Patterns

These are patterns, not verdicts. ScamLens looks for 19 fixed patterns in the text you paste; each one is a warning sign that often appears in scam messages, and none of them proves anything about a person on its own.

Check a message

Guaranteed or fixed returns

rule guaranteed_returns

What it looks like: A promise of fixed daily or weekly profit, "double your money", or "no risk" investing.
Why such messages use it: Real investments cannot promise a fixed profit; the promise creates trust before money is asked for.
What to do: Do not invest. Check whether the firm is registered with SEBI or RBI through their own websites.
Illustrative example: “Join now and get guaranteed returns of 3% daily on your deposit.”; Try this example
When it is not a signal: Statements that returns are not guaranteed ("past returns do not guarantee future returns").
A negation right before it cancels it ("does not guarantee").
Inside a sentence that warns about scams ("beware", "red flag", "police said", "If someone says ..., it is a fraud") it is shown but not counted, unless that sentence also asks you to pay, send, join or click.
How it counts: One counted pattern, however many times it appears. Patterns alone can raise the level to Elevated, never to High.

Pay to withdraw

rule withdrawal_fee

What it looks like: A fee, tax or "activation charge" you must pay before you can take out money shown in an account.
Why such messages use it: The balance on screen is usually not real; each fee is another payment.
What to do: Do not pay. A genuine platform deducts charges from the balance, it does not ask for new money.
Illustrative example: “Your profit is ready, but you must pay the withdrawal fee of Rs 4,999 first.”; Try this example
When it is not a signal: Inside a sentence that warns about scams ("beware", "red flag", "police said", "If someone says ..., it is a fraud") it is shown but not counted, unless that sentence also asks you to pay, send, join or click.
How it counts: One counted pattern, however many times it appears. Patterns alone can raise the level to Elevated, never to High.

Urgency or a threat of blocking

rule urgency_deadline

What it looks like: "Within 2 hours", "last chance", "your account will be blocked today".
Why such messages use it: Pressure leaves no time to check with someone else.
What to do: Pause. Contact the bank or company through the number on its official website or your card.
Illustrative example: “Update now or your account will be blocked within 2 hours.”; Try this example
When it is not a signal: Inside a sentence that warns about scams ("beware", "red flag", "police said", "If someone says ..., it is a fraud") it is shown but not counted, unless that sentence also asks you to pay, send, join or click.
How it counts: One counted pattern, however many times it appears. Patterns alone can raise the level to Elevated, never to High.

Asks for a seed phrase or private key

rule seed_phrase_request

What it looks like: A request for the 12 or 24 recovery words of a crypto wallet, or its private key.
Why such messages use it: Whoever has these words controls the wallet and can empty it.
What to do: Never share them with anyone, including "support" staff. No genuine service asks for them.
Illustrative example: “To verify your wallet, send us your 12-word recovery phrase.”; Try this example
When it is not a signal: A negation earlier in the same sentence cancels it ("never share your OTP").
Inside a sentence that warns about scams ("beware", "red flag", "police said", "If someone says ..., it is a fraud") it is shown but not counted, unless that sentence also asks you to pay, send, join or click.
How it counts: One counted pattern, however many times it appears. Patterns alone can raise the level to Elevated, never to High.

Asks for an OTP, UPI PIN or CVV

rule otp_pin_request

What it looks like: A request to share or read out a one-time password, UPI PIN, ATM PIN or card CVV.
Why such messages use it: These codes approve payments; sharing one lets the other person take money.
What to do: Never share them. A UPI PIN is only needed to send money, never to receive it.
Illustrative example: “Please share the OTP you just received to complete the refund.”; Try this example
When it is not a signal: A message that itself contains your code ("Share OTP 4821 with the delivery agent"): that is the issuer's notice.
A negation earlier in the same sentence cancels it ("never share your OTP").
Inside a sentence that warns about scams ("beware", "red flag", "police said", "If someone says ..., it is a fraud") it is shown but not counted, unless that sentence also asks you to pay, send, join or click.
How it counts: One counted pattern, however many times it appears. Patterns alone can raise the level to Elevated, never to High.

Moves the chat to Telegram or WhatsApp

rule move_platform

What it looks like: "Let's continue on Telegram", "join our WhatsApp group".
Why such messages use it: Private apps make the conversation harder to trace and easier to control.
What to do: Be careful if a stranger insists on switching apps, especially together with other signs.
Illustrative example: “Our VIP team will guide you, join our Telegram group for guaranteed returns.”; Try this example
When it is not a signal: On its own: it counts only when another rule also fires in the same text.
It counts only when a second, different pattern is also found.
Inside a sentence that warns about scams ("beware", "red flag", "police said", "If someone says ..., it is a fraud") it is shown but not counted, unless that sentence also asks you to pay, send, join or click.
How it counts: One counted pattern, however many times it appears. Patterns alone can raise the level to Elevated, never to High.

