eval/hard_v4_eval.jsonl

{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0800", "input": "USPS notice: delivery failed. Update delivery login before tomorrow morning: http://usps-held-package-update-delivery-login-800.example Ref 1800."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0801", "input": "Bank of America alert: Card suspended. To cancel it, confirm your PIN. Ref 1801."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0802", "input": "Grandpa, it's me. I got in trouble and need help. Wire emergency funds now and don't call anyone. Ref 1802."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0803", "input": "Security alert: your security warning. Please pay the cleanup fee immediately. Ref 1803."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0804", "input": "Congratulations, unclaimed prize. Pay a processing fee before 2 PM. Ref 1804."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0805", "input": "You are hired. Deposit a check and send back money before 6 PM so we can activate your role. Ref 1805."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0806", "input": "bank or service provider: Your appointment is confirmed for tomorrow morning. Reply C to confirm or R to reschedule. Ref 1806."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0807", "input": "Your dentist appointment is confirmed for Friday. Call the office number on your calendar if you need to reschedule. Note 1807."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0808", "input": "DHL: Held package. Your item will be returned unless you confirm address and payment: https://dhl-held-package-confirm-address-and-payment-808.example Ref 1808."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0809", "input": "Security notice from card security: Card suspended. Confirm your PIN now to restore access. Ref 1809."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0810", "input": "Please keep this quiet. I need you to wire emergency funds before 2 PM. I will explain later. Ref 1810."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0811", "input": "antivirus support case opened: Security warning. Technician requires you to pay the cleanup fee. Ref 1811."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0812", "input": "lottery office notice: Unclaimed prize. Release requires you to pay a processing fee. Ref 1812."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0813", "input": "hiring manager here. Your training starts today; please deposit a check and send back money now. Ref 1813."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0814", "input": "bank or service provider: We noticed a sign-in. If this was not you, open the official app to review. Ref 1814."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0815", "input": "Can you bring milk when you come over tonight? Note 1815."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0816", "input": "FedEx: Your package is held package. Verify account details now: https://fedex-held-package-verify-account-details-816.example Ref 1816."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0817", "input": "credit union: your card suspended. Please confirm your PIN immediately. Ref 1817."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0818", "input": "Hi Auntie, I lost my phone. This is my new number. Can you wire emergency funds for a hospital bill? Please don't tell anyone. Ref 1818."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0819", "input": "antivirus support: Security warning. Pay the cleanup fee now to avoid permanent damage. Ref 1819."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0820", "input": "lottery office: Unclaimed prize. To receive it, pay a processing fee: https://lottery-office-unclaimed-prize-pay-a-processing-fee-820.example Ref 1820."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0821", "input": "hiring manager: Training starts today. To continue, deposit a check and send back money: https://hiring-manager-training-starts-today-deposit-a-check-and-send-back-money-821.example Ref 1821."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0822", "input": "bank or service provider fraud alert: Did you attempt a $940.00 purchase at Shell? Reply YES or NO. Ref 1822."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0823", "input": "The library book you requested is ready for pickup at the front desk. Note 1823."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0824", "input": "Postal Service notice: delivery failed. Update delivery login before tomorrow morning: http://postal-service-held-package-update-delivery-login-824.example Ref 1824."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0825", "input": "Chase alert: Card suspended. To cancel it, confirm your PIN. Ref 1825."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0826", "input": "Mom, it's me. I got in trouble and need help. Wire emergency funds now and don't call anyone. Ref 1826."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0827", "input": "Security alert: your security warning. Please pay the cleanup fee immediately. Ref 1827."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0828", "input": "Congratulations, unclaimed prize. Pay a processing fee before 2 PM. Ref 1828."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0829", "input": "You are hired. Deposit a check and send back money before 6 PM so we can activate your role. Ref 1829."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0830", "input": "bank or service provider: Your appointment is confirmed for tomorrow morning. Reply C to confirm or R to reschedule. Ref 1830."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0831", "input": "Dinner moved to Friday. No need to bring anything. Note 1831."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0832", "input": "UPS: Held package. Your item will be returned unless you confirm address and payment: https://ups-held-package-confirm-address-and-payment-832.example Ref 1832."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0833", "input": "Security notice from fraud department: Card suspended. Confirm your PIN now to restore access. Ref 1833."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0834", "input": "Please keep this quiet. I need you to wire emergency funds before 2 PM. I will explain later. Ref 1834."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0835", "input": "antivirus support case opened: Security warning. Technician requires you to pay the cleanup fee. Ref 1835."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0836", "input": "lottery office notice: Unclaimed prize. Release requires you to pay a processing fee. Ref 1836."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0837", "input": "hiring manager here. Your training starts today; please deposit a check and send back money now. Ref 1837."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0838", "input": "bank or service provider: We noticed a sign-in. If this was not you, open the official app to review. Ref 1838."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0839", "input": "Your dentist appointment is confirmed for noon. Call the office number on your calendar if you need to reschedule. Note 1839."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0840", "input": "USPS: Your package is held package. Verify account details now: https://usps-held-package-verify-account-details-840.example Ref 1840."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0841", "input": "Bank of America: your card suspended. Please confirm your PIN immediately. Ref 1841."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0842", "input": "Hi Grandpa, I lost my phone. This is my new number. Can you wire emergency funds for bail? Please don't tell anyone. Ref 1842."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0843", "input": "antivirus support: Security warning. Pay the cleanup fee now to avoid permanent damage. Ref 1843."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0844", "input": "lottery office: Unclaimed prize. To receive it, pay a processing fee: https://lottery-office-unclaimed-prize-pay-a-processing-fee-844.example Ref 1844."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0845", "input": "hiring manager: Training starts today. To continue, deposit a check and send back money: https://hiring-manager-training-starts-today-deposit-a-check-and-send-back-money-845.example Ref 1845."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0846", "input": "bank or service provider fraud alert: Did you attempt a $82.19 purchase at Walmart? Reply YES or NO. Ref 1846."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0847", "input": "Can you bring milk when you come over tonight? Note 1847."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0848", "input": "DHL notice: delivery failed. Update delivery login before tomorrow morning: http://dhl-held-package-update-delivery-login-848.example Ref 1848."