The Four Stages of Every Scam
Almost every scam follows the same four stages: contact, hook, pressure and ask. How each stage works, with examples, and the simple move that breaks the chain at each one.
Scams come in thousands of disguises: parcels, prizes, bank alerts, job offers, romances, investments, family emergencies. It can feel impossible to keep up. The good news is that underneath the disguise, almost every scam follows the same four stages. Learn the stages, and you can recognise a scam you have never seen before.
Stage 1: Contact
The scammer reaches you, or gets you to reach them. Common routes include text messages, emails, WhatsApp, social media messages and comments, phone calls, online adverts and search results, and marketplace listings.
What to notice: the contact is unexpected, or it tries to move you off an official channel ("Let us continue on WhatsApp", "Call this direct number").
How to break it: treat unexpected contact as unverified until you have checked it yourself. Do not use the links or numbers in the message.
Stage 2: Hook
The hook is the story that makes the rest seem reasonable. It usually plays on one strong feeling:
- Fear: "Your account has been compromised." "There is a warrant for your arrest."
- Hope or greed: "You have won." "Guaranteed 30% monthly returns."
- Helpfulness: "I sent money to your number by mistake."
- Love or loyalty: "Mum, I lost my phone, this is my new number."
- Authority: "This is the fraud department." "The CEO needs this done today."
The hook often includes real details, such as your name, your bank or a recent purchase, taken from data leaks or social media, to make it believable.
How to break it: ask, "If this were real, how would I normally find out?" Then find out that way.
Stage 3: Pressure
Pressure is what stops you checking. It is the most reliable warning sign of all.
- Urgency: "within 24 hours", "before your account is closed", "the offer ends today".
- Secrecy: "Do not tell the bank staff, they may be involved." "Keep this between us."
- Isolation: staying on the line, discouraging you from talking to family.
- Escalation: threats, guilt or flattery when you hesitate.
How to break it: give yourself permission to pause. A genuine organization will still be there in an hour. Hang up, close the chat, and talk to someone you trust.
If someone tells you not to tell your bank, your family or the police, that is the scam talking. Legitimate organizations never ask for secrecy from the people who could protect you.
Stage 4: Ask
Finally comes the request that the whole story was built around:
- A payment, often by a method that is hard to reverse, such as a bank transfer, mobile money, gift cards or crypto. Our guide on why scammers ask for gift cards and crypto explains why.
- A one-time code, PIN or password.
- Personal details or ID documents.
- Installing an app or allowing remote access.
- Approving a sign-in or payment prompt.
How to break it: have firm rules. Never share codes. Never move money because of a message or call you did not expect. Never install software at a stranger's request.
All four stages in one example
- Caller ID can be faked, so the bank's name on screen proves nothing.
- A real bank never asks you to read out a code or to move money to "protect" it.
- What to do: hang up and call the number on the back of your card, ideally from another phone.
Why knowing the stages helps
You do not need to memorise every scam. You only need to notice the pattern: an unexpected contact, a strong emotion, pressure to act now, and a request for money, codes or access. When all four appear together, it is almost certainly a scam, whatever the story.
It also explains why intelligent people are caught: the stages are designed to work on normal human reactions. Our guide on the six levers attackers pull on people goes deeper into the psychology.
Spot something that feels off? Paste it into CyberWatch AI Scan for a free second opinion before you respond.
For warning signs, the most common scams today and what to do if you have been caught, read the complete guide to online scams.
Frequently asked questions
What is the most important stage to spot?
Pressure. Almost every scam needs you to act before you can think or check. Whenever a message makes you feel you must act right now, slow down.
Do all scams follow these stages?
Nearly all do, though the timescale varies. A fake bank call may pass through all four stages in five minutes. A romance or investment scam may take months to reach the ask.
What single habit breaks most scams?
Checking independently. Contact the organization or person through details you find yourself, not those in the message. It breaks the chain at any stage.
Sources
- How To Avoid a Scam, US Federal Trade Commission
- ScamSmart, UK Financial Conduct Authority
- Phishing: spot and report scam emails, texts, websites and calls, UK National Cyber Security Centre
