The practice inbox

A trap. The link belongs to a completely different address, and the email pushes you to pay quickly. Real parcel services do sometimes send payment links for customs fees — still, only pay in the app or on the website you open yourself.

• The sender's address ends in parcelgull-delivery.test — not parcelgull.test, the parcel service's address. One extra word makes it a completely different address.
• The link starts with “parcelgull.test”, but what matters is what comes right before the ending: customs-fee.test. The beginning is just camouflage.
• A small amount plus a deadline: nobody thinks twice about £1.99 — that's the whole trick. The fake page then asks for your card number.

Genuine. Nothing in this email asks you to enter or pay anything through a link.

• The sender's address ends in kestrelmoorbank.example, which fits your bank. On its own that proves little, because senders can be faked — but here the email also asks nothing of you.
• No time pressure, no link, nothing to type in. That the email knows your name proves nothing — scammers sometimes know it too. What matters: you're asked to sign in yourself, the usual way.

Genuine. The email fits your order and asks nothing of you. You don't need the link, though: to check, open the ParcelGull app or type the address yourself. And if you chose “trap”, you were simply being careful — a false alarm costs little.

• The sender's address ends in parcelgull.test, the parcel service's address. On its own that proves little — but the content fits too: your order and the day CraneBasket mentioned.
• The link belongs to mail-dispatch.test, not ParcelGull. Real companies often send emails through mailing services like this — so a foreign link target alone doesn't mean “trap”. But you can't tell for sure from the address.
• No payment, no data, no deadline — just a message that fits your order.

A trap. Your bank doesn't ask you to enter your login details through a link — if in doubt, open your banking app yourself.

• kestrelmoor-review.example is not the bank's address (kestrelmoorbank.example).
• The link goes to kestrelmoor-login.example — again, not kestrelmoorbank.example.
• Fear plus a deadline: a threatened block, 48 hours. Reputable banks don't ask you to enter your login details, PIN or codes through a link in an email.

A trap: a disguised web page wrapped in a reminder that's designed to scare you.

• The file ends in .html — that's a web page, not a PDF. The “.pdf” in front is camouflage. Opened, it often shows a fake sign-in window that captures your password.
• A sender with no company name whom you don't know — and you haven't ordered anything from them.
• “Final reminder” and “debt collection” are meant to scare you into opening the attachment quickly instead of thinking.

Genuine. Sender and link match the shop, and you're expecting exactly this delivery. Even safer: open your account yourself from a bookmark.

• The sender ends in cranebasket.example, which fits the shop — though that alone proves nothing, because senders can be faked.
• The link also goes to cranebasket.example. The “www.” in front changes nothing.
• You really did order the kettle, the email names your order, and nobody wants money or data from you.

A trap: extortion based on nothing but a claim. The scammers are guessing — they don't even know whether you have a camera. Don't pay and don't reply. If an email like this shows real details of yours, such as an old password, they most likely come from a data breach — change that password wherever you still use it.

• That's your own address — and that's exactly what's meant to scare you. But the sender shown on an email is easy to fake, like the return address on an envelope. Nobody needs access to your inbox to do it.
• Not a single piece of proof: no picture, nothing that only someone with access to your device could know. Emails like this go out word for word to huge numbers of addresses. Shame, threats, a deadline and Bitcoin are meant to put you under so much pressure that you don't talk to anyone about it.

A trap. The link doesn't belong to the streaming service — even though its name appears in it.

• The sender ends in flickerhaven-account.example instead of flickerhaven.example.
• It says “flickerhaven.example-account.example”: after “flickerhaven” comes a dot, then it continues with a hyphen. So the address belongs to example-account.example.
• A threatened pause, a small amount. The missing greeting is only a weak sign — what matters: you only change payment details in an account you opened yourself.

Genuine. Expected, from a known address, harmless attachments. If something were odd — a link instead of photos, a request for money — you'd give Jonah a quick call.

• You know this address — it's your brother's, and he said he'd send the photos.
• Ordinary photos (.jpg), and you were expecting them.
• A personal tone, a shared experience, no request for money or data.

A trap — even though the sender and the link are genuine. The platform is real, the document isn't: anyone can share files there under someone else's name. So also check who is sharing, and whether the route fits your bank. If in doubt, open your banking app yourself.

• The sender is right: grebefold.example is the address of the platform the document was shared through. Who shared it is in the text — and that's not your bank but a private email address at mailbox.test.
• The link is right too: grebefold.example. This is where the address rule ends — it only shows that the page is on the platform, not who put the file there. Anyone can open an account on platforms like this and share under any name.
• Banks usually put documents in the messages section of your online banking — your bank suddenly sharing through an outside platform doesn't fit. The deadline and the threatened restriction are the bait: behind the link there's usually a fake sign-in page.

A trap. A prize you have to pay for first isn't a prize.

• You never entered a prize draw. And real winners don't have to pay anything — certainly not through a link.
• ploverbury-promo.test is not ploverbury.test.
• The link belongs to ploverbury-voucher.test — yet another address.