Demo
Ask the demo bank whether it sent this
This is the Fromenance communication provenance demo, and nothing about it is mocked. There is a real fraud alert from JT Merlin Bank (demo), registered on the production API, a lure that imitates it, and the same public verify endpoint your customers would use. Paste either one and read the verdict, the locked wording, and the rule that produced it.
JT Merlin Bank (demo) verify page
This is the demo tenant, JT Merlin Bank (demo), on the production API with site keysk_pub_demo_jtmerlin. The latency you see is the latency your customers would see.
The real alert
We registered this fraud alert at send time, addressed tojane.doe@example.com. The footer carries the code twice on purpose: one copy usually survives whatever a mail client does on the way.
JT Merlin Bank We noticed a card transaction Hi Jane, A purchase of $412.90 at ACME ELECTRONICS was made with your JT Merlin Bank Visa ending in 4471 on September 24 at 10:42 AM. If this was you, no action is needed. If you do not recognize this transaction, review it in the app or call the number on the back of your card. Review this transaction: https://www.jtmerlin.com/app/alerts/tx/98812?utm=email Thank you, JT Merlin Bank Fraud Team Not sure this email is from JT Merlin Bank? Forward it to verify@jtmerlin.com or enter code KX73-PQ9G at jtmerlin.com/verify. Reference: KX73-PQ9G JT Merlin Bank, Member FDIC. 1 Merlin Plaza, Wilmington, DE 19801. Privacy: https://www.jtmerlin.com/privacyJT Merlin Bank Urgent: your card has been temporarily restricted Hi Jane, A purchase of $412.90 at ACME ELECTRONICS was attempted with your JT Merlin Bank Visa ending in 4471 on September 24 at 10:42 AM and has been placed on hold. To avoid permanent suspension of your card, confirm your identity within 24 hours. Confirm your identity now: https://jtmerlin-secure.com/login?ref=8812 Thank you, JT Merlin Bank Fraud Team Not sure this email is from JT Merlin Bank? Forward it to verify@jtmerlin.com or enter code QF29-TH40 at jtmerlin.com/verify. Reference: QF29-TH40 JT Merlin Bank, Member FDIC. 1 Merlin Plaza, Wilmington, DE 19801.
Notice what the reply does not do. It never quotes the suspicious message or repeats its links. It says only what the bank can stand behind: a registered communication matches, or none does.
Try these
Three things worth trying
- Verified
Paste the real alert and leave the address as jane.doe@example.com. The code leads to the registration, the recipient matches, and the fingerprint is within threshold. Rule:
code+recipient+content. - Not verified
Paste the lure. Its code was never issued and its text is far from anything registered for that recipient, so nothing matches (
no_match). Then change the address on the real alert and watch the same code fail the recipient check (code:recipient_mismatch). Send the code on its own with no address and we treat it as a copied footer (code:replay). - Known fraud
You cannot reach this one from here, on purpose. Known fraud takes an analyst on the tenant confirming a lure or adding an indicator to the fraud list. Nothing a submission says can produce it.
The demo tenant is rate limited like any other site key, and what you paste here is stored on the demo tenant with the same retention as production. So please do not paste a real customer's message.