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0849", "input": "card security alert: Card suspended. To cancel it, confirm your PIN. Ref 1849."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0850", "input": "Grandma, it's me. I got in trouble and need help. Wire emergency funds now and don't call anyone. Ref 1850."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0851", "input": "Security alert: your security warning. Please pay the cleanup fee immediately. Ref 1851."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0852", "input": "Congratulations, unclaimed prize. Pay a processing fee before 2 PM. Ref 1852."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0853", "input": "You are hired. Deposit a check and send back money before 6 PM so we can activate your role. Ref 1853."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0854", "input": "bank or service provider: Your appointment is confirmed for tomorrow morning. Reply C to confirm or R to reschedule. Ref 1854."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0855", "input": "The library book you requested is ready for pickup at the front desk. Note 1855."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0856", "input": "FedEx: Held package. Your item will be returned unless you confirm address and payment: https://fedex-held-package-confirm-address-and-payment-856.example Ref 1856."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0857", "input": "Security notice from credit union: Card suspended. Confirm your PIN now to restore access. Ref 1857."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0858", "input": "Please keep this quiet. I need you to wire emergency funds before 2 PM. I will explain later. Ref 1858."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0859", "input": "antivirus support case opened: Security warning. Technician requires you to pay the cleanup fee. Ref 1859."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0860", "input": "lottery office notice: Unclaimed prize. Release requires you to pay a processing fee. Ref 1860."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0861", "input": "hiring manager here. Your training starts today; please deposit a check and send back money now. Ref 1861."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0862", "input": "bank or service provider: We noticed a sign-in. If this was not you, open the official app to review. Ref 1862."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0863", "input": "Dinner moved to noon. No need to bring anything. Note 1863."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0864", "input": "Postal Service: Your package is held package. Verify account details now: https://postal-service-held-package-verify-account-details-864.example Ref 1864."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0865", "input": "Chase: your card suspended. Please confirm your PIN immediately. Ref 1865."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0866", "input": "Hi Mom, I lost my phone. This is my new number. Can you wire emergency funds for car repairs? Please don't tell anyone. Ref 1866."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0867", "input": "antivirus support: Security warning. Pay the cleanup fee now to avoid permanent damage. Ref 1867."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0868", "input": "lottery office: Unclaimed prize. To receive it, pay a processing fee: https://lottery-office-unclaimed-prize-pay-a-processing-fee-868.example Ref 1868."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0869", "input": "hiring manager: Training starts today. To continue, deposit a check and send back money: https://hiring-manager-training-starts-today-deposit-a-check-and-send-back-money-869.example Ref 1869."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0870", "input": "bank or service provider fraud alert: Did you attempt a $249.00 purchase at TARGET? Reply YES or NO. Ref 1870."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0871", "input": "Your dentist appointment is confirmed for 6 PM. Call the office number on your calendar if you need to reschedule. Note 1871."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0872", "input": "UPS notice: delivery failed. Update delivery login before tomorrow morning: http://ups-held-package-update-delivery-login-872.example Ref 1872."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0873", "input": "fraud department alert: Card suspended. To cancel it, confirm your PIN. Ref 1873."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0874", "input": "Dad, it's me. I got in trouble and need help. Wire emergency funds now and don't call anyone. Ref 1874."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0875", "input": "Security alert: your security warning. Please pay the cleanup fee immediately. Ref 1875."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0876", "input": "Congratulations, unclaimed prize. Pay a processing fee before 2 PM. Ref 1876."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0877", "input": "You are hired. Deposit a check and send back money before 6 PM so we can activate your role. Ref 1877."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0878", "input": "bank or service provider: Your appointment is confirmed for tomorrow morning. Reply C to confirm or R to reschedule. Ref 1878."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0879", "input": "Can you bring milk when you come over tonight? Note 1879."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0880", "input": "USPS: Held package. Your item will be returned unless you confirm address and payment: https://usps-held-package-confirm-address-and-payment-880.example Ref 1880."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0881", "input": "Security notice from Bank of America: Card suspended. Confirm your PIN now to restore access. Ref 1881."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0882", "input": "Please keep this quiet. I need you to wire emergency funds before 2 PM. I will explain later. Ref 1882."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0883", "input": "antivirus support case opened: Security warning. Technician requires you to pay the cleanup fee. Ref 1883."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0884", "input": "lottery office notice: Unclaimed prize. Release requires you to pay a processing fee. Ref 1884."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0885", "input": "hiring manager here. Your training starts today; please deposit a check and send back money now. Ref 1885."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0886", "input": "bank or service provider: We noticed a sign-in. If this was not you, open the official app to review. Ref 1886."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0887", "input": "The library book you requested is ready for pickup at the front desk. Note 1887."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0888", "input": "DHL: Your package is held package. Verify account details now: https://dhl-held-package-verify-account-details-888.example Ref 1888."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0889", "input": "card security: your card suspended. Please confirm your PIN immediately. Ref 1889."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0890", "input": "Hi Grandma, I lost my phone. This is my new number. Can you wire emergency funds for rent today? Please don't tell anyone. Ref 1890."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0891", "input": "antivirus support: Security warning. Pay the cleanup fee now to avoid permanent damage. Ref 1891."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0892", "input": "lottery office: Unclaimed prize. To receive it, pay a processing fee: https://lottery-office-unclaimed-prize-pay-a-processing-fee-892.example Ref 1892."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0893", "input": "hiring manager: Training starts today. To continue, deposit a check and send back money: https://hiring-manager-training-starts-today-deposit-a-check-and-send-back-money-893.example Ref 1893."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0894", "input": "bank or service provider fraud alert: Did you attempt a $17.45 purchase at Costco? Reply YES or NO. Ref 1894."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0895", "input": "Dinner moved to 6 PM. No need to bring anything. Note 1895."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0896", "input": "FedEx notice: delivery failed. Update delivery login before tomorrow morning: http://fedex-held-package-update-delivery-login-896.example Ref 1896."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0897", "input": "credit union alert: Card suspended. To cancel it, confirm your PIN. Ref 1897."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0898", "input": "Auntie, it's me. I got in trouble and need help. Wire emergency funds now and don't call anyone. Ref 1898."