The Complete Guide to Online Scams: How to Identify, Avoid and Report Them
How online scams work, the most common types, the warning signs to check, what to do if you are scammed, and where to report it in your country.
A text arrives while you are in a queue: "You have received 850.00 from J. Daniels." A minute later a stranger calls, close to tears, saying they sent the money to your number by mistake and begging you to send it back. You check the text again. It looks exactly like the real thing. What do you do?
That moment is what this guide is about. Online scams rarely rely on clever technology. They rely on a believable story, a little pressure and a request that feels reasonable in the moment. Once you understand how they are built, you can recognise one you have never seen before, whether it arrives by SMS, WhatsApp, email, social media or a phone call.
This guide explains what online scams are, how they work, the types you are most likely to meet, the warning signs worth checking, how to verify something before you act, and exactly what to do and who to contact if you have already been caught. The examples come from many countries, because the same tricks travel: a mobile money reversal in Africa, a fake parcel text in Europe, a bank impersonation call in North America, a payment app "accident" in Asia. The advice applies wherever you are.
What counts as an online scam?
An online scam is any attempt to trick you, using digital channels, into giving away money, access or information you would not give if you knew the truth. The key word is trick. In most scams you are persuaded to act yourself: you make the transfer, type the password or share the code.
A few related terms are worth separating, because they need different responses:
- Scam or fraud: deception for financial gain. The broadest term, and the one this guide uses.
- Phishing: a scam message, usually email or SMS, designed to make you click a link, open a file or enter details on a fake page. Phishing is one delivery method for scams. Our guide on how to spot a phishing email covers it in depth.
- Hacking: getting into a system or account without permission. Scams are often the first step, because it is easier to trick a person into handing over a password than to break a system.
- Identity theft: using your personal details to impersonate you, for example to open accounts or take over your phone number.
How online scams work
Scams vary endlessly on the surface, but most follow the same four stages.
- Contact. The scammer reaches you by text, call, email, social media, a dating app, an online marketplace or an advert. Often you are one of thousands receiving the same message.
- The hook. A story that gives you a reason to engage: a problem with your account, money sent by mistake, a prize, a job, a bargain, a relationship or a relative in trouble.
- Pressure. A reason to act now and not check: a deadline, a threat, an emotional appeal or a request for secrecy.
- The ask. Money, a one-time code, a PIN, a password, a payment approval, remote access to your device, or personal details that can be used later.
Underneath the story, scammers pull a small set of psychological levers: authority, urgency, fear, helpfulness, curiosity and the hope of reward. We explain each one, with the question to ask yourself, in the six levers attackers pull on people. When you notice two or three of them in one message, slow down.
The one rule that defeats most scams: when a message asks you to act, confirm it through a channel you choose, not the one the message came from. Call the number you already have, open the official app, or ask the person face to face.
The most common types of online scams
New variations appear constantly, but these categories account for most of what people encounter.
Impersonation scams
The scammer pretends to be someone you trust: your bank, your mobile network, a courier, a government agency, the police, your employer or a family member. Common versions include "your account will be blocked", "your parcel is held for a fee" and the "Hi Mum, this is my new number" message. Some callers claim to be from IT support and ask to install software on your computer; see fake IT support calls.
Mobile money reversal and payment tricks
A fake deposit message, or a real payment app transfer that later bounces, is followed by a request to send the money back. Other versions include callers posing as network staff who ask you to approve a prompt or dial a code, which actually authorises a withdrawal. These are covered in detail in mobile money scams.
Phishing links and fake websites
A message leads to a page that copies a bank, a delivery company, a social network or your email provider, and asks you to sign in or pay a small fee. The page collects whatever you type. Learn to check a site in how to check if a website is fake, and watch for the text message version described in smishing.
Online shopping and marketplace scams
Goods that never arrive, sellers who insist on payment outside the platform, fake shops with prices that are too good to be true, and buyers who "overpay" and ask for the difference back. Paying by a method you cannot reverse is what makes these costly.
Investment and cryptocurrency scams
Promises of guaranteed or unusually high returns, trading bots, "exclusive" signals, or a new online friend who introduces you to a platform where your balance appears to grow until you try to withdraw. Read AI investment scams and AI crypto trading scams.
