What this is about
Six conversations arrive on your phone — texts and messenger chats. Some are genuine, some are traps. Decide each time: genuine or trap?
What you practise
Recognise tricks on your phone and check back through a channel you already know.
Your situation in this exercise
You're the mother of Emma, who lives in the next town and whose number is saved in your phone. You bank with Kestrelmoor Bank and have a contract with Tidewren Mobile. You're not expecting a parcel.
On a real phone: don't tap links, and don't press and hold them either. A press that's too short is a tap, and some phones already show a preview of the page. If in doubt, open the app or type the known address yourself. To see where a link leads without opening it, use a computer: point at it with the mouse, don't click. In text messages, the address is usually shown as text anyway — reading it is enough.
iPhone: if a preview does appear, don't tap it — tapping anywhere outside it closes it.
The interactive exercise needs JavaScript. Without it, you can read through all messages with their explanations here.
+44 7700 ••• 719 · Text message
← ParcelGull: Your parcel is at our depot. Please confirm your delivery address or it will be returned: parcelgull-track.test/p/8KX2
Well spotted: this is a trap.
A trap. The link wants you to enter details or install an app that spies on your phone.
- An ordinary mobile number, no company name — that's not how parcel services text.
- The link goes to parcelgull-track.test, not parcelgull.test.
- You're not expecting a parcel from ParcelGull, and “or it will be returned” adds pressure. Texts like this go to thousands — someone is always expecting a parcel.
+44 7700 ••• 382 · Messenger
← Hi Mum, my phone broke, this is my new number. Can you delete the old one and save this one? 😊
→ Oh no! What happened?
← Dropped it in the water 🙈 I have to pay two bills today and can't get into my banking on the new phone yet. Could you transfer them for me? I'll pay you back tomorrow.
← Please be quick, otherwise there'll be late fees. I'll send you the account details.
Well spotted: this is a trap.
A trap — the “Hi Mum” scam. Never transfer money before you've spoken to the person on the number you know.
- An unknown number claiming to be your child. No name is mentioned — “Mum” fits every mother. Some scammers do know names from social media, though, so a name alone proves nothing either.
- The pattern is almost always the same: new number, please delete the old one, then an urgent transfer to a stranger's account.
- Call your child on the OLD number. It usually still works — and the spell is broken.
Kestrelmoor · Text message
← Kestrelmoor Bank: Your security app must be reconnected today. Confirm now or your access will be blocked: kestrelmoor-approve.example/new
Well spotted: this is a trap.
A trap. The fake page wants your login details — and to get you to approve a payment in your real banking app.
- The sender name “Kestrelmoor” proves nothing: text sender names can be faked. A fake message can even land in the same thread as genuine bank texts.
- The link goes to kestrelmoor-approve.example, not kestrelmoorbank.example.
- Reputable banks don't send links to set up a security app again, and they don't threaten to block you by text.
Tidewren · Text message
← Tidewren Mobile: Your September bill of £12.99 is ready. You'll find it in the Tidewren app or at tidewren.test/bill
Correct: this message is genuine.
Genuine. Pure information, and the link fits your provider. Not every text with a link is a trap — if you want to check, it's still best to open the app yourself.
- No deadline, no request to pay or type anything in — just a message that fits your contract.
- The link goes to tidewren.test, your provider's address. You don't need it, though: the bill is in the app, too.
- The sender name could be faked. Here that isn't decisive, because the message wants nothing from you.
Emma · Messenger
← Hi Mum, we'll come on Sunday around 3. Shall I bring a cake? 🍰
→ Lovely! I'll make coffee.
← Great, see you Sunday ❤️
Correct: this message is genuine.
Genuine. An ordinary family chat. Not every message is suspicious — be alert when money, data or hurry come in.
- The number is saved as “Emma” — it's your usual chat with your daughter.
- No request for money, no rush, nothing unusual.
+44 7700 ••• 042 · Text message
← You have 1 new voicemail. Listen: voicemail-listen.test/v/3928
Well spotted: this is a trap.
A trap. Don't tap it; block the number and delete the message.
- A stranger's mobile number. Your real voicemail comes from your mobile network, not from strangers.
- You listen to voicemail through the voicemail number or your phone app — not through a link to voicemail-listen.test.
- Curiosity is the bait: behind the link you are often asked to install a “voicemail app” — actually malware.
All companies, people, addresses and numbers in the exercises are invented. Any resemblance to real companies or people would be purely coincidental and unintended.