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0899", "input": "Security alert: your security warning. Please pay the cleanup fee immediately. Ref 1899."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0900", "input": "Congratulations, unclaimed prize. Pay a processing fee before 2 PM. Ref 1900."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0901", "input": "You are hired. Deposit a check and send back money before 6 PM so we can activate your role. Ref 1901."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0902", "input": "bank or service provider: Your appointment is confirmed for tomorrow morning. Reply C to confirm or R to reschedule. Ref 1902."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0903", "input": "Your dentist appointment is confirmed for Friday. Call the office number on your calendar if you need to reschedule. Note 1903."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0904", "input": "Postal Service: Held package. Your item will be returned unless you confirm address and payment: https://postal-service-held-package-confirm-address-and-payment-904.example Ref 1904."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0905", "input": "Security notice from Chase: Card suspended. Confirm your PIN now to restore access. Ref 1905."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0906", "input": "Please keep this quiet. I need you to wire emergency funds before 2 PM. I will explain later. Ref 1906."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0907", "input": "antivirus support case opened: Security warning. Technician requires you to pay the cleanup fee. Ref 1907."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0908", "input": "lottery office notice: Unclaimed prize. Release requires you to pay a processing fee. Ref 1908."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0909", "input": "hiring manager here. Your training starts today; please deposit a check and send back money now. Ref 1909."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0910", "input": "bank or service provider: We noticed a sign-in. If this was not you, open the official app to review. Ref 1910."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0911", "input": "Can you bring milk when you come over tonight? Note 1911."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0912", "input": "UPS: Your package is held package. Verify account details now: https://ups-held-package-verify-account-details-912.example Ref 1912."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0913", "input": "fraud department: your card suspended. Please confirm your PIN immediately. Ref 1913."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0914", "input": "Hi Dad, I lost my phone. This is my new number. Can you wire emergency funds for a school payment? Please don't tell anyone. Ref 1914."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0915", "input": "antivirus support: Security warning. Pay the cleanup fee now to avoid permanent damage. Ref 1915."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0916", "input": "lottery office: Unclaimed prize. To receive it, pay a processing fee: https://lottery-office-unclaimed-prize-pay-a-processing-fee-916.example Ref 1916."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0917", "input": "hiring manager: Training starts today. To continue, deposit a check and send back money: https://hiring-manager-training-starts-today-deposit-a-check-and-send-back-money-917.example Ref 1917."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0918", "input": "bank or service provider fraud alert: Did you attempt a $1,200.00 purchase at Amazon? Reply YES or NO. Ref 1918."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0919", "input": "The library book you requested is ready for pickup at the front desk. Note 1919."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0920", "input": "USPS notice: delivery failed. Update delivery login before tomorrow morning: http://usps-held-package-update-delivery-login-920.example Ref 1920."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0921", "input": "Bank of America alert: Card suspended. To cancel it, confirm your PIN. Ref 1921."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0922", "input": "Grandpa, it's me. I got in trouble and need help. Wire emergency funds now and don't call anyone. Ref 1922."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0923", "input": "Security alert: your security warning. Please pay the cleanup fee immediately. Ref 1923."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0924", "input": "Congratulations, unclaimed prize. Pay a processing fee before 2 PM. Ref 1924."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0925", "input": "You are hired. Deposit a check and send back money before 6 PM so we can activate your role. Ref 1925."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0926", "input": "bank or service provider: Your appointment is confirmed for tomorrow morning. Reply C to confirm or R to reschedule. Ref 1926."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0927", "input": "Dinner moved to Friday. No need to bring anything. Note 1927."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0928", "input": "DHL: Held package. Your item will be returned unless you confirm address and payment: https://dhl-held-package-confirm-address-and-payment-928.example Ref 1928."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0929", "input": "Security notice from card security: Card suspended. Confirm your PIN now to restore access. Ref 1929."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0930", "input": "Please keep this quiet. I need you to wire emergency funds before 2 PM. I will explain later. Ref 1930."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0931", "input": "antivirus support case opened: Security warning. Technician requires you to pay the cleanup fee. Ref 1931."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0932", "input": "lottery office notice: Unclaimed prize. Release requires you to pay a processing fee. Ref 1932."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0933", "input": "hiring manager here. Your training starts today; please deposit a check and send back money now. Ref 1933."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0934", "input": "bank or service provider: We noticed a sign-in. If this was not you, open the official app to review. Ref 1934."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0935", "input": "Your dentist appointment is confirmed for noon. Call the office number on your calendar if you need to reschedule. Note 1935."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0936", "input": "FedEx: Your package is held package. Verify account details now: https://fedex-held-package-verify-account-details-936.example Ref 1936."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0937", "input": "credit union: your card suspended. Please confirm your PIN immediately. Ref 1937."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0938", "input": "Hi Auntie, I lost my phone. This is my new number. Can you wire emergency funds for a hospital bill? Please don't tell anyone. Ref 1938."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0939", "input": "antivirus support: Security warning. Pay the cleanup fee now to avoid permanent damage. Ref 1939."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0940", "input": "lottery office: Unclaimed prize. To receive it, pay a processing fee: https://lottery-office-unclaimed-prize-pay-a-processing-fee-940.example Ref 1940."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0941", "input": "hiring manager: Training starts today. To continue, deposit a check and send back money: https://hiring-manager-training-starts-today-deposit-a-check-and-send-back-money-941.example Ref 1941."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0942", "input": "bank or service provider fraud alert: Did you attempt a $940.00 purchase at Shell? Reply YES or NO. Ref 1942."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0943", "input": "Can you bring milk when you come over tonight? Note 1943."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0944", "input": "Postal Service notice: delivery failed. Update delivery login before tomorrow morning: http://postal-service-held-package-update-delivery-login-944.example Ref 1944."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0945", "input": "Chase alert: Card suspended. To cancel it, confirm your PIN. Ref 1945."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0946", "input": "Mom, it's me. I got in trouble and need help. Wire emergency funds now and don't call anyone. Ref 1946."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0947", "input": "Security alert: your security warning. Please pay the cleanup fee immediately. Ref 1947."