergencies" follow.

SPECIFIC RED FLAGS:
- Profile photos are too polished (often stolen from models or military personnel).
- Stories change or contain inconsistencies.
- Asks to move communication off the dating platform to email or WhatsApp quickly.
- Refuses or avoids video calls.
- Asks for money, gift cards, or cryptocurrency.
- Claims to love you but you have never met.

WHY IT'S DANGEROUS:
Victims can lose tens of thousands of dollars and suffer severe emotional harm.
Scammers are often part of organized criminal groups.

CHATBOT WARNING TO USER:
"This has several signs of a romance scam. This person may not be who they
claim to be. Never send money, gift cards, or cryptocurrency to someone you
haven't met in person. Do a reverse image search on their photos at
images.google.com. If you suspect a scam, report it to the FTC at
reportfraud.ftc.gov."

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SECTION 4: SCAM TYPE — CRYPTO / INVESTMENT FRAUD
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

WHAT IT IS:
Fraudulent investment schemes promise high or guaranteed returns through
cryptocurrency, forex trading, stock tips, or fake investment platforms.
"Pig butchering" scams combine romance and investment fraud.

COMMON PATTERNS:
- "I made $50,000 last month — I can show you how."
- Fake trading platforms that show growing balances you can never actually withdraw.
- Celebrity or influencer endorsements (almost always fabricated).
- Initial small "test" withdrawals are allowed to build trust, then larger deposits
  are locked or fees are demanded to release funds.
- Promises of 10%, 20%, or higher guaranteed monthly returns.
- Urgency to invest before a "limited window" closes.

SPECIFIC RED FLAGS:
- No verifiable company registration, license, or physical address.
- Platform is not listed with FINRA, SEC, or a recognized regulatory body.
- You were recruited via social media, dating app, or unsolicited message.
- You must recruit others to earn more (Ponzi / MLM structure).
- Withdrawal requests are blocked, delayed, or require additional "taxes" or "fees."
- Returns are consistently too high regardless of market conditions.

WHY IT'S DANGEROUS:
Money sent to crypto addresses is nearly impossible to recover. These scams
have cost victims billions of dollars globally.

CHATBOT WARNING TO USER:
"This shows signs of an investment scam. No legitimate investment guarantees
high returns, and real platforms are registered with financial regulators.
Do not send money or cryptocurrency. Verify any investment platform at
investor.gov or finra.org/investors. If you've already sent money, contact
your bank immediately and report to the FTC at reportfraud.ftc.gov."

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SECTION 5: SCAM TYPE — TECH SUPPORT SCAMS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

WHAT IT IS:
Scammers impersonate Microsoft, Apple, Google, or antivirus companies and
claim your device has a virus or has been hacked, then charge for fake repairs
or install actual malware via remote access tools.

COMMON PATTERNS:
- Pop-up alert on your screen: "Your computer is infected! Call 1-800-XXX-XXXX."
- Unsolicited phone call claiming to be from Microsoft or Apple tech support.
- Email saying your device sent suspicious activity and needs immediate attention.
- Asks you to download remote access software (AnyDesk, TeamViewer, etc.).
- Claims your bank account was accessed and asks you to verify by logging in
  while they watch your screen.

SPECIFIC RED FLAGS:
- Microsoft, Apple, and Google do NOT proactively call customers about viruses.
- Real security alerts from your OS do not include phone numbers to call.
- Being asked to download software to give a stranger remote access to your computer.
- Pressure to pay via gift cards, wire transfer, or cryptocurrency for "repairs."
- Technician claims to find hundreds of "infections" and demands payment immediately.

WHY IT'S DANGEROUS:
Remote access allows scammers to steal files, install real malware, access
banking apps, and drain accounts while you watch.

CHATBOT WARNING TO USER:
"This is a tech support scam. Microsoft, Apple, and Google will never
contact you unsolicited about a virus. Do not call the number, do not
download any software, and do not give anyone remote access to your computer.
Close the pop-up by restarting your computer. Report it to the FTC at
reportfraud.ftc.gov."

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SECTION 6: SCAM TYPE — FAKE JOB OFFER SCAMS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

WHAT IT IS:
Fake job listings or unsolicited job offers lure victims with easy, high-paying
remote work. They either steal personal information, extract money upfront, or
use the victim as an unwitting money mule.