Asks you to install a remote-access app

rule remote_access_app

What it looks like: AnyDesk, TeamViewer, QuickSupport, screen sharing, or an APK from a link.
Why such messages use it: These apps let the other person see and control your phone, including banking apps.
What to do: Do not install. Uninstall it if you already did, and tell your bank.
Illustrative example: “Please install AnyDesk so our executive can fix your account.”; Try this example
When it is not a signal: A negation earlier in the same sentence cancels it ("never share your OTP").
Inside a sentence that warns about scams ("beware", "red flag", "police said", "If someone says ..., it is a fraud") it is shown but not counted, unless that sentence also asks you to pay, send, join or click.
How it counts: One counted pattern, however many times it appears. Patterns alone can raise the level to Elevated, never to High.

Claims to be police, CBI, customs or another authority

rule authority_impersonation

What it looks like: "Mumbai Police", "CBI officer", "customs department", "TRAI".
Why such messages use it: Authority makes threats believable and stops people from asking questions.
What to do: Hang up. Officials do not demand payments over video calls or chats; call 1930 to check.
Illustrative example: “This is the CBI officer handling your case, stay on the line.”; Try this example
When it is not a signal: Inside a sentence that warns about scams ("beware", "red flag", "police said", "If someone says ..., it is a fraud") it is shown but not counted, unless that sentence also asks you to pay, send, join or click.
How it counts: One counted pattern, however many times it appears. Patterns alone can raise the level to Elevated, never to High.

"Digital arrest" or arrest-warrant threat

rule digital_arrest

What it looks like: "You are under digital arrest", "stay on the video call", a parcel with drugs in your name.
Why such messages use it: Fear and isolation: the person is kept on a call until they transfer money.
What to do: There is no such thing as a digital arrest in Indian law. End the call and call 1930.
Illustrative example: “You are under digital arrest, stay on the video call until the inquiry is complete.”; Try this example
When it is not a signal: Advice that names the threat ("there is no such thing as a digital arrest").
Inside a sentence that warns about scams ("beware", "red flag", "police said", "If someone says ..., it is a fraud") it is shown but not counted, unless that sentence also asks you to pay, send, join or click.
How it counts: One counted pattern, however many times it appears. Patterns alone can raise the level to Elevated, never to High.

KYC, PAN or Aadhaar update threat

rule fake_kyc

What it looks like: "Your KYC has expired", "PAN will be blocked", with a link or number to call.
Why such messages use it: It looks routine, and the link leads to a page that collects card or login details.
What to do: Update KYC only in the bank's own app or branch; never through a link in a message.
Illustrative example: “Your KYC has expired and your account will be suspended, click the link to update.”; Try this example
When it is not a signal: A negation earlier in the same sentence cancels it ("never share your OTP").
Inside a sentence that warns about scams ("beware", "red flag", "police said", "If someone says ..., it is a fraud") it is shown but not counted, unless that sentence also asks you to pay, send, join or click.
How it counts: One counted pattern, however many times it appears. Patterns alone can raise the level to Elevated, never to High.

Refund that needs your PIN, a QR scan or a link

rule fake_refund

What it looks like: A refund or cashback you must "collect" by scanning a QR code or entering your UPI PIN.
Why such messages use it: Scanning or entering a PIN sends money out of your account, not in.
What to do: Never enter a PIN to receive money. Refunds arrive on their own.
Illustrative example: “Your refund of Rs 2,499 is ready, scan the QR code to receive it.”; Try this example
When it is not a signal: A negation earlier in the same sentence cancels it ("never share your OTP").
Inside a sentence that warns about scams ("beware", "red flag", "police said", "If someone says ..., it is a fraud") it is shown but not counted, unless that sentence also asks you to pay, send, join or click.
How it counts: One counted pattern, however many times it appears. Patterns alone can raise the level to Elevated, never to High.

Like-and-earn or paid online tasks

rule task_earn

What it looks like: Money for liking videos, rating hotels or "prepaid tasks", often starting with small real payouts.
Why such messages use it: Small early payouts build trust before a larger "task" needs your money.
What to do: Stop before paying anything. Real jobs do not ask you to deposit money.
Illustrative example: “Like these videos and earn Rs 150 per task, work from home and earn daily.”; Try this example
When it is not a signal: Inside a sentence that warns about scams ("beware", "red flag", "police said", "If someone says ..., it is a fraud") it is shown but not counted, unless that sentence also asks you to pay, send, join or click.
How it counts: One counted pattern, however many times it appears. Patterns alone can raise the level to Elevated, never to High.