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0948", "input": "Congratulations, unclaimed prize. Pay a processing fee before 2 PM. Ref 1948."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0949", "input": "You are hired. Deposit a check and send back money before 6 PM so we can activate your role. Ref 1949."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0950", "input": "bank or service provider: Your appointment is confirmed for tomorrow morning. Reply C to confirm or R to reschedule. Ref 1950."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0951", "input": "The library book you requested is ready for pickup at the front desk. Note 1951."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0952", "input": "UPS: Held package. Your item will be returned unless you confirm address and payment: https://ups-held-package-confirm-address-and-payment-952.example Ref 1952."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0953", "input": "Security notice from fraud department: Card suspended. Confirm your PIN now to restore access. Ref 1953."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0954", "input": "Please keep this quiet. I need you to wire emergency funds before 2 PM. I will explain later. Ref 1954."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0955", "input": "antivirus support case opened: Security warning. Technician requires you to pay the cleanup fee. Ref 1955."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0956", "input": "lottery office notice: Unclaimed prize. Release requires you to pay a processing fee. Ref 1956."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0957", "input": "hiring manager here. Your training starts today; please deposit a check and send back money now. Ref 1957."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0958", "input": "bank or service provider: We noticed a sign-in. If this was not you, open the official app to review. Ref 1958."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0959", "input": "Dinner moved to noon. No need to bring anything. Note 1959."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0960", "input": "USPS: Your package is held package. Verify account details now: https://usps-held-package-verify-account-details-960.example Ref 1960."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0961", "input": "Bank of America: your card suspended. Please confirm your PIN immediately. Ref 1961."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0962", "input": "Hi Grandpa, I lost my phone. This is my new number. Can you wire emergency funds for bail? Please don't tell anyone. Ref 1962."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0963", "input": "antivirus support: Security warning. Pay the cleanup fee now to avoid permanent damage. Ref 1963."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0964", "input": "lottery office: Unclaimed prize. To receive it, pay a processing fee: https://lottery-office-unclaimed-prize-pay-a-processing-fee-964.example Ref 1964."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0965", "input": "hiring manager: Training starts today. To continue, deposit a check and send back money: https://hiring-manager-training-starts-today-deposit-a-check-and-send-back-money-965.example Ref 1965."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0966", "input": "bank or service provider fraud alert: Did you attempt a $82.19 purchase at Walmart? Reply YES or NO. Ref 1966."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0967", "input": "Your dentist appointment is confirmed for 6 PM. Call the office number on your calendar if you need to reschedule. Note 1967."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0968", "input": "DHL notice: delivery failed. Update delivery login before tomorrow morning: http://dhl-held-package-update-delivery-login-968.example Ref 1968."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0969", "input": "card security alert: Card suspended. To cancel it, confirm your PIN. Ref 1969."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0970", "input": "Grandma, it's me. I got in trouble and need help. Wire emergency funds now and don't call anyone. Ref 1970."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0971", "input": "Security alert: your security warning. Please pay the cleanup fee immediately. Ref 1971."}
{"category": "prize_lottery", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "suspicious link"], "id": "prize_lottery_0972", "input": "Congratulations, unclaimed prize. Pay a processing fee before 2 PM. Ref 1972."}
{"category": "job_scam", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "suspicious link"], "id": "job_scam_0973", "input": "You are hired. Deposit a check and send back money before 6 PM so we can activate your role. Ref 1973."}
{"category": "legitimate_needs_check", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed"], "id": "legitimate_needs_check_0974", "input": "bank or service provider: Your appointment is confirmed for tomorrow morning. Reply C to confirm or R to reschedule. Ref 1974."}
{"category": "safe_benign", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "safe_benign_0975", "input": "Can you bring milk when you come over tonight? Note 1975."}
{"category": "package_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "suspicious link", "credential request"], "id": "package_phishing_0976", "input": "FedEx: Held package. Your item will be returned unless you confirm address and payment: https://fedex-held-package-confirm-address-and-payment-976.example Ref 1976."}
{"category": "bank_phishing", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "urgency", "credential request"], "id": "bank_phishing_0977", "input": "Security notice from credit union: Card suspended. Confirm your PIN now to restore access. Ref 1977."}
{"category": "family_impersonation", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "secrecy", "payment pressure"], "id": "family_impersonation_0978", "input": "Please keep this quiet. I need you to wire emergency funds before 2 PM. I will explain later. Ref 1978."}
{"category": "tech_support", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "urgency", "remote access request"], "id": "tech_support_0979", "input": "antivirus support case opened: Security warning. Technician requires you to pay the cleanup fee. Ref 1979."}
{"category": "family_impersonation_hard", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "new channel", "payment pressure"], "id": "family_impersonation_hard_00_00", "input": "Grandpa, my phone broke. Text me on this number only. I need help paying a bill before midnight."}
{"category": "family_impersonation_hard", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "new channel", "payment pressure"], "id": "family_impersonation_hard_00_01", "input": "This is your son using a friend's phone. I am stranded. Can you send crypto to this wallet right away?"}
{"category": "family_impersonation_hard", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "new channel", "payment pressure"], "id": "family_impersonation_hard_00_02", "input": "Mom it's me from a temporary phone. I need help with rent today and cannot talk."}
{"category": "family_impersonation_hard", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "urgency", "new channel", "payment pressure"], "id": "family_impersonation_hard_00_03", "input": "Grandma, please use this new number. My account is locked and I need you to send money now."}
{"category": "secrecy_payment_hard", "expected_risk_level": "dangerous", "expected_scam_type": "payment_request", "expected_tactics": ["secrecy", "payment pressure", "emotional manipulation"], "id": "secrecy_payment_hard_00_00", "input": "Auntie please don't tell Dad. I need gift cards for an emergency and I'll pay you back tomorrow."}
{"category": "secrecy_payment_hard", "expected_risk_level": "dangerous", "expected_scam_type": "payment_request", "expected_tactics": ["secrecy", "payment pressure", "emotional manipulation"], "id": "secrecy_payment_hard_00_01", "input": "Do not tell your family about us yet. I need help with a hospital bill before we can meet."}
{"category": "secrecy_payment_hard", "expected_risk_level": "dangerous", "expected_scam_type": "payment_request", "expected_tactics": ["secrecy", "payment pressure", "emotional manipulation"], "id": "secrecy_payment_hard_00_02", "input": "Please keep this quiet. I need Apple gift cards today and I will explain later."}
{"category": "secrecy_payment_hard", "expected_risk_level": "dangerous", "expected_scam_type": "payment_request", "expected_tactics": ["secrecy", "payment pressure", "emotional manipulation"], "id": "secrecy_payment_hard_00_03", "input": "Nobody else can know yet. Wire the hospital payment and I will repay you tomorrow."}
{"category": "marketplace_hard", "expected_risk_level": "suspicious", "expected_scam_type": "marketplace_scam", "expected_tactics": ["marketplace", "payment pressure", "third party"], "id": "marketplace_hard_00_00", "input": "I want to buy your item. I will send extra money and my mover will pick it up."}
