What usually changes first
The script changes faster than the underlying fraud goal. One week it looks like refund help, the next week it looks like KYC or a fake recruiter. The pressure pattern stays similar: urgency, authority, and a request to act before independent verification.