Romance that turns into an investment pitch

rule romance_investment

What it looks like: A new online friend or partner who soon suggests a trading platform or crypto.
Why such messages use it: Emotional trust is used to steer someone into a fake platform.
What to do: Do not invest through someone you only know online. Talk to family or a friend first.
Illustrative example: “My love, I made so much on this crypto trading platform, you should invest too.”; Try this example
When it is not a signal: Inside a sentence that warns about scams ("beware", "red flag", "police said", "If someone says ..., it is a fraud") it is shown but not counted, unless that sentence also asks you to pay, send, join or click.
How it counts: One counted pattern, however many times it appears. Patterns alone can raise the level to Elevated, never to High.

Pay into someone else's account

rule third_party_account

What it looks like: "Pay to my uncle's account", "use the company settlement UPI ID".
Why such messages use it: Money sent to a third party is harder to trace back to the person asking.
What to do: Pay only the business itself, through its official, verified payment page.
Illustrative example: “Transfer the amount to my manager's account, it is our company account.”; Try this example
When it is not a signal: Inside a sentence that warns about scams ("beware", "red flag", "police said", "If someone says ..., it is a fraud") it is shown but not counted, unless that sentence also asks you to pay, send, join or click.
How it counts: One counted pattern, however many times it appears. Patterns alone can raise the level to Elevated, never to High.

"Send a small amount first"

rule small_amount_first

What it looks like: A token, test or minimum payment to "verify" something.
Why such messages use it: A small first payment tests whether you will pay, and makes the next request easier.
What to do: Do not send anything to verify an account or a prize.
Illustrative example: “Just send a small amount first so we can verify your UPI ID.”; Try this example
When it is not a signal: Inside a sentence that warns about scams ("beware", "red flag", "police said", "If someone says ..., it is a fraud") it is shown but not counted, unless that sentence also asks you to pay, send, join or click.
How it counts: One counted pattern, however many times it appears. Patterns alone can raise the level to Elevated, never to High.

Screenshots or claims of others' profits

rule fake_profit_proof

What it looks like: Screenshots of withdrawals, "our members earned 3 lakh".
Why such messages use it: Screenshots are easy to fake and create pressure to join.
What to do: Ignore screenshots; they prove nothing. Check registrations yourself.
Illustrative example: “See the screenshots of profits, our members earned 2 lakh last month.”; Try this example
When it is not a signal: Inside a sentence that warns about scams ("beware", "red flag", "police said", "If someone says ..., it is a fraud") it is shown but not counted, unless that sentence also asks you to pay, send, join or click.
How it counts: One counted pattern, however many times it appears. Patterns alone can raise the level to Elevated, never to High.

Prize, lottery or lucky draw win

rule prize_lottery

What it looks like: "You have won", KBC lottery, a lucky draw that needs a fee to claim.
Why such messages use it: A win you never entered is followed by a "processing fee".
What to do: You cannot win a draw you did not enter. Do not pay any fee.
Illustrative example: “Congratulations, you have won the KBC lottery of Rs 25 lakh.”; Try this example
When it is not a signal: "Lucky draw" alone (for example a housing society's festival draw) unless it addresses you, a claim or a payment.
Inside a sentence that warns about scams ("beware", "red flag", "police said", "If someone says ..., it is a fraud") it is shown but not counted, unless that sentence also asks you to pay, send, join or click.
How it counts: One counted pattern, however many times it appears. Patterns alone can raise the level to Elevated, never to High.

Electricity or gas disconnection threat

rule utility_disconnection

What it looks like: "Your electricity will be disconnected tonight" with a number to call.
Why such messages use it: Fear of a sudden outage pushes people to pay a fake bill or install an app.
What to do: Check your bill in the official board's app or website, or visit the office.
Illustrative example: “Your electricity connection will be disconnected tonight, call this officer now.”; Try this example
When it is not a signal: Inside a sentence that warns about scams ("beware", "red flag", "police said", "If someone says ..., it is a fraud") it is shown but not counted, unless that sentence also asks you to pay, send, join or click.
How it counts: One counted pattern, however many times it appears. Patterns alone can raise the level to Elevated, never to High.

"Account hacked" and a security deposit

rule account_hacked_deposit

What it looks like: "Your bank account has been hacked", a demand to pay a "security deposit" to stop a freeze, and "do not tell anyone or visit the branch".
Why such messages use it: Fear of losing the account makes people pay fast; keeping them away from the bank stops anyone from checking.
What to do: Do not pay. Call the number on the back of your card or visit your branch yourself; a bank never asks for a deposit to protect an account.
Illustrative example: “Your bank account has been hacked. Pay a security deposit to stop the freeze.”; Try this example
When it is not a signal: A rental or utility security deposit on its own: the rule counts only together with another pattern.
It counts only when a second, different pattern is also found.
Inside a sentence that warns about scams ("beware", "red flag", "police said", "If someone says ..., it is a fraud") it is shown but not counted, unless that sentence also asks you to pay, send, join or click.
How it counts: One counted pattern, however many times it appears. Patterns alone can raise the level to Elevated, never to High.