Charu

Push versus pull is the frame I was missing entirely. I had been thinking about it as "how quickly did you notice", which explains nothing.

One thing worth saying plainly to anyone you explain this to: if they do send money, the payment type in the other thread is why it is so serious.

This scam always asks for a bank transfer, never a card payment, and that is not an accident. The scammer is choosing the rail with no reversal mechanism. It is the strongest evidence available that they know exactly what they are doing.

So "they asked me to transfer rather than pay by card" is itself a signal, and it is one that can be spotted before any money moves.

Question 2 is a good one because API keys are widely misunderstood.

A key in a server-to-server context is a real secret: it lives on a machine you control, and nobody else sees it. That is the case they were designed for and there they work.

A key in a client is not a secret and was never treated as one by anyone who thought about it. What it is instead is an identifier: it tells you which application the traffic came from, so you can meter it, revoke it, and see when one integration starts behaving oddly. That is genuinely useful — it just is not authentication.

The failure comes from treating the second one as though it were the first. A public key with a rate limit attached is fine. A public key that grants privileged access is a credential you have published.

Yes, required versus optional changes it, and in a way that catches people out.

For a required field, the blank option is doing real work: it lets validation distinguish "not answered" from "answered". Without it there is no unanswered state and your required check can never fire — which is the situation where the alphabetically-first country ends up in your database a thousand times.

For an optional field, blank is not a placeholder, it is a legitimate answer meaning "no preference" or "none of these", and it should be labelled as such rather than left empty. -- none -- or No preference is clearer than an empty row, which reads as a rendering bug.

The common mistake is using a blank first row as an instruction — an empty line where the label should be. If it says nothing, people do not know whether it is a choice or a placeholder.

For question 3, what does reliably work is much more boring and does not involve pretending to be somewhere:

• Being flexible by a day either side. Consistently the biggest single lever, often by a wide margin, and it takes one search on a flexible-date view.
• Checking the two directions separately as one-ways on carriers that price them independently. Not all do, but where it works the saving is real and there is no trick to it.
• Nearby airports, once you have costed the ground transport honestly, including the time.

And two things worth deliberately not doing, because they are the other half of the folklore: clearing cookies and searching in private windows. Prices moving between searches is overwhelmingly ordinary inventory movement — a fare bucket selling out — not the site recognising you and marking it up. People have tested this repeatedly and the effect does not survive controlled testing.