Job and task scams
An offer for work you did not apply for, a remote role with high pay, or paid "tasks" such as liking videos, which later require you to deposit money to continue. A genuine employer never asks you to pay to get a job. See fake job offers.
Romance scams
A relationship built over weeks or months online, often with someone who is always abroad and can never meet or video call properly. Eventually there is an emergency, a customs fee or an investment opportunity that needs your money.
Prize, lottery and inheritance scams
You have won a promotion you never entered, or you are named in an inheritance, and a fee is needed to release it. Real prizes do not require you to pay first.
AI-assisted scams
Artificial intelligence makes scam messages more fluent and makes it possible to imitate a voice or face. A call that sounds exactly like a relative or a manager can still be fake; see deepfake voice calls. The defence is the same as always: verify through a channel you choose.
Warning signs: a checklist
No single sign proves a scam, and a real message can contain one of these. The more of them you see together, the more careful you should be.
| Warning sign | What it looks like | Why it matters |
|---|---|---|
| Unexpected contact | A message, call or friend request you did not expect, often from an unknown number | Scammers start conversations; genuine problems are usually visible when you log in yourself |
| Urgency or threats | "Within 24 hours", "your account will be closed", "you will be arrested" | Pressure is designed to stop you checking |
| Secrecy | "Don't tell anyone", "keep this confidential" | A scam survives only until someone else looks at it |
| Requests for codes or PINs | "Read me the code we just sent you" | One-time codes and PINs are the keys to your accounts; no genuine organization asks for them |
| Unusual payment methods | Gift cards, cryptocurrency, transfers to a personal account or number | These are fast and hard to reverse |
| Too good to be true | Guaranteed returns, big discounts, prizes you never entered | The reward is the bait |
| Links that don't match | A bank's name with a strange web address, shortened links | The address, not the logo, tells you where a link really goes |
| A new number for someone you know | "Hi, it's me, I lost my phone" | Impersonation of family and friends is common and effective |
| Moving you off the platform | "Let's continue on WhatsApp", "pay me directly, not through the app" | Platforms have protections that scammers want you to leave behind |
Illustrative examples, with the red flags explained
These examples are fictional and written for this guide. The web addresses have been deliberately broken so they cannot be clicked.
- The "deposit" arrived as an ordinary text that anyone can type, not through your provider's official channel.
- A stranger calls immediately with an emotional story.
- What to do: check your real balance through the official menu or app. If money truly arrived by mistake, the sender can ask the provider to reverse it; you should not send anything yourself.
hxxps://parcel-redelivery-center[.]com/pay- A small fee lowers your guard, but the page collects full card or wallet details.
- The address is not the courier's official website, and there is a deadline.
- What to do: if you are expecting a parcel, check its status on the courier's own app or website using your tracking number.
- You did not apply, and there was no real interview.
- Unusually high pay for simple work.
- A fee to secure the job. A genuine employer does not charge applicants.
How to check if something is a scam
When a message makes you hesitate, work through these steps before you reply, click or pay.
- Pause. Put the phone down for a minute. Urgency is part of the trick, and very few genuine situations cannot wait for a quick check.
- Verify through your own channel. Open the official app, type the website address yourself, or call a number from the back of your card, a bill or a previous contract. Never use the contact details in the suspicious message.
- Check the link without opening it. Press and hold (on a phone) or hover (on a computer) to see the full address. Look at the part just before the first single slash: is it exactly the organization's real domain?
- For "new numbers" from people you know, call their old number or ask a question only they could answer.
- Search independently. Search the company name, phone number or the exact wording of the message together with the word "scam". For online profiles, a reverse image search can reveal photos taken from someone else.
- Ask someone. Show the message to a friend, colleague or family member. Scams rarely survive a second pair of eyes.
Get a second opinion in seconds. Paste the message or link, or upload a screenshot, into CyberWatch AI Scan. It is free, works in any language and explains what looks suspicious and what to do next. Use it alongside the checks above, especially before sending money.
How to protect yourself from online scams
Protect your accounts
- Turn on two-step verification for email, banking, mobile money and social media. Use an authenticator app where you can.
