Spot the Scam

Live: https://theguysaccount.github.io/psych-sec-social-engineering-defense/ · Screens: desktop and phone

A free two-minute test of the scams of the AI era. You see ten realistic texts, emails, phone calls, chats, letters and ads, and decide for each: scam or legit? Then you see the tells, highlighted in the message, and a short lesson. It's built for anyone, and especially for sending to parents.

• 25 scam types, each with a lesson page: how it works, red flags, a real-looking example, what to do, a mini test, and the latest FTC and CISA alerts about it.
• 70 messages in the bank, about a quarter of them legitimate, so you have to judge rather than say "scam" to everything.
• Updated weekly from public alerts. A GitHub Action pulls the FTC's consumer alerts, CISA's feeds and the FBI's IC3 announcements every Monday, tags them by scam type, and the week's test leans on the scams in the news. (The FTC blocks GitHub's servers, so FTC alerts also arrive through the content routine; see OPERATIONS.md.)
• Share loop built in. "Send this test to your parents" and "Challenge a friend" links replay the same test; a friend's link carries only the test code and the score.
• No server, no tracking. Static files on GitHub Pages. Answers stay in the browser.

Made by Psych Sec. Not affiliated with the FTC, CISA or any company named in examples (the names are invented).

How it runs (no human in the loop)

What	Where	When
Test, build, play end to end in headless Chrome, deploy, smoke-test live, IndexNow	.github/workflows/pages.yml	every push, and weekly after the refresh
Pull FTC, CISA and FBI alerts, tag, commit, redeploy	.github/workflows/refresh.yml	Mondays
Live end-to-end test, page and data health checks, keep-alive	.github/workflows/selftest.yml	Wednesdays

Details, failure modes and the keys that switch on a custom domain, analytics and a paid team version: OPERATIONS.md.

Layout

data/types.json        25 scam types: lesson text, red flags, what to do, FTC/CISA sources, alert keywords
data/items.json        the message bank (see OPERATIONS.md, "Writing items")
data/alerts.json       FTC, CISA and FBI alert archive, updated weekly by refresh.yml
data/backlog.md        scenario seeds for future items
pipeline/alerts.py     fetch, parse, tag and merge alerts; pick the week's featured scam types
pipeline/build.py      static site generator (standard library only) -> dist/
pipeline/render.py     message rendering at build time (mirrors site/assets/core.js)
site/assets/           core.js (quiz logic), app.js (UI), selftest.js (end-to-end driver), site.css, og/ cards
scripts/               e2e.sh, screens.sh, og.py, indexnow.py, check_live.py, keepalive.sh
tests/                 Python tests (content, alerts, build) and tests/js (logic, renderer parity)

Run, test, deploy

Python 3.9+ and Google Chrome. Node 18+ for the JS tests.

python3 pipeline/build.py                 # build dist/
python3 -m http.server -d dist 8000       # open http://localhost:8000
python3 -m unittest discover -s tests     # content, alerts, build
node --test tests/js/*.test.mjs           # quiz logic, Python/JS renderer parity
scripts/e2e.sh                            # play dist/ end to end in headless Chrome
scripts/screens.sh                        # refresh docs/screens/
python3 scripts/og.py                     # refresh share cards after adding a scam type

Deploy is a push to main: pages.yml tests, builds and publishes to GitHub Pages.

License

Code: MIT (see LICENSE). Lesson text and example messages: CC BY 4.0. Alert titles and summaries are from the FTC, CISA and FBI (U.S. government works) and link to the originals.