COMMON PATTERNS:
- "Work from home, earn $500–$1,000/day liking social media posts."
- "We found your resume online and want to hire you immediately — no interview needed."
- Asks for your SSN, bank details, or ID for "payroll setup" before you start.
- Sends you a check to buy equipment, then asks you to wire the remainder back
  (the check later bounces, and you owe the bank).
- Job involves receiving and forwarding packages or payments (money mule activity).

SPECIFIC RED FLAGS:
- Hired without a real interview (or interview via text/chat only).
- Company is hard to verify — no real website, no LinkedIn presence, no reviews.
- Salary is unusually high for vague or simple tasks.
- Asked to pay for training, equipment, background checks, or certifications upfront.
- Overpayment check scam: sent more than agreed and asked to return the difference.
- Communication is exclusively via WhatsApp, Telegram, or personal email.

WHY IT'S DANGEROUS:
Victims lose money, have their identities stolen, or unknowingly commit federal
crimes (money mule activity carries criminal liability).

CHATBOT WARNING TO USER:
"This has the hallmarks of a fake job scam. Legitimate employers never ask
for payment upfront or send checks asking you to wire money back. Never share
your SSN or bank information until you have verified the employer thoroughly.
Search the company name plus the word 'scam' online. Report suspicious job
offers to the FTC at reportfraud.ftc.gov or the FBI at ic3.gov."

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SECTION 7: SCAM TYPE — IRS / GOVERNMENT IMPERSONATION
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

WHAT IT IS:
Scammers pose as IRS agents, Social Security Administration (SSA) officers,
immigration officials, or law enforcement to intimidate victims into paying
fake debts or fines immediately.

COMMON PATTERNS:
- "You owe back taxes. Pay immediately or face arrest."
- "Your Social Security number has been suspended due to suspicious activity."
- "There is a warrant out for your arrest. Pay to have it cleared."
- Callers may spoof real government phone numbers to appear legitimate.
- Pressure to pay via iTunes gift cards, Google Play cards, wire transfer, or crypto.

SPECIFIC RED FLAGS:
- The IRS NEVER calls demanding immediate payment without first mailing you a bill.
- The IRS NEVER demands payment via gift cards, wire transfer, or cryptocurrency.
- Government agencies do not threaten immediate arrest over the phone or email.
- Caller refuses to send written documentation of the alleged debt.
- Caller demands secrecy and instructs you not to tell family members.

HOW THE REAL IRS WORKS:
- The IRS contacts taxpayers primarily by mail.
- You always have the right to appeal or question what you owe.
- If you owe taxes, you can pay at IRS.gov directly.

CHATBOT WARNING TO USER:
"This is a government impersonation scam. The IRS and Social Security
Administration do not demand immediate payment by phone, email, or gift cards.
Hang up or do not respond. If you're worried about a real tax issue, go
directly to IRS.gov or call 1-800-829-1040. Report this to the Treasury
Inspector General at 1-800-366-4484 or the FTC at reportfraud.ftc.gov."

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SECTION 8: SCAM TYPE — PRIZE / LOTTERY SCAMS
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

WHAT IT IS:
The victim is told they've won a lottery, sweepstakes, or prize but must pay
fees, taxes, or processing charges upfront to claim it. No prize ever exists.

COMMON PATTERNS:
- "Congratulations! You've been selected to receive $500,000. Pay a $500
  processing fee to claim your winnings."
- Fake notifications mimicking Publishers Clearing House, national lotteries,
  or foreign lotteries.
- "You are the lucky winner of our Facebook giveaway — send us your address
  and a small shipping fee."
- A check is sent for "partial winnings" with instructions to deposit it and
  wire back the taxes (check later bounces).

SPECIFIC RED FLAGS:
- You never entered the contest, lottery, or giveaway they reference.
- You must pay money to receive money — this is the defining sign of a scam.
- Winner notifications arrive via email, text, or social media instead of
  certified mail (for legitimate sweepstakes).
- Requests for your SSN or bank details to "deposit your winnings."
- Urgency: "You must claim within 48 hours or the prize is forfeited."

A KEY RULE:
Legitimate lotteries and sweepstakes NEVER require winners to pay fees or
taxes upfront. Any required taxes are deducted from the prize itself.

CHATBOT WARNING TO USER:
"This is a prize or lottery scam. You cannot win a contest you never entered,
and real prizes never require upfront payment. Do not send any money or
share your personal information. Delete or ignore this message. If you've
already paid, contact your bank immediately and report the scam to the FTC
at reportfraud.ftc.gov."

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SECTION 9: SCAM KEYWORD & PHRASE TRIGGER LIST
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

The following words and phrases, especially in combination, are strong
indicators of a scam. Use these as detection triggers.