{"category": "marketplace_hard", "expected_risk_level": "suspicious", "expected_scam_type": "marketplace_scam", "expected_tactics": ["marketplace", "payment pressure", "third party"], "id": "marketplace_hard_00_01", "input": "I only use this escrow service for marketplace purchases: https://safe-escrow-pay.example"}
{"category": "marketplace_hard", "expected_risk_level": "suspicious", "expected_scam_type": "marketplace_scam", "expected_tactics": ["marketplace", "payment pressure", "third party"], "id": "marketplace_hard_00_02", "input": "The courier needs a small insurance payment before pickup. I will reimburse you."}
{"category": "marketplace_hard", "expected_risk_level": "suspicious", "expected_scam_type": "marketplace_scam", "expected_tactics": ["marketplace", "payment pressure", "third party"], "id": "marketplace_hard_00_03", "input": "I am out of town but my assistant will handle payment. Please email your bank name."}
{"category": "marketplace_hard", "expected_risk_level": "suspicious", "expected_scam_type": "marketplace_scam", "expected_tactics": ["marketplace", "payment pressure", "third party"], "id": "marketplace_hard_00_04", "input": "Can you verify you are real by sending me the code I just texted you?"}
{"category": "suspicious_link_hard", "expected_risk_level": "suspicious", "expected_scam_type": "unknown_link", "expected_tactics": ["suspicious link", "vague request"], "id": "suspicious_link_hard_00_00", "input": "Your account needs attention. Visit http://account-message-center.example when you have time."}
{"category": "suspicious_link_hard", "expected_risk_level": "suspicious", "expected_scam_type": "unknown_link", "expected_tactics": ["suspicious link", "vague request"], "id": "suspicious_link_hard_00_01", "input": "We could not process your request. Open https://customer-resolution.example for details."}
{"category": "suspicious_link_hard", "expected_risk_level": "suspicious", "expected_scam_type": "unknown_link", "expected_tactics": ["suspicious link", "vague request"], "id": "suspicious_link_hard_00_02", "input": "Your profile is incomplete. Confirm your information here: http://profile-update-center.example"}
{"category": "suspicious_link_hard", "expected_risk_level": "suspicious", "expected_scam_type": "unknown_link", "expected_tactics": ["suspicious link", "vague request"], "id": "suspicious_link_hard_00_03", "input": "Please review the secure document I shared: https://document-viewer-secure.example"}
{"category": "suspicious_link_hard", "expected_risk_level": "suspicious", "expected_scam_type": "unknown_link", "expected_tactics": ["suspicious link", "vague request"], "id": "suspicious_link_hard_00_04", "input": "Your voicemail is available at http://voice-message-download.example"}
{"category": "suspicious_urgency_hard", "expected_risk_level": "suspicious", "expected_scam_type": "unknown_urgent_request", "expected_tactics": ["urgency", "vague request"], "id": "suspicious_urgency_hard_00_00", "input": "Please call me back immediately about your account. This cannot wait."}
{"category": "suspicious_urgency_hard", "expected_risk_level": "suspicious", "expected_scam_type": "unknown_urgent_request", "expected_tactics": ["urgency", "vague request"], "id": "suspicious_urgency_hard_00_01", "input": "Your subscription has a problem. We need confirmation today or it may be closed."}
{"category": "suspicious_urgency_hard", "expected_risk_level": "suspicious", "expected_scam_type": "unknown_urgent_request", "expected_tactics": ["urgency", "vague request"], "id": "suspicious_urgency_hard_00_02", "input": "Final reminder: your paperwork is missing. Send your details by end of day."}
{"category": "suspicious_urgency_hard", "expected_risk_level": "suspicious", "expected_scam_type": "unknown_urgent_request", "expected_tactics": ["urgency", "vague request"], "id": "suspicious_urgency_hard_00_03", "input": "Action required: confirm ownership of your account within 24 hours."}
{"category": "suspicious_urgency_hard", "expected_risk_level": "suspicious", "expected_scam_type": "unknown_urgent_request", "expected_tactics": ["urgency", "vague request"], "id": "suspicious_urgency_hard_00_04", "input": "We noticed an issue with your delivery. Respond quickly so we can resolve it."}
{"category": "legitimate_notice_hard", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "legitimate_notice_hard_00_00", "input": "UPS update: your package is out for delivery today. Track it in the UPS app."}
{"category": "legitimate_notice_hard", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "legitimate_notice_hard_00_01", "input": "FedEx delivery exception: weather delay reported. Check status on the official FedEx site."}
{"category": "legitimate_notice_hard", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "legitimate_notice_hard_00_02", "input": "Your pharmacy order shipped. Open your pharmacy account if you need details."}
{"category": "legitimate_notice_hard", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "legitimate_notice_hard_00_03", "input": "Your password was changed. If this was not you, open the app directly and review account security."}
{"category": "legitimate_notice_hard", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "legitimate_notice_hard_00_04", "input": "Your verification code is 482910. Do not share this code with anyone."}
{"category": "bank_credential_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "credential request", "urgency"], "id": "bank_credential_boundary_00_00", "input": "Card Security: your debit card is suspended. Confirm your PIN now to restore access."}
{"category": "bank_credential_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "credential request", "urgency"], "id": "bank_credential_boundary_00_01", "input": "Chase verification: unusual transfer detected. Reply with your one-time code to stop it."}
{"category": "bank_credential_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "credential request", "urgency"], "id": "bank_credential_boundary_00_02", "input": "Credit union alert: your card will close today unless you send your full card number."}
{"category": "bank_credential_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "credential request", "urgency"], "id": "bank_credential_boundary_00_03", "input": "Bank of America security: profile expires today. Send password to keep account active."}
{"category": "bank_credential_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "credential request", "urgency"], "id": "bank_credential_boundary_00_04", "input": "Fraud desk: we received a request to change your account phone number. Call the number in this text now."}
{"category": "bank_credential_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "credential request", "urgency"], "id": "bank_credential_boundary_00_05", "input": "Coinbase security: phone number update requested. If this was not you, call support at the number below."}
{"category": "bank_credential_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "credential request", "urgency"], "id": "bank_credential_boundary_00_06", "input": "Zelle support: transfer pending. Reply with the verification code so we can cancel it."}
{"category": "bank_credential_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "credential request", "urgency"], "id": "bank_credential_boundary_00_07", "input": "Card services: suspicious login found. Confirm your billing information in this message."}
{"category": "package_fee_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "payment request", "suspicious link", "urgency"], "id": "package_fee_boundary_00_00", "input": "Postal notice: your package is held for an unpaid customs fee. Pay now at http://postal-release.example"}
{"category": "package_fee_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "payment request", "suspicious link", "urgency"], "id": "package_fee_boundary_00_01", "input": "DHL: final delivery attempt failed. Enter address and card details to reschedule."}
{"category": "package_fee_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "payment request", "suspicious link", "urgency"], "id": "package_fee_boundary_00_02", "input": "USPS: incomplete address. Verify your identity and pay $1.99 to release the parcel."}
{"category": "package_fee_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "payment request", "suspicious link", "urgency"], "id": "package_fee_boundary_00_03", "input": "UPS support: package will return to sender unless you confirm billing info today."}
{"category": "package_fee_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "payment request", "suspicious link", "urgency"], "id": "package_fee_boundary_00_04", "input": "FedEx: delivery tax unpaid. Use this secure link to avoid storage charges."}
