
Withdrawal HAW-WD-773201-URGENT has been cancelled.
Your account is secure — no further action is needed.
waiting for victim input…
In a real attack these two lines would be POSTed to the attacker's server and used to sign in as the victim within seconds — unlocking their wallets, linked bank accounts, cards and transfers. In this demo nothing leaves the browser.
Chain demonstrated: search-contacts (victim's real name + email) → unauthenticated send-email (branded "withdrawal" notice from no-reply@usehawala.com) → this page. Press A to toggle this panel.