HIGH-RISK PHRASES:
- "Act immediately" / "Respond within 24 hours" / "Urgent action required"
- "You have been selected" / "Congratulations, you've won"
- "Your account has been compromised" / "Suspicious activity detected"
- "Pay with gift cards" / "Buy iTunes cards" / "Send Bitcoin"
- "Do not tell anyone" / "Keep this confidential"
- "Send me your SSN" / "Wire the funds"
- "Guaranteed returns" / "Risk-free investment"
- "Your Social Security number has been suspended"
- "Warrant for your arrest" / "Police are on their way"
- "Click here to verify your account"
- "You owe back taxes" / "Immediate payment required"
- "I am deployed overseas" / "I am working on an oil rig"
- "I need your help — I'm in trouble"
- "Send a processing fee to claim your prize"
- "Your computer has a virus — call this number"
- "We found your resume and want to hire you"
- "Deposit this check and send us back the difference"

SUSPICIOUS PAYMENT METHOD MENTIONS:
- Gift cards (iTunes, Google Play, Amazon, Steam, Target)
- Wire transfer / Western Union / MoneyGram
- Zelle (to strangers)
- Bitcoin / Ethereum / Cryptocurrency
- Cash App / Venmo (to strangers)

SUSPICIOUS DOMAIN PATTERNS (for email sender analysis):
- Misspelled brand names: amaz0n, paypa1, netf1ix, micros0ft
- Hyphens in brand domains: amazon-support.com, apple-id-verify.net
- Extra words added: paypal-billing-department.com
- Free email providers for "official" contact: support@gmail.com, irs@yahoo.com
- Country code domains for US companies: amazon.co.ru, apple.com.br.xyz

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SECTION 10: WHAT TO DO IF YOU SUSPECT OR HAVE BEEN SCAMMED
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

IF YOU HAVEN'T SENT MONEY OR INFORMATION YET:
1. Do not respond, click links, or call any phone numbers in the message.
2. Block the sender.
3. Delete the message.
4. If impersonating a real brand, forward the email to that company's abuse
   team (e.g., phishing@paypal.com, reportphishing@apple.com).

IF YOU HAVE ALREADY SENT MONEY:
1. Contact your bank or credit card company immediately — ask about reversing
   the transaction.
2. If you sent a wire transfer, call your bank within 24 hours.
3. If you paid with gift cards, contact the gift card company directly.
4. If you sent cryptocurrency, contact the exchange if applicable.

IF YOU SHARED PERSONAL INFORMATION:
1. Change passwords for any accounts that may be affected.
2. Place a fraud alert or credit freeze at the three major bureaus:
   - Equifax: equifax.com | 1-800-525-4360
   - Experian: experian.com | 1-888-397-3742
   - TransUnion: transunion.com | 1-800-916-8800
3. Monitor your credit report at annualcreditreport.com.

WHERE TO REPORT SCAMS:
- FTC (Federal Trade Commission): reportfraud.ftc.gov
- FBI Internet Crime Complaint Center: ic3.gov
- IRS impersonation scams: 1-800-366-4484
- Social Security scams: oig.ssa.gov/report
- Your state's attorney general office

━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
SECTION 11: CHATBOT RESPONSE TEMPLATES
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━

Use these as base templates for chatbot responses when a scam is detected.

--- TEMPLATE: HIGH CONFIDENCE SCAM DETECTED ---
"⚠️ WARNING: This looks like a scam.

[INSERT SCAM TYPE]-specific explanation of why this is suspicious.

What you should do:
• Do NOT click any links, call any numbers, or reply.
• Do NOT send money, gift cards, or personal information.
• [Insert relevant action, e.g., 'Contact your bank immediately' or 'Report to the FTC at reportfraud.ftc.gov.']

You were right to check. Stay safe."

--- TEMPLATE: POSSIBLE SCAM / SUSPICIOUS ---
"🔶 CAUTION: This message has some warning signs.

[Explain specific red flags detected.]

Before taking any action:
• Verify the sender by going directly to the official website — do not use
  any links or phone numbers in the message.
• When in doubt, do not respond.

If you're unsure, it's always safer to ignore the message."

--- TEMPLATE: LOOKS LEGITIMATE ---
"✅ This message doesn't match common scam patterns, but always stay alert.

Reminders:
• Never share passwords or PINs — even with companies you trust.
• If something feels off, trust your instincts and verify independently."

================================================================================
END OF KNOWLEDGE BASE
================================================================================