- Use a different password for every important account, ideally a long passphrase kept in a password manager. See passwords you will remember and attackers won't guess.
- Never share a one-time code, PIN or password with anyone, including people who say they work for your bank, network or employer.
Protect your money
- Check balances and payment requests in the official app, never from a text message.
- Read every payment prompt before you approve it. If it asks you to pay, it is a payment, whatever the caller calls it.
- When buying online, prefer payment methods that offer protection, and stay on the platform until the transaction is complete.
- Be very wary of anyone who asks for gift cards, cryptocurrency or transfers to a personal number.
Protect your phone number and identity
- Share your date of birth, address and ID numbers only when necessary.
- If your phone suddenly loses service without explanation, contact your network from another phone. It can be a sign of a SIM swap.
Protect your devices
- Keep your phone, computer and apps updated, and install apps only from official stores.
- Never install remote access software because a caller asked you to.
What to do if you have been scammed
Being scammed is not a sign of foolishness. These schemes are designed by people who do this every day. What matters now is acting quickly, in roughly this order.
- Stop all contact with the scammer. Do not send more money, even if they promise a refund or threaten you.
- Call your bank or mobile money provider immediately using the official number. Ask them to stop or reverse the transaction and to secure your account. Speed matters: money that has moved on is much harder to recover, and recovery is never guaranteed.
- Secure your accounts. If you shared a password, change it from a trusted device, starting with your email. If you shared a code or approved a sign-in, tell the provider and check for new devices or changed details.
- Protect your device. If you installed software at a scammer's request, disconnect from the internet and get help removing it before using the device for banking.
- Keep the evidence. Take screenshots of messages, profiles, phone numbers, web addresses and transaction references before anything is deleted.
- Report it to the authorities and to the platform where the scam happened. The next section lists where.
- Watch for follow-up scams. Victims are often contacted by people offering to recover their money for a fee. This is almost always a second scam.
If the scam involved a work account, device or payment, tell your employer's IT or security team straight away. Our step-by-step guide clicked a phishing link at work? covers that situation.
How and where to report online scams
Reporting helps authorities spot patterns, warn others and, in some cases, act against the people responsible. Keep your evidence ready when you report.
| Where you are | Where to report |
|---|---|
| Anywhere | Start with your bank, card issuer or payment provider on its official number, and use the report tools in the app or platform where the scam happened. Report phishing websites to Google Safe Browsing. If your country is not listed here, your national police cybercrime unit is the place to start. |
| Australia | Scamwatch at scamwatch.gov.au, and ReportCyber at cyber.gov.au if you have lost money or data. |
| Canada | Canadian Anti-Fraud Centre: 1-888-495-8501 or antifraudcentre.ca. |
| European Union | Each country has its own reporting service. Europol lists them on its "Report cybercrime online" page. |
| Ghana | Cyber Security Authority: call or text 292, WhatsApp 0501603111, email report@csa.gov.gh. Ghana Police Service helpline 18555 or 191. |
| India | National cybercrime helpline 1930, especially for financial fraud, and the National Cybercrime Reporting Portal at cybercrime.gov.in. |
| United Kingdom | England, Wales and Northern Ireland: Report Fraud at reportfraud.police.uk or 0300 123 2040. Scotland: Police Scotland on 101. Forward scam emails to report@phishing.gov.uk and scam texts to 7726. |
| United States | Federal Trade Commission at reportfraud.ftc.gov, and the FBI's Internet Crime Complaint Center at ic3.gov. |
Contact details change from time to time. If a number does not work, check the organization's official website for the current one.
Common mistakes and myths
- "Only older people fall for scams." Anyone can be caught when a message arrives at the wrong moment. Different scams target different groups, including students, job seekers and busy professionals.
- "The caller knew my details, so it must be real." Personal details leak widely. Knowing your name or account type proves nothing.
- "The padlock means the website is safe." It only means the connection is encrypted. Scam sites use padlocks too.
- "My bank will always refund me." Policies vary, and payments you authorised yourself may not be refunded. Prevention is far more reliable than recovery.
- "I'll just reply STOP." Replying confirms your number is active. Block and report instead.
