[
  {
    "id": "suspicious",
    "label": "Payment pressure",
    "text": "URGENT: This is the IT Security Team. Your account has been suspended. To reactivate your account immediately, buy $200 in Google Play gift cards and send codes to this address.",
    "receipt": {
      "check_id": "eb6dede8f4e32189",
      "verdict": "SUSPICIOUS",
      "verdict_reason": "HARD_RULE",
      "score": 90,
      "threshold": 40,
      "hard_hit": true,
      "content_digest": "00cb4cde7d4a482da6d5d56d68a16086ee08b0d66b41b60b98d52c5b617dfb63",
      "input_chars": 177,
      "sender_email": null,
      "ruleset": {
        "version": "2026.09.28-r2",
        "sha256": "6fea0a910fc7d147d6d2340003790576c92b40af73eb67155bf182d434294dc4"
      },
      "engine_version": "0.1.0",
      "signals": [
        "AMOUNT",
        "AUTHORITY_CLAIM",
        "PAYMENT_RAIL",
        "THREAT",
        "UNUSUAL_PAYMENT",
        "URGENCY_MARKER",
        "VERIFY_REQUEST"
      ],
      "matched_rules": [
        {
          "rule_id": "R01",
          "name": "Gift-card payment demand",
          "explain": "Real organisations never ask for payment in gift cards.",
          "class": "hard",
          "weight": 100,
          "citations": [
            {
              "id": "a09",
              "kind": "UNUSUAL_PAYMENT",
              "value": "send codes",
              "quote": "send codes",
              "digest": "fc19412a0c1b14028654f657332a764c0b0069022b2b5c2b05029d9ac2d19fc1"
            }
          ]
        },
        {
          "rule_id": "R02",
          "name": "Crypto/wire pressure",
          "explain": "Crypto or wire-transfer demands with urgency are the classic fraud rail; payments are unrecoverable.",
          "class": "hard",
          "weight": 60,
          "citations": [
            {
              "id": "a09",
              "kind": "UNUSUAL_PAYMENT",
              "value": "send codes",
              "quote": "send codes",
              "digest": "fc19412a0c1b14028654f657332a764c0b0069022b2b5c2b05029d9ac2d19fc1"
            }
          ]
        },
        {
          "rule_id": "R04",
          "name": "Authority impersonation with threat",
          "explain": "Someone claiming authority threatens legal or physical consequences to force fast compliance.",
          "class": "hard",
          "weight": 80,
          "citations": [
            {
              "id": "a06",
              "kind": "AUTHORITY_CLAIM",
              "value": "security team",
              "quote": "Security Team",
              "digest": "5549157ae4bbc3d4cca81b69858e6c78e3889c044623366d8d239282a577aa7d"
            },
            {
              "id": "a07",
              "kind": "THREAT",
              "value": "your account has been",
              "quote": "Your account has been",
              "digest": "9738243fe4541ae73a8a3d15651b87259783ec73bbc4e06b25fd0b7e077c4dd7"
            }
          ]
        },
        {
          "rule_id": "R05",
          "name": "Bank-security impersonation",
          "explain": "Urgent security-team framing combined with a money amount is the standard bank-impersonation script.",
          "class": "hard",
          "weight": 70,
          "citations": [
            {
              "id": "a01",
              "kind": "AMOUNT",
              "value": "200",
              "quote": "$200",
              "digest": "dc1147f9efb14148ecd52d6e6152c5467eb01b91ee7db765331094de4bc47aa3"
            },
            {
              "id": "a03",
              "kind": "URGENCY_MARKER",
              "value": "urgent",
              "quote": "URGENT",
              "digest": "27da21a42341ed974ecbdb3863555df155fc445a908c713e416c82e5d6155abd"
            },
            {
              "id": "a04",
              "kind": "URGENCY_MARKER",
              "value": "suspended",
              "quote": "suspended",
              "digest": "7483f471dc649433a9869da3003791b433dc4b6a143175472a9e50b3baa21783"
            },
            {
              "id": "a05",
              "kind": "URGENCY_MARKER",
              "value": "immediately",
              "quote": "immediately",
              "digest": "70024d1ed29c948958f9bc9409759bbdc1e599131644b99c5fec1f5244d7f8eb"
            },
            {
              "id": "a06",
              "kind": "AUTHORITY_CLAIM",
              "value": "security team",
              "quote": "Security Team",
              "digest": "5549157ae4bbc3d4cca81b69858e6c78e3889c044623366d8d239282a577aa7d"
            }
          ]
        },
        {
          "rule_id": "R12",
          "name": "Verify via link with payment rail present",
          "explain": "A verification request mentioning gift cards or crypto rails is fraud, full stop.",
          "class": "hard",
          "weight": 65,
          "citations": [
            {
              "id": "a02",
              "kind": "PAYMENT_RAIL",
              "value": "google play",
              "quote": "Google Play",
