A New Scam Format Appears Overnight

Reports of scam posts on your platform go from a typical 120 per day to 900 per day over 24 hours. The posts use a format the model has never seen: image text plus a coded phrase. The classifier's score on these posts is low, so most are allowed. You have a standing red team, a reviewer pool, a weekly retraining job and a canary set.

1. Is this spike real? Quantify it against the baseline.
2. How much of the harm happens before you can act, and how does that shape the response timeline?
3. Lay out the first hour, first day and first week.
4. Which signals should have warned you earlier, and what do you change afterwards?