Scammers cannot talk people past a 24 hour wait. This attack is built upon pressure and operates at a scale that makes stealing many identies, building different-enough apps to avoid getting flagged by Google and signing them all non-viable.
Not a 'code of rules'. The scam itself relies on urgency. Breaking the spell by allowing people to talk to friends/family/their bank makes the scam not work.