{"category": "package_fee_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "payment request", "suspicious link", "urgency"], "id": "package_fee_boundary_00_05", "input": "Package Center: your item is waiting. Enter birth date and payment card to continue."}
{"category": "package_fee_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "payment request", "suspicious link", "urgency"], "id": "package_fee_boundary_00_06", "input": "USPS track: unpaid postage fee. Verify now using the link in this text."}
{"category": "package_fee_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "payment request", "suspicious link", "urgency"], "id": "package_fee_boundary_00_07", "input": "Courier desk: insurance payment required before driver pickup. We will refund it later."}
{"category": "tech_support_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "remote access request", "payment request", "urgency"], "id": "tech_support_boundary_00_00", "input": "Microsoft case opened: malware found. Call this technician now and share the screen code."}
{"category": "tech_support_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "remote access request", "payment request", "urgency"], "id": "tech_support_boundary_00_01", "input": "Apple support: your iCloud is locked. Reply with the six digit code to verify ownership."}
{"category": "tech_support_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "remote access request", "payment request", "urgency"], "id": "tech_support_boundary_00_02", "input": "Security alert: antivirus cleanup fee is overdue. Pay now to prevent shutdown."}
{"category": "tech_support_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "remote access request", "payment request", "urgency"], "id": "tech_support_boundary_00_03", "input": "Windows Defender: your computer is compromised. Install this support tool immediately."}
{"category": "tech_support_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "remote access request", "payment request", "urgency"], "id": "tech_support_boundary_00_04", "input": "Geek support: refund pending. Open the remote support link so we can return your money."}
{"category": "tech_support_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "remote access request", "payment request", "urgency"], "id": "tech_support_boundary_00_05", "input": "Device protection team: subscription expired. Call the number in this alert to avoid data loss."}
{"category": "tech_support_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "remote access request", "payment request", "urgency"], "id": "tech_support_boundary_00_06", "input": "Support desk: we detected a virus. Technician requires gift cards to unlock protection."}
{"category": "tech_support_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "remote access request", "payment request", "urgency"], "id": "tech_support_boundary_00_07", "input": "Account security: share the login code so we can remove the attacker."}
{"category": "prize_fee_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "credential request"], "id": "prize_fee_boundary_00_00", "input": "Grant office: your $8,500 grant is approved. Pay the processing fee to release funds."}
{"category": "prize_fee_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "credential request"], "id": "prize_fee_boundary_00_01", "input": "Reward Center: unclaimed prize expires tonight. Send your bank login for direct deposit."}
{"category": "prize_fee_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "credential request"], "id": "prize_fee_boundary_00_02", "input": "Sweepstakes team: winner selected. Buy an activation card before 6 PM to claim."}
{"category": "prize_fee_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "credential request"], "id": "prize_fee_boundary_00_03", "input": "Lottery desk: congratulations. Pay taxes with gift cards before your prize can be delivered."}
{"category": "prize_fee_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "credential request"], "id": "prize_fee_boundary_00_04", "input": "Travel rewards: free vacation approved. Enter your card number to reserve the certificate."}
{"category": "prize_fee_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "credential request"], "id": "prize_fee_boundary_00_05", "input": "Cash award notice: release requires a small wire fee today."}
{"category": "prize_fee_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "credential request"], "id": "prize_fee_boundary_00_06", "input": "Government benefits team: emergency grant waiting. Send account details for verification."}
{"category": "prize_fee_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "prize_scam", "expected_tactics": ["too good to be true", "payment request", "credential request"], "id": "prize_fee_boundary_00_07", "input": "Prize support: claim at this link and pay shipping before midnight."}
{"category": "job_scam_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "too good to be true", "suspicious contact"], "id": "job_scam_boundary_00_00", "input": "TikTok Shop recruiter: part-time assistant pays $650 per day. Contact us on WhatsApp to begin."}
{"category": "job_scam_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "too good to be true", "suspicious contact"], "id": "job_scam_boundary_00_01", "input": "Remote job approved. Deposit our check, buy equipment, and send the remaining money back."}
{"category": "job_scam_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "too good to be true", "suspicious contact"], "id": "job_scam_boundary_00_02", "input": "Payroll team: your role starts today. Pay an onboarding fee so we can activate your account."}
{"category": "job_scam_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "too good to be true", "suspicious contact"], "id": "job_scam_boundary_00_03", "input": "Hiring manager: we only interview on Telegram. Send your bank login for direct payroll setup."}
{"category": "job_scam_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "too good to be true", "suspicious contact"], "id": "job_scam_boundary_00_04", "input": "Online task work: earn $720 daily for one hour of work. Message this number to receive tasks."}
{"category": "job_scam_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "too good to be true", "suspicious contact"], "id": "job_scam_boundary_00_05", "input": "Recruiting desk: equipment shipment is ready. Buy from this link and we reimburse later."}
{"category": "job_scam_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "too good to be true", "suspicious contact"], "id": "job_scam_boundary_00_06", "input": "Work from home coordinator: complete training fee payment before your first assignment."}
{"category": "job_scam_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "job_scam", "expected_tactics": ["fake job", "payment request", "too good to be true", "suspicious contact"], "id": "job_scam_boundary_00_07", "input": "HR assistant: receive customer funds in your account and forward them to our vendor."}
{"category": "family_romance_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "secrecy", "payment pressure", "urgency"], "id": "family_romance_boundary_00_00", "input": "Auntie, my phone broke. Use this number only and wire emergency funds before Dad finds out."}
{"category": "family_romance_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "secrecy", "payment pressure", "urgency"], "id": "family_romance_boundary_00_01", "input": "Grandma it is me from a temporary phone. I need crypto for rent today and cannot talk."}
{"category": "family_romance_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "secrecy", "payment pressure", "urgency"], "id": "family_romance_boundary_00_02", "input": "Do not tell anyone about us yet. I need help with a hospital bill before we can meet."}
{"category": "family_romance_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "secrecy", "payment pressure", "urgency"], "id": "family_romance_boundary_00_03", "input": "Mom, please keep this quiet. Buy Apple gift cards and text me the codes."}
{"category": "family_romance_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "secrecy", "payment pressure", "urgency"], "id": "family_romance_boundary_00_04", "input": "This is your nephew. I am stranded and need a payment app transfer right away."}
{"category": "family_romance_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "secrecy", "payment pressure", "urgency"], "id": "family_romance_boundary_00_05", "input": "I love you but my account is frozen. Send gift cards today and I will explain tomorrow."}
{"category": "family_romance_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "secrecy", "payment pressure", "urgency"], "id": "family_romance_boundary_00_06", "input": "Please do not call my old number. I need wire money for bail now."}
{"category": "family_romance_boundary", "expected_risk_level": "dangerous", "expected_scam_type": "family_impersonation", "expected_tactics": ["impersonation", "secrecy", "payment pressure", "urgency"], "id": "family_romance_boundary_00_07", "input": "Your daughter asked me to text you. Send funds to this wallet for her emergency."}
