← All detection heuristics · Social Engineering
critical
SE_ADVANCE_FEE_SCAM_LURE
What it means
Document contains lottery/beneficiary, large-value funds, and claim/contact/payment instructions.
Why it fires
The rule requires multiple independent fraud-letter cues: beneficiary or lottery/prize language, large-value draft/funds wording, and claim, contact, payment-bureau, or courier instructions. This is the classic advance-fee scam shape and is stronger than generic prize wording alone.
Other Social Engineering heuristics
SE_BOOKING_COMPLAINT_PHISH PDF_FAKE_DOCUMENT_COMPONENT_INSTALLER OOXML_QR_CREDENTIAL_PHISH SE_CALLBACK_SCAM_TEMPLATE PDF_BRAND_ACCOUNT_UPDATE_REDIRECT_LURE PDF_IMAGE_REPEATED_DECOY_REDIRECT_LURE PDF_IMAGE_DOCUMENT_REVIEW_HOST_LURE PDF_LOCALIZED_DOWNLOAD_HOSTING_LURE PDF_MINIMAL_VIEW_DOCUMENT_REDIRECT PDF_NESTED_ENCODED_CROSSHOST_REDIRECT PDF_RFP_EXTERNAL_ACTION_LURE PDF_UTILITY_REFUND_OFFDOMAIN_LURE PDF_SPARSE_MOVED_ARTICLE_DOORWAY