Learn from
the aftermath.
SCAMMED simulates seven days of a fictional digital life. Most interactions are routine. A few carry risks, and their consequences may arrive days later. Your final incident report connects what happened to the decisions that led there.
How to play
Open an app or choose All activity. Read a request, inspect its sender and destination, and decide how to handle it. Open a service from the trusted directory to verify independently. Account controls let you enable MFA, set unique game passwords, revoke sessions, and scan the simulated device.
Handle all eight daily encounters before ending a day. You can leave a request unanswered, but legitimate tasks and genuine alerts still matter. The intended session length is 30–45 minutes when players investigate and read the report; no timer forces you to wait.
A safe simulation
All services, people, URLs, codes, accounts, payments, and identity documents are fictional. Links open inside the game. Nothing installs software or transfers money. Login pages use provided fictional credentials through a button; there are no password or personal-information fields.
Anonymous statistics
When the backend is available, starting a game creates a random session identifier. We record only scenario identifiers, predefined actions, in-game day, timestamps, and calculated game outcomes. We do not store raw IP addresses, names, emails, passwords, phone numbers, or text you enter.
The game uses a strictly necessary session cookie and browser storage to resume play. Clearing browser storage removes your local copy. Hosting providers may independently keep access logs; operators should configure log minimization and retention.
Offline practice contributes no statistics. Completed online games contribute to public aggregates. No cross-device or repeat-player tracking is implemented. Counts can include replayed games and are not a representative population study.
Accessibility
All core controls work with a keyboard and visible focus indicators. Dialogs use native browser focus handling. Sender and URL clues are written in text. Reduced motion is respected, sound can be muted, and no gameplay information depends on sound.
Understanding your result
A high score rewards safe decisions and keeping up with legitimate tasks. Account protection can block or contain compromises, but unsafe decisions still appear in your report. An ending is an educational game outcome, not a diagnosis of your real-world security.