{"category": "official_route_contrast", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "official_route_contrast_00_00", "input": "Your bank statement is ready. Open the official banking app to view it."}
{"category": "official_route_contrast", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "official_route_contrast_00_01", "input": "Fraud alert: did you attempt a $249.00 purchase at Target? Reply YES or NO."}
{"category": "official_route_contrast", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "official_route_contrast_00_02", "input": "Your Coinbase password was changed. If this was not you, open the official app to review security."}
{"category": "official_route_contrast", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "official_route_contrast_00_03", "input": "UPS update: your package is out for delivery. Track it in the UPS app."}
{"category": "official_route_contrast", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "official_route_contrast_00_04", "input": "Your pharmacy order shipped. Open your normal pharmacy account for details."}
{"category": "official_route_contrast", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "official_route_contrast_00_05", "input": "Your utility bill is ready. No payment is due until next week through your normal account."}
{"category": "official_route_contrast", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "official_route_contrast_00_06", "input": "School reminder: permission forms are due Friday. Check the parent portal."}
{"category": "official_route_contrast", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "official_route_contrast_00_07", "input": "Your verification code is 482910. Do not share this code with anyone."}
{"category": "benign_scary_contrast", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "benign_scary_contrast_00_00", "input": "Dentist reminder: appointment tomorrow at 2 PM. Call the office number you already have if needed."}
{"category": "benign_scary_contrast", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "benign_scary_contrast_00_01", "input": "Can you bring milk on your way home? No rush."}
{"category": "benign_scary_contrast", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "benign_scary_contrast_00_02", "input": "Your library book is ready for pickup at the front desk."}
{"category": "benign_scary_contrast", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "benign_scary_contrast_00_03", "input": "Dinner moved to 6 PM. No need to bring anything."}
{"category": "benign_scary_contrast", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "benign_scary_contrast_00_04", "input": "Your clinic lab results are available in the patient portal."}
{"category": "benign_scary_contrast", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "benign_scary_contrast_00_05", "input": "Thanks for helping today. I left your receipt on the kitchen table."}
{"category": "benign_scary_contrast", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "benign_scary_contrast_00_06", "input": "Soccer practice is cancelled because of weather."}
{"category": "benign_scary_contrast", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "benign_scary_contrast_00_07", "input": "The school bus is running ten minutes late this morning."}
{"category": "tech_support_long_json_lock", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "remote access request", "urgency"], "id": "tech_support_long_json_lock_00_00", "input": "Windows Security Center: multiple banking trojans were detected during a routine scan. Your device protection subscription is expired and your files may be deleted. Do not turn off the computer. Call the support number in this alert and give the technician the screen code so they can remove the infection."}
{"category": "tech_support_long_json_lock", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "remote access request", "urgency"], "id": "tech_support_long_json_lock_00_01", "input": "Apple Device Care: suspicious sign-in activity was found and your iCloud backup may be disabled. A technician is waiting to verify ownership. Call the number shown, keep this case open, and read the six digit code before data loss occurs."}
{"category": "tech_support_long_json_lock", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "remote access request", "urgency"], "id": "tech_support_long_json_lock_00_02", "input": "Browser warning: your computer has been blocked for safety reasons. The page says not to restart, not to close the tab, and to call certified support immediately. The support agent asks you to install a remote cleanup tool and pay the unlock fee."}
{"category": "tech_support_long_json_lock", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "remote access request", "urgency"], "id": "tech_support_long_json_lock_00_03", "input": "Geek support renewal: your service plan was charged by mistake. To refund it, open the remote support link, allow the technician to view your screen, and confirm the bank account where the refund should go."}
{"category": "tech_support_long_json_lock", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "remote access request", "urgency"], "id": "tech_support_long_json_lock_00_04", "input": "Antivirus response team: malware is sending photos and saved passwords from this device. Call the emergency number in the pop-up, share the desktop access code, and pay the cleanup deposit with a prepaid card."}
{"category": "tech_support_long_json_lock", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "remote access request", "urgency"], "id": "tech_support_long_json_lock_00_05", "input": "Account recovery desk: your email was used from another country. To stop permanent closure, call this callback number, verify the code sent to your phone, and keep the phone line open during repair."}
{"category": "tech_support_long_json_lock", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "remote access request", "urgency"], "id": "tech_support_long_json_lock_00_06", "input": "Microsoft defender audit: unusual command activity found. A technician needs remote access to isolate the device. The alert says the case will be closed in 20 minutes unless you call the listed support number."}
{"category": "tech_support_long_json_lock", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "remote access request", "urgency"], "id": "tech_support_long_json_lock_00_07", "input": "Security billing office: your protection plan is expired and the renewal failed. The message asks you to download a support app, enter your card number, and read the confirmation code to the operator."}
{"category": "tech_support_long_json_lock", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "remote access request", "urgency"], "id": "tech_support_long_json_lock_00_08", "input": "Cloud storage support: backup corruption detected. To avoid losing family photos, call the number in this notice and provide the account reset code that arrives by text."}
{"category": "tech_support_long_json_lock", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "remote access request", "urgency"], "id": "tech_support_long_json_lock_00_09", "input": "Device warranty alert: unauthorized login found. The operator says they can fix it only if you install remote access software and leave the computer connected while they process a service fee."}
{"category": "tech_support_long_json_lock", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "remote access request", "urgency"], "id": "tech_support_long_json_lock_00_10", "input": "Printer support case: driver error locked your network. Call the help desk number in this message, grant screen sharing, and buy a troubleshooting voucher before the case expires."}
{"category": "tech_support_long_json_lock", "expected_risk_level": "dangerous", "expected_scam_type": "tech_support", "expected_tactics": ["fake authority", "remote access request", "urgency"], "id": "tech_support_long_json_lock_00_11", "input": "Streaming device support: subscription expired and a security issue was found. The message asks you to call the number shown and provide the one-time code to reactivate protection."}
{"category": "official_route_v4", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "official_route_v4_00_00", "input": "Netflix notice: your payment method needs attention. Open the Netflix app or website yourself to update billing."}
{"category": "official_route_v4", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "official_route_v4_00_01", "input": "Credit union alert: we noticed a new login. If this was not you, open the official mobile app and review security."}
{"category": "official_route_v4", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "official_route_v4_00_02", "input": "Hospital portal: new test results are available. Sign in through your usual patient portal to view them."}
