Online scams often imitate ordinary communication: a delivery update, bank alert, job offer, prize, invoice, or message from someone you know. The safest response is to slow down and verify the request through a separate trusted channel. A familiar logo or name is not proof that a message is genuine.
Image: freestocks / Unsplash
9 warning signs
- Urgency or threats: You must act immediately or face account closure or penalties.
- Unexpected links: You are asked to sign in or pay through a message you did not expect.
- Requests for codes: A caller asks for a one-time verification code or login approval.
- Unusual payments: The sender insists on gift cards, crypto, wire transfer, or another hard-to-reverse method.
- Too-good-to-be-true offers: Guaranteed returns, unusually cheap goods, or prizes you never entered.
- Impersonation: Someone claims to be a relative, boss, bank, or government agency and resists independent verification.
- Odd web addresses: The domain uses misspellings or extra words.
- Unexpected attachments: Files or QR codes arrive with little context.
- Secrecy: The sender tells you not to speak to family, colleagues, or the official organization.
Verify before responding
Do not use contact details inside a suspicious message. Open the official app, type the known website address yourself, or call a number from a trusted statement. If a message seems to come from family or a colleague, contact them through another channel. For a shopping site, check the exact domain, return policy, business details, and independent reviews; reviews can also be manipulated.
Protect your accounts
Use a unique password for each account and a reputable password manager. Enable multifactor authentication or passkeys where available. Keep your operating system and apps updated, and inspect unexpected QR codes before entering credentials or paying. Legitimate organizations should not ask you to disclose a password or one-time code to a caller. For additional guidance, consult the Federal Trade Commission’s phishing guide; for stronger account protection, see our passkeys vs. password managers guide.
If you already clicked
If you entered a password, visit the real service directly, change it, and change it anywhere else it was reused. Sign out unfamiliar sessions and enable stronger authentication. If you shared card or bank details, contact the financial institution using its official channel. If you installed a file or app, seek trusted device-security assistance and protect sensitive accounts.
If money was sent, contact the payment provider or bank quickly and ask whether the transaction can be stopped or disputed. Preserve messages and receipts, then report the incident to the platform and relevant local authorities. Be wary of “recovery agents” who demand an upfront fee to retrieve stolen money; that may be another scam.
Help others stay safe
Agree on a callback process for urgent money requests. Encourage family members to ask for help without fear of blame. Businesses should require a second approval for bank-detail changes and unusual invoice payments.
Remember the rule
Pause, inspect, verify independently, and only then act. Urgency and emotional pressure are not evidence. Reporting options differ by country and payment provider, so use official channels for your location.