              "digest": "cb8c288bbbc60b5d766ccba5d69618c5569a097e87cce3d05d715c0909af5550"
            },
            {
              "id": "a08",
              "kind": "VERIFY_REQUEST",
              "value": "reactivate your account",
              "quote": "reactivate your account",
              "digest": "bb2a70b149b78c1560304b727f253282eeb6a46ffdab976637cc633723c39eee"
            }
          ]
        },
        {
          "rule_id": "R24",
          "name": "Tech-support / fake-security script",
          "explain": "Unsolicited security alarm plus urgency plus a verification request is the standard fake tech-support script.",
          "class": "hard",
          "weight": 60,
          "citations": [
            {
              "id": "a03",
              "kind": "URGENCY_MARKER",
              "value": "urgent",
              "quote": "URGENT",
              "digest": "27da21a42341ed974ecbdb3863555df155fc445a908c713e416c82e5d6155abd"
            },
            {
              "id": "a04",
              "kind": "URGENCY_MARKER",
              "value": "suspended",
              "quote": "suspended",
              "digest": "7483f471dc649433a9869da3003791b433dc4b6a143175472a9e50b3baa21783"
            },
            {
              "id": "a05",
              "kind": "URGENCY_MARKER",
              "value": "immediately",
              "quote": "immediately",
              "digest": "70024d1ed29c948958f9bc9409759bbdc1e599131644b99c5fec1f5244d7f8eb"
            },
            {
              "id": "a07",
              "kind": "THREAT",
              "value": "your account has been",
              "quote": "Your account has been",
              "digest": "9738243fe4541ae73a8a3d15651b87259783ec73bbc4e06b25fd0b7e077c4dd7"
            },
            {
              "id": "a08",
              "kind": "VERIFY_REQUEST",
              "value": "reactivate your account",
              "quote": "reactivate your account",
              "digest": "bb2a70b149b78c1560304b727f253282eeb6a46ffdab976637cc633723c39eee"
            }
          ]
        },
        {
          "rule_id": "R13",
          "name": "Urgency pressure",
          "explain": "Manufactured urgency short-circuits careful thinking.",
          "class": "soft",
          "weight": 15,
          "citations": [
            {
              "id": "a03",
              "kind": "URGENCY_MARKER",
              "value": "urgent",
              "quote": "URGENT",
              "digest": "27da21a42341ed974ecbdb3863555df155fc445a908c713e416c82e5d6155abd"
            },
            {
              "id": "a04",
              "kind": "URGENCY_MARKER",
              "value": "suspended",
              "quote": "suspended",
              "digest": "7483f471dc649433a9869da3003791b433dc4b6a143175472a9e50b3baa21783"
            },
            {
              "id": "a05",
              "kind": "URGENCY_MARKER",
              "value": "immediately",
              "quote": "immediately",
              "digest": "70024d1ed29c948958f9bc9409759bbdc1e599131644b99c5fec1f5244d7f8eb"
            }
          ]
        },
        {
          "rule_id": "R14",
          "name": "Threat language",
          "explain": "Threats are used to stop you from double-checking.",
          "class": "soft",
          "weight": 20,
          "citations": [
            {
              "id": "a07",
              "kind": "THREAT",
              "value": "your account has been",
              "quote": "Your account has been",
              "digest": "9738243fe4541ae73a8a3d15651b87259783ec73bbc4e06b25fd0b7e077c4dd7"
            }
          ]
        },
        {
          "rule_id": "R15",
          "name": "Money amount in message",
          "explain": "The message discusses a specific amount of money.",
          "class": "soft",
          "weight": 10,
          "citations": [
            {
              "id": "a01",
              "kind": "AMOUNT",
              "value": "200",
              "quote": "$200",
              "digest": "dc1147f9efb14148ecd52d6e6152c5467eb01b91ee7db765331094de4bc47aa3"
            }
          ]
        },
        {
          "rule_id": "R17",
          "name": "Payment rail mentioned",
          "explain": "Untraceable payment methods are mentioned (common in fraud, legitimate in rare contexts).",
          "class": "soft",
          "weight": 20,
          "citations": [
            {
              "id": "a02",
              "kind": "PAYMENT_RAIL",
              "value": "google play",
              "quote": "Google Play",
              "digest": "cb8c288bbbc60b5d766ccba5d69618c5569a097e87cce3d05d715c0909af5550"
            }
          ]
        },
        {
          "rule_id": "R18",
          "name": "Authority role claimed",
          "explain": "Someone invokes an official or corporate role.",
          "class": "soft",
          "weight": 10,
          "citations": [
            {
