- Fires when
- Contact you did not initiate, referencing your account, an order or a payment.
- First move
- Read the last sentence. If there is an ask, everything before it is framing.
- What settles most of it
- The channel. No market runs support on a messaging app, a forum account or email.
- What never settles it
- How established, helpful or plausible the sender seems.
- The mistake
- Replying to judge. The interaction is designed to be steered rather than assessed.
The channel answers it before the content does
No market runs support, announcements or an official presence on a clearnet messaging platform, a chat group, an email address or a forum account. Anything presenting itself that way is impersonation regardless of how established it looks, which means there is no judgement to make about whether this particular contact is genuine.
Why it arrives when it doesSomebody who has just described a problem publicly is the most receptive audience there is, which is why contact tends to arrive within the hour of a post. That sequence is the method, and it is almost the whole method.
Requests that are never legitimate
| The request | How it is framed |
|---|---|
| A wallet phrase or private key | Migration, verification, recovery, proving the wallet is yours |
| A password on a page you did not navigate to | Session expired, confirm your identity, security check |
| A second factor code passed to a person | Support needs it to unlock your account |
| Payment outside the platform arrangement | Faster, cheaper, escrow is having problems, a discount |
| Lowering your browser security | The page will not work otherwise |
What tips it
Whether you started the conversation. Contact you initiated, through the platform, about an order you placed, is ordinary. Contact that arrived is a different category, and the rule that covers it needs no expertise: a message wanting action inside a stated period is telling you what it is, because nothing genuine here operates on a clock.