Before — on a calm day
The two that are worth doing when nothing is wrong. They are the reason the other two stay short.
SHOAL
Twelve scareware and adjacent techniques, each with the one tell — the single detail that gives it away. Every card carries its authority citation and its confidence state.
Read the card set →Bulkhead
Sixteen controls in four groups. Not a scanner — a phone cannot be meaningfully scanned by an app running on that phone. It audits posture, and names what floods if a compartment is left open.
Check your posture →During — the ten minutes that matter
A scam runs on a countdown. This surface opens by removing it.
Right Now
Three questions in a fixed order — did money move, did anyone get in, is the device theirs. It sends you on to recovery only if one of those was actually true.
Triage what just happened →Salvage
Six phases in an order most people get backwards. Preserve is first and cleaning is fourth — deleting the messages is the one step that cannot be undone. It opens by telling most readers they are probably not hacked.
Work the runbook →Watch
Five short narrated films, one per surface and one for the set. Drawn frame by frame — no stock footage, and nothing that imitates a real screen. Captions are burned in.
What this set will not do
- No scan, and no security score A percentage implies safety it cannot measure. Bulkhead reports sealed compartments and names the consequence of each open one instead.
- No fabricated screens Nothing in the art or the pages imitates a real alert, logo, account or record. A set that teaches you to spot fakes cannot ship one.
- Your evidence stays yours Salvage hashes files in your browser and builds a manifest on your device. Nothing is uploaded, and the desk neither keeps nor vouches for it.
- No records on private individuals The cards describe techniques, never people. A private citizen is never routed into the defender-side reporting systems — that boundary is enforced in their schema, not by policy.
- It stops for the harder case Before any password-change step, Salvage stops for the reader whose intruder is someone they live with, where a sudden lockout escalates instead of protecting.
- It routes to the platform Genuine threat notices arrive in your account from the platform, never in a browser tab. Continuous monitoring is the platform's job; these pages do the periodic part.