              "id": "a06",
              "kind": "AUTHORITY_CLAIM",
              "value": "security team",
              "quote": "Security Team",
              "digest": "5549157ae4bbc3d4cca81b69858e6c78e3889c044623366d8d239282a577aa7d"
            }
          ]
        },
        {
          "rule_id": "R19",
          "name": "Verify/reactivate request",
          "explain": "You are asked to verify or reactivate something by message.",
          "class": "soft",
          "weight": 15,
          "citations": [
            {
              "id": "a08",
              "kind": "VERIFY_REQUEST",
              "value": "reactivate your account",
              "quote": "reactivate your account",
              "digest": "bb2a70b149b78c1560304b727f253282eeb6a46ffdab976637cc633723c39eee"
            }
          ]
        }
      ],
      "artifacts": [
        {
          "id": "a01",
          "kind": "AMOUNT",
          "value": "200"
        },
        {
          "id": "a02",
          "kind": "PAYMENT_RAIL",
          "value": "google play"
        },
        {
          "id": "a03",
          "kind": "URGENCY_MARKER",
          "value": "urgent"
        },
        {
          "id": "a04",
          "kind": "URGENCY_MARKER",
          "value": "suspended"
        },
        {
          "id": "a05",
          "kind": "URGENCY_MARKER",
          "value": "immediately"
        },
        {
          "id": "a06",
          "kind": "AUTHORITY_CLAIM",
          "value": "security team"
        },
        {
          "id": "a07",
          "kind": "THREAT",
          "value": "your account has been"
        },
        {
          "id": "a08",
          "kind": "VERIFY_REQUEST",
          "value": "reactivate your account"
        },
        {
          "id": "a09",
          "kind": "UNUSUAL_PAYMENT",
          "value": "send codes"
        }
      ],
      "recompute_guarantee": "This receipt can be recomputed byte-identically from (content, ruleset) by the same engine version.",
      "receipt_sha256": "69608f3e9556ce7cd945805dc8131051bb5119745e419bbc881b50527336c187"
    }
  },
  {
    "id": "uncertain",
    "label": "One weak signal",
    "text": "Please respond immediately.",
    "receipt": {
      "check_id": "5739a23391a85f78",
      "verdict": "INSUFFICIENT_EVIDENCE",
      "verdict_reason": "SOFT_SIGNALS_BELOW_THRESHOLD",
      "score": 15,
      "threshold": 40,
      "hard_hit": false,
      "content_digest": "7b6c2c72438d2efa845bfdf4fc6e79e71982822856e1d66850c1cfb509015a79",
      "input_chars": 27,
      "sender_email": null,
      "ruleset": {
        "version": "2026.09.28-r2",
        "sha256": "6fea0a910fc7d147d6d2340003790576c92b40af73eb67155bf182d434294dc4"
      },
      "engine_version": "0.1.0",
      "signals": [
        "URGENCY_MARKER"
      ],
      "matched_rules": [
        {
          "rule_id": "R13",
          "name": "Urgency pressure",
          "explain": "Manufactured urgency short-circuits careful thinking.",
          "class": "soft",
          "weight": 15,
          "citations": [
            {
              "id": "a01",
              "kind": "URGENCY_MARKER",
              "value": "immediately",
              "quote": "immediately",
              "digest": "d57a3ad9de83bd6d8a09ffd3133d098c1d5095af0a7d5b656b06f25d18aa119f"
            }
          ]
        }
      ],
      "artifacts": [
        {
          "id": "a01",
          "kind": "URGENCY_MARKER",
          "value": "immediately"
        }
      ],
      "recompute_guarantee": "This receipt can be recomputed byte-identically from (content, ruleset) by the same engine version.",
      "receipt_sha256": "c57263aaa880c015896a95febcda941b8d856aafdb78b965da823fbddfc9bcb3"
    }
  },
  {
    "id": "ordinary",
    "label": "An ordinary message",
    "text": "See you for lunch tomorrow.",
    "receipt": {
      "check_id": "9a8e7d0cc0d5270e",
      "verdict": "LIKELY_SAFE",
      "verdict_reason": "NO_RISK_SIGNALS",
      "score": -15,
      "threshold": 40,
      "hard_hit": false,
      "content_digest": "f6599e9c4cfa9afd65007c2665950193b191912f158424ceb6e47814252677dd",
      "input_chars": 27,
      "sender_email": null,
      "ruleset": {
        "version": "2026.09.28-r2",
        "sha256": "6fea0a910fc7d147d6d2340003790576c92b40af73eb67155bf182d434294dc4"
      },
      "engine_version": "0.1.0",
      "signals": [
        "LOW_SIGNAL"
      ],
      "matched_rules": [
        {
          "rule_id": "S03",
          "name": "Ordinary conversational tone",
          "explain": "The message contains none of the usual fraud markers.",
          "class": "safe",
          "weight": 15,
          "citations": []
        }
      ],
      "artifacts": [],
      "recompute_guarantee": "This receipt can be recomputed byte-identically from (content, ruleset) by the same engine version.",
      "receipt_sha256": "e85818ba7483c87aad2db4c80a73cfb39d682baeedbab2f7dfb60797cd359761"
    }
  }
]