Chapter 2 — Sniff and the Three Tells

Sniff is a hound-tween with a sensitive nose and a magnifying glass tucked into his collar.

He is short. He is brown-and-cream. His ears are long and floppy — they swing forward when he’s concentrating on a smell. His tail is waggy when he’s excited about a puzzle (which is almost always). He carries a small notebook labeled TELLS in his shirt pocket, and a small magnifying glass on a cord around his neck.

His posture is bent slightly forward. His nose is twitching. He is sniffing for something.

What he is sniffing for is tells.

(A tell is a small clue that gives a scam away. Every scam has tells. Sniff’s whole job is to teach kids how to find them.)

Critical: Sniff NEVER frames scam-spotting as terrifying. He never says “if you don’t spot this scam, something terrible will happen to you and your family.” That is fear-mongering, and fear-mongering makes kids freeze — which is the opposite of what scam-spotting requires. (You cannot pattern-match clearly when you are panicking.)

Instead, Sniff frames scam-spotting as a puzzle to win. He treats every phishing email, every fake-prize popup, every too-good-to-be-true text message as a puzzle the scammer left for the kid to solve. The scammer left a tell. Sniff’s job is to help the kid find it. The kid is the detective. The scammer is the puzzle-maker who left clues by accident. When the kid spots the tell, the kid wins.

Sniff grew up in a small village where his family had been the village’s letter-sniffers — the hounds who could smell whether a letter was authentic (sent by the person it claimed to be from) or forged (sent by someone pretending to be that person). Letter-sniffing had been a respected craft in his village for generations. Sniff had learned by age six that forgeries always smell slightly off — the ink is wrong, the paper is wrong, the handwriting strain is wrong. Forgeries had tells. Real letters did not.

He walked to the SafetyForge academy at twenty-two. Aegis had asked him: “What is pattern-spotting in scams?” Sniff had said: “It is the skill of recognizing the three universal scam-tells: urgency, too-good-to-be-true, and request-for-personal-info. Every scam has at least one. Most scams have all three. Every scam has a tell. Sniff for the tell.” Aegis had said: “You are appointed.”

In his classroom, Sniff begins every first-day lesson the same way. He pulls out his magnifying glass. He sniffs the air dramatically. He says: “I am Sniff. The digital-citizenship skill I teach is pattern-spotting in scams and phishing. Every scam has a tell. There are three big ones. Let me show you.”

He teaches the three universal tells:

• Tell #1 — Urgency. “Act now! Only 5 minutes left! Your account will be closed!” Real businesses do not panic kids into instant decisions. Urgency is a tell.
• Tell #2 — Too-good-to-be-true. “You won a free iPad! Click here to claim it!” Real prizes do not arrive unannounced from strangers. Too-good-to-be-true is a tell.
• Tell #3 — Request-for-personal-info. “Confirm your password to keep your account safe!” Real businesses never ask you to type your password into a link sent by email. Request-for-personal-info is a tell.

He is explicit: “You don’t have to remember a thousand specific scams. You only have to remember the three tells. Most scams have all three. Spot one tell, and you have probably spotted a scam. Spot two tells, and you have definitely spotted a scam.”

(He carries his small notebook. He pulls it out. He says: “Want to see real examples? Let me show you the tells in this one. And this one. And this one.” He treats each example as a puzzle — not as a horror story. The kid leaves empowered, not frightened.)

When students ask Sniff whether scam-spotting is hard, Sniff always says the same thing:

“It is not hard. It is sniffing for the three tells. Urgency. Too-good-to-be-true. Request-for-personal-info. Every scam has a tell. Sniff for the tell.”

He sniffs the air. His tail wags. The puzzle is fun.

Voice register

Guidance: Detective-curious, fond of magnifying glasses + small notebooks labeled TELLS, treats scam-spotting as a puzzle to win not a disaster to prevent. Hound-tween with sensitive nose + long floppy ears + waggy tail. NEVER frames scams as terrifying; ALWAYS as puzzles with three universal tells. Friends with Pause (pause-before-clicking + pattern-spotting pair); all SafetyForge cast.

Sample lines:

• “Every scam has a tell. Sniff for the tell.”
• “Three big ones: urgency, too-good-to-be-true, request-for-personal-info.”
• “You are the detective. The scammer left clues by accident.”
• “Spot the tell, and you win the puzzle.”

Arc across kits

• Kit 1 — Cameo.
• Kit 2 — Anchor character. Full chapter feature (the three universal tells).
• Kit 3-7 — Recurring (pattern-spotting across phishing / fake-prize / impersonation scenarios).
• Kit 8 — CRITICAL gate (sensitivity-reviewer-required: real-world scam patterns kid-scaled).
• Kit 9-16 — Recurring ensemble member.

Relationships

• Alliance: Pause (pause-before-clicking + pattern-spotting pair); all SafetyForge cast.
• Tension: None.

Cultural-sensitivity gate

Fear-amplification gate enforced (CO-STRONGEST Wave 24 burden alongside FitQuest body-image gate). Phishing scenarios framed PATTERN-SPOTTING-GAME register, NEVER disaster-prevention drill. No graphic harm references in Sniff’s voice. Kid leaves empowered, not frightened.

Cultural-context note

The village-letter-sniffer family framing is a deliberate generic European-village tradition. The three universal tells (urgency / too-good-to-be-true / request-for-personal-info) are load-bearing per Common Sense Media digital-citizenship pedagogy + FTC consumer-protection guidance. The puzzle-to-win framing (NOT disaster-to-prevent framing) is load-bearing per 2024 evidence on fear-amplification in cyber-safety education (Common Sense 2024 evidence base; ICAC + NCMEC educator guidance).