{"category": "official_route_v4", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "official_route_v4_00_03", "input": "Utility reminder: your statement is ready. Pay only through your normal account or the phone number printed on your bill."}
{"category": "official_route_v4", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "official_route_v4_00_04", "input": "Airline update: your flight time changed. Open the airline app or website directly to review the itinerary."}
{"category": "official_route_v4", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "official_route_v4_00_05", "input": "County tax office: your annual notice is available. Visit the official county website printed on prior mail."}
{"category": "official_route_v4", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "official_route_v4_00_06", "input": "Delivery update: your package is delayed because of weather. Check tracking in the official carrier app."}
{"category": "official_route_v4", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "official_route_v4_00_07", "input": "Card fraud alert: did you attempt a $318.44 grocery purchase? Reply YES or NO, or call the number on your card."}
{"category": "official_route_v4", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "official_route_v4_00_08", "input": "Insurance EOB ready: this is not a bill. Review details in your normal insurance portal."}
{"category": "official_route_v4", "expected_risk_level": "needs_check", "expected_scam_type": "possible_legitimate_alert", "expected_tactics": ["verification needed", "trusted route"], "id": "official_route_v4_00_09", "input": "School safety notice: pickup procedures changed today. Check the parent portal for official instructions."}
{"category": "external_route_phishing_v4", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "suspicious link", "urgency"], "id": "external_route_phishing_v4_00_00", "input": "Netflix billing: payment failed and your account closes tonight. Update now at http://netflix-billing-review.example"}
{"category": "external_route_phishing_v4", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "suspicious link", "urgency"], "id": "external_route_phishing_v4_00_01", "input": "Credit union security: new login detected. Call the fraud number in this text now to cancel it."}
{"category": "external_route_phishing_v4", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "suspicious link", "urgency"], "id": "external_route_phishing_v4_00_02", "input": "Hospital portal: test results blocked. Enter your login and insurance number here: https://patient-records-release.example"}
{"category": "external_route_phishing_v4", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "suspicious link", "urgency"], "id": "external_route_phishing_v4_00_03", "input": "Utility shutoff warning: service stops today unless you pay through this urgent portal: http://utility-fastpay.example"}
{"category": "external_route_phishing_v4", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "suspicious link", "urgency"], "id": "external_route_phishing_v4_00_04", "input": "Airline refund desk: your ticket changed. Provide card details at https://airline-refund-claim.example"}
{"category": "external_route_phishing_v4", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "suspicious link", "urgency"], "id": "external_route_phishing_v4_00_05", "input": "County tax office: final notice. Pay the penalty fee with the link below before noon."}
{"category": "external_route_phishing_v4", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "suspicious link", "urgency"], "id": "external_route_phishing_v4_00_06", "input": "Carrier delivery: weather delay fee unpaid. Confirm address and card at http://package-release-fee.example"}
{"category": "external_route_phishing_v4", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "suspicious link", "urgency"], "id": "external_route_phishing_v4_00_07", "input": "Card fraud center: suspicious grocery purchase. Call the number in this alert and verify your full card number."}
{"category": "external_route_phishing_v4", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "suspicious link", "urgency"], "id": "external_route_phishing_v4_00_08", "input": "Insurance claims: EOB blocked. Upload ID and bank details through this secure message link."}
{"category": "external_route_phishing_v4", "expected_risk_level": "dangerous", "expected_scam_type": "credential_theft", "expected_tactics": ["fake authority", "suspicious link", "urgency"], "id": "external_route_phishing_v4_00_09", "input": "School portal alert: emergency form missing. Enter parent login and payment card at this link."}
{"category": "benign_scary_v4", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "benign_scary_v4_00_00", "input": "Clinic reminder: your lab results are available in the patient portal. No urgent action is required."}
{"category": "benign_scary_v4", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "benign_scary_v4_00_01", "input": "School alert: buses are delayed because of weather. Students are safe and pickup is at the usual place."}
{"category": "benign_scary_v4", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "benign_scary_v4_00_02", "input": "Court reminder: jury duty starts Monday. Bring your ID and report to the address on your mailed summons."}
{"category": "benign_scary_v4", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "benign_scary_v4_00_03", "input": "Pharmacy notice: your prescription refill is ready for pickup at your usual store."}
{"category": "benign_scary_v4", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "benign_scary_v4_00_04", "input": "Dentist reminder: your appointment is tomorrow at 9 AM. Call the office number you already have if needed."}
{"category": "benign_scary_v4", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "benign_scary_v4_00_05", "input": "Library notice: your requested book is ready. It will be held at the front desk until Friday."}
{"category": "benign_scary_v4", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "benign_scary_v4_00_06", "input": "Building notice: fire alarm testing is scheduled this afternoon. No action needed."}
{"category": "benign_scary_v4", "expected_risk_level": "safe", "expected_scam_type": "none", "expected_tactics": [], "id": "benign_scary_v4_00_07", "input": "HR reminder: open enrollment ends Friday. Review benefits through the company portal."}
{"category": "marketplace_calibration_v4", "expected_risk_level": "suspicious", "expected_scam_type": "marketplace_scam", "expected_tactics": ["marketplace", "third party", "payment pressure"], "id": "marketplace_calibration_v4_00_00", "input": "I want your table but I am traveling. My cousin will pick it up and I can send extra money now."}
{"category": "marketplace_calibration_v4", "expected_risk_level": "suspicious", "expected_scam_type": "marketplace_scam", "expected_tactics": ["marketplace", "third party", "payment pressure"], "id": "marketplace_calibration_v4_00_01", "input": "Use this shipping agent and pay their small insurance deposit; I will include it in the final payment."}
{"category": "marketplace_calibration_v4", "expected_risk_level": "suspicious", "expected_scam_type": "marketplace_scam", "expected_tactics": ["marketplace", "third party", "payment pressure"], "id": "marketplace_calibration_v4_00_02", "input": "I sent a code to prove you are real. Send it back and then I will pay."}
{"category": "marketplace_calibration_v4", "expected_risk_level": "suspicious", "expected_scam_type": "marketplace_scam", "expected_tactics": ["marketplace", "third party", "payment pressure"], "id": "marketplace_calibration_v4_00_03", "input": "My assistant handles payment by email. Send your bank name so accounting can release funds."}
{"category": "marketplace_calibration_v4", "expected_risk_level": "suspicious", "expected_scam_type": "marketplace_scam", "expected_tactics": ["marketplace", "third party", "payment pressure"], "id": "marketplace_calibration_v4_00_04", "input": "I can buy today, but we need to move off the marketplace because my account has a limit."}
{"category": "marketplace_calibration_v4", "expected_risk_level": "suspicious", "expected_scam_type": "marketplace_scam", "expected_tactics": ["marketplace", "third party", "payment pressure"], "id": "marketplace_calibration_v4_00_05", "input": "The escrow site protects both of us. Please use this payment page before pickup."}
{"category": "marketplace_calibration_v4", "expected_risk_level": "suspicious", "expected_scam_type": "marketplace_scam", "expected_tactics": ["marketplace", "third party", "payment pressure"], "id": "marketplace_calibration_v4_00_06", "input": "I accidentally overpaid. Please refund the difference to my driver."}
{"category": "marketplace_calibration_v4", "expected_risk_level": "suspicious", "expected_scam_type": "marketplace_scam", "expected_tactics": ["marketplace", "third party", "payment pressure"], "id": "marketplace_calibration_v4_00_07", "input": "Can you mark it sold and pay the courier fee now? I promise to reimburse you."}