- "I'm too embarrassed to report it." Reporting quickly gives you the best chance of limiting the damage, and it protects other people.
Online scams at work
The same tricks target organizations, usually through staff who handle payments, passwords and customer data. Fake supplier bank details, urgent payment requests from "the CEO" and fake IT calls can cost far more than a personal scam. If you are responsible for a team, start with business email compromise and a cyber security checklist for small and growing businesses. CyberWatch AI also helps organizations train staff with realistic practice attacks and measure how well they spot and report scams.
Frequently asked questions
How can I tell if a message is a scam?
Look for the combination of an unexpected contact, pressure to act quickly, a request for money, codes or personal details, and a reason not to check with anyone. Then verify through a channel you choose yourself, such as the official app or a phone number you already have. If the message fails that check, treat it as a scam.
What are the most common online scams right now?
Phishing messages that lead to fake login pages, impersonation of banks, mobile networks and family members, mobile money reversal tricks, fake online shops, investment and crypto schemes, fake job offers and romance scams are among the most widely reported types. The channel changes often; the underlying tricks change far less.
Can I get my money back after a scam?
Sometimes, but not always. Your best chance is to contact your bank or mobile money provider immediately, because transfers are much harder to stop once the money has moved on. Card payments may be disputed with your bank. Anyone who promises to recover your money for a fee is very likely running a second scam.
Where should I report an online scam?
Start with your bank or payment provider if money was involved, then your national reporting service. Examples include the FTC in the US, Report Fraud in England, Wales and Northern Ireland, the Canadian Anti-Fraud Centre, Scamwatch in Australia, the 1930 helpline in India and the Cyber Security Authority on 292 in Ghana. Europol lists the reporting services for each EU country.
Is it safe to reply STOP or tell the scammer I know it is a scam?
It is better not to reply at all. Any reply confirms that the number or address is active and read by a real person, which can lead to more scam attempts. Block the sender, report the message and delete it.
The caller knew my name and details. Does that mean it is genuine?
No. Names, phone numbers, addresses and even account types are often available from data leaks, social media and earlier scams. Knowing some of your details is a common way to make a scam sound official. Hang up and call the organization back on a number you already have.
Does the padlock icon mean a website is safe?
No. The padlock only means the connection between your browser and the site is encrypted. Scam websites can and do use padlocks. Check the exact web address instead, and reach important sites by typing the address yourself or using the official app.
What should I do if I only clicked a link but entered nothing?
Close the page and do not enter anything. The risk is lower than if you had entered details, but it is still worth running your device's security updates, watching for unusual activity and reporting the message, especially if it came to a work account.
Why do scammers ask for gift cards, crypto or mobile money?
These payments are fast and hard to reverse, and some are hard to trace. Genuine organizations and government agencies do not ask you to pay fines, fees or taxes with gift cards or cryptocurrency. A request to pay that way is one of the clearest warning signs there is.
How can CyberWatch AI help me check a suspicious message?
You can paste a link or message, or upload a screenshot, into CyberWatch AI Scan for free. It explains what looks suspicious and what to do next. It is a second opinion to support your judgement, not a guarantee, so still verify anything involving money through an official channel.
Sources
- How To Avoid a Scam, US Federal Trade Commission
- What To Do if You Were Scammed, US Federal Trade Commission
- Report fraud to the FTC, US Federal Trade Commission
- Internet Crime Complaint Center (IC3), Federal Bureau of Investigation
- Phishing: Spot and report scam emails, texts, websites and calls, UK National Cyber Security Centre
- Reporting a scam email, UK National Cyber Security Centre
- Report Fraud service goes live, City of London Police
- Recognize and report phishing, US Cybersecurity and Infrastructure Security Agency
- Cyber Security Authority incident reporting channels, Cyber Security Authority, Ghana (official account)
- Cyber Crime, Ghana Police Service
- Report a phishing page, Google Safe Browsing
- Report fraud and cybercrime, Canadian Anti-Fraud Centre
- Report a scam, Scamwatch, Australian Competition and Consumer Commission
- National Cybercrime Reporting Portal, Ministry of Home Affairs, India
- Report cybercrime online, Europol
