Do not do "clever" stuff like making the game do actual things on the user's system. Like trying to find data to scare the user
Most people do know if they play a game, so the issue should not even be an issue.
Also most people wanting to play games do not want to be educated, so you have to wrap it in a way that they want to play the game and the awareness/education is happening as a side effect.
If you succeed, you might not want to give scammers a manual how to improve their scams. But if your goal is awareness, you can keep it in general unspecific terms.
Basically your plot could be similar to games like Papers, Please or That's not my Neighbor. Only you would accept or reject situations, like emails or IT requests.
I do not think people would return to such a game on a weekly basis. This is not Wordle.