Warning signs of seven common scam scripts

This guide is based on the script corpus and scenario playbooks in the DeepSuck repository (site/assets/core/scam_scripts.json and scam_playbooks.json) and on the categories used by the public intel library. All corpus material comes from public sources, labelled by type: public police bulletins, typical cases published by courts, official anti-fraud handbooks and public datasets. Most entries are summarised from multiple public awareness materials and do not correspond to any single case (see the "scam script corpus" section of docs/INTEL.md).

We only describe warning signs and responses. Actual lines are not repeated here; to see a full playbook, you can play the scammer once in the sandbox.

Five stages that almost always appear

Nearly every phone or online scam goes through these five steps, in varying order and weight:

1. Opening: a claimed identity and a pretext — a refund, a criminal case, a "wrong friend request", a side job, a loan;
2. Building trust: confirming your personal details, quoting a staff number, small talk, a small payout, screenshots;
3. Pressure: threats of loss, deadlines, demands for secrecy, leveraging money you have already put in, forged documents or receipts;
4. The ask: verification codes, card numbers, balances, ID photos; installing an app, sharing your screen, borrowing or topping up;
5. Payment instructions: an account, wallet address, URL or contact to pay, plus a request to delete the chat.

Once a conversation reaches step 3 or 4, stop — no matter who the caller claims to be.

Red flags in any scenario

• You are asked to read out or enter a verification code;
• You are asked to share your screen, allow remote assistance, or install an app or join a meeting room they choose;
• You are told to move money into a "safe account", "supervised account" or "verification account";
• You are told to keep it secret, not to hang up, not to tell family or colleagues;
• You are given a very short deadline;
• You must pay first to receive money: unfreezing fees, deposits, handling fees, taxes;
• You are moved off the call into a private chat, a group or an unfamiliar platform.

Seven common types

Fake customer service

Typical pretext: compensation for a defective product, a lost parcel, a membership about to auto-renew.

Warning signs: they contact you first about a refund; they want you to install meeting or remote-control software or share your screen; they ask you to open a credit line for "verification"; they say you will keep being charged or your credit score will suffer.

What to do: hang up, then open the official app or call the official hotline yourself. Legitimate refunds go back to the original payment method and never require you to make a transfer.

Fake police, prosecutors or courts

Typical pretext: someone from a "courier", "telecom" or "social insurance" office says your identity was misused, then transfers you to an "officer" or "prosecutor" who says you are suspected of money laundering or another crime.

Warning signs: a case handled over the phone; images or links to arrest warrants or freezing orders; demands for secrecy, staying on the line, or going alone to a hotel to "cooperate"; instructions to move funds into a "safe account" for review.

What to do: law enforcement does not handle cases by phone and there is no such thing as a "safe account". Hang up and call 110 or 96110 to check.

Fake boss or acquaintance

Typical pretext: a profile with the same photo and name as your boss, teacher or a relative, or "I have a new number", asking you to pay or lend money because they are in a meeting or need cash urgently.

Warning signs: a sudden new number plus a transfer request; refusing calls because of a meeting or bad signal; asking you not to tell anyone; a screenshot claiming "I have already sent you the money".

What to do: call the number you already had saved, or confirm in person. Do not trust screenshots — only money that has actually arrived in your account counts.

Romance-investment scams (Pig-butchering)

Typical pretext: a "wrong contact" turns into a long relationship, followed by an inside channel or a platform loophole to make money together.

Warning signs: someone you met online and never met in person offers to help you invest or gamble; your first small withdrawals succeed; larger withdrawals require taxes, deposits or unfreezing fees first; you are asked to top up with crypto.

What to do: never deposit on a site or app they provide and never send crypto to strangers. A platform that charges you before you can withdraw is fake.

Task scam (fake order-brushing rebates)

Typical pretext: a side job paid daily for simple tasks such as liking or following.

Warning signs: a few small payouts first; then "bonus orders" or "combo orders" that require you to advance money; when your money is stuck, they blame your mistake and ask for more to unfreeze it.

What to do: order brushing is illegal, and any "job" that asks you to pay first is a task scam. Do not install task apps from strangers or join unknown task groups.

Fake investment

Typical pretext: text messages, live streams or investment groups with a "mentor" or "analyst" offering free stock tips or trading signals.

Warning signs: promises of high, guaranteed returns; many group members posting profits and withdrawal screenshots; limited places and short windows; opening an account through a link or app shared in the group; paying before you can withdraw.

What to do: trade only through official channels of licensed institutions. A promise of guaranteed high returns is itself a warning sign.

Fake loans and credit repair

Typical pretext: either "no collateral, low interest, instant approval", or a fake lending-platform agent saying an old student loan was never closed and will hurt your credit.

Warning signs: fees before the loan is released — membership, deposit, unfreezing; claims that you entered your card number wrong and must pay to unlock funds; being told to borrow on a real platform and transfer it out to "clear the credit line"; misuse of regulators' names; insistence on finishing today.

What to do: legitimate lenders never charge before releasing a loan. Credit records cannot be "repaired", and "cancelling a student loan account" or "clearing a credit line" is not a thing. Check your credit report only through the official central bank credit reference channel.

If you have already paid

1. Call 110 immediately (mainland China) and contact your bank to try to stop the payment;
2. Keep chat logs, transfer receipts and the scammer's numbers and accounts;
3. If 96110 calls you, answer — it is the national anti-fraud warning line;
4. Report scam numbers, texts, URLs, apps and receiving accounts through the official national anti-fraud app's reporting feature; spam texts and nuisance calls can be reported to 12321.

DeepSuck's public intel library collects phone numbers, wallet addresses, URLs and script patterns that scammers reveal, for search and early warning. Intel is only a lead — numbers may be recycled or spoofed and can never be used to accuse anyone.