Spot the phish
Eight messages per round: texts, emails, WhatsApp chats and login pages. All made up, all modelled on real UAE scams. Tap anything that looks off, then decide: phish or legit? At the end you'll see which tricks fooled you.
Read a link from the right
Scammers put the name you trust at the start of the address. The part that really decides where you go is the bit just before the first single slash.
The real site is fines-pay.top. "rta-ae" is just a label the scammer chose.
Looks like the post office, but the site is ae-track.info.
Fine: "online" is a part of the bank's own address, gulfcrescentbank.ae.
It only means the connection is encrypted. Scam sites get a padlock for free.
Got one for real?
Bank, fine, parcel or boss: open the official app, or call a number you already have. Never use the link or number in the message.
No real bank, courier or government office will ask for your PIN, your card details or the code they just sent you.
Report it through your police app or the eCrime platform (ecrime.ae), then block the sender.
Call your bank now on the number on the back of your card and freeze the card. If you are in danger, call 999.
Every message here is invented. Bank, courier and company names are fictional, and real authority names appear only because scammers pretend to be them. No real logos are used. Scenarios are based on public scam warnings from UAE police forces and the UAE Cyber Security Council, and on phishing guidance from the UK National Cyber Security Centre and the US Cybersecurity and Infrastructure Security Agency (CISA) on look-alike links, invoice fraud, QR phishing and "MFA fatigue". Game by Mariam Alzaabi.