Online scams are deceptive attempts to steal money, account access, or personal information. Scammers may impersonate a bank, government agency, retailer, employer, technical-support representative, friend, or family member. Their messages often create urgency so the target acts before checking the story.
Common types of online scams
- Phishing: fraudulent emails or websites designed to collect passwords or financial information.
- Text-message scams: unexpected texts that contain malicious links, fake delivery notices, account warnings, or payment requests.
- Tech support scams: calls, pop-ups, or messages claiming that a device or account has a serious problem.
- Impersonation scams: someone pretends to be a government official, company, relative, or trusted professional.
- Fake shopping sites: fraudulent stores advertise products that do not exist or collect payment and card details.
- Payment app scams: criminals request money through services such as Zelle, Venmo, or Cash App using a false story.
Phishing
Phishing often imitates a bank, retailer, streaming service, employer, or government agency. The message may say that an account is locked or that a payment requires confirmation. The link leads to a page designed to capture credentials or financial information.
Smishing and text-message scams
Smishing is phishing delivered by text message. Common U.S. examples include fake package notices, unpaid toll alerts, bank-fraud warnings, and messages claiming to come from a company recruiter. A familiar area code does not prove that the sender is local or legitimate.
Vishing and phone scams
Vishing uses a phone call or voice message. Scammers can spoof caller ID and may already know the targetâs name or partial account information. A real bank or agency name on the screen is not enough to verify the caller.
Tech support scams
In a tech support scam, a pop-up or caller claims that a computer or phone is infected and asks for remote access, payment, or account credentials. Legitimate companies do not place unsolicited calls to diagnose a device, and browser pop-ups cannot independently scan an entire computer.
Fake stores and marketplace scams
Fake online shopping scams may copy product photos and branding, offer unrealistic discounts, or demand a payment method with limited buyer protection. On marketplaces, a scammer may move the conversation off-platform, send a fake payment notice, or request a verification code.
Warning signs of a scam
Be cautious when someone demands immediate action, requests payment by gift card, cryptocurrency, wire transfer, or payment app, asks for a password or verification code, or tells you not to contact anyone else. Unexpected prizes, guaranteed returns, unusual account alerts, and requests to move a conversation away from an official platform also deserve scrutiny.
Artificial intelligence can make messages, images, and voices more convincing, but the verification process remains the same. Do not rely only on grammar, appearance, or voice recognition. Verify the claim through a separate channel that you select.
Why urgency and impersonation work
Many scams combine a believable identity with emotional pressure. Fear can make an account warning feel urgent; affection can make a family emergency seem credible; scarcity can make an offer appear temporary. The goal is to interrupt normal verification.
Create a pause before any unusual transfer, disclosure, or account change. Banks and government agencies provide ways to contact them independently. A legitimate family member can answer a question or return a call through a known number.
How security tools can help
A link checker and malware detection can warn about some known phishing sites, malicious downloads, and unsafe apps. Credential monitoring can alert a user when an email address appears in known breach data. These tools reduce risk but cannot determine whether every story, caller, seller, or payment request is genuine.
What to do before responding
Do not use the contact information in the suspicious message. Open the companyâs official app, type its website yourself, or call a number from a statement or payment card. Confirm money requests with the person through a known phone number. Never share a one-time security code.
What to do after a scam
Contact the bank, card issuer, or payment service immediately. Change affected passwords, enable multifactor authentication, review account activity, and save screenshots and transaction details. Report consumer fraud through ReportFraud.ftc.gov. If identity information was exposed, use IdentityTheft.gov for a recovery plan.
The response depends on what happened. If you only received a message, block and report it. If you clicked but entered nothing, close the page, remove unexpected downloads, and monitor the device and accounts. If you entered credentials, change them immediately from a trusted device. If you sent money, contact the provider before the transaction progresses, while understanding that recovery is not guaranteed.
Frequently asked questions
How can I quickly check whether a message is a scam?
Pause and verify the claim through an official channel. A legitimate organization will not object to independent verification.
Can caller ID or a familiar email address be trusted?
Not by itself. Caller ID and sender information can be spoofed, and real accounts can be compromised.
Can security software block every scam?
No. It can identify some malicious links, sites, apps, and files, but social engineering often depends on persuading the user to act.
A relative asked for money from a new number. What should I do?
Do not send money until you confirm the request using a phone number or contact method you already had. Ask a question that an impersonator would not easily answer.
Can a bank ask for a one-time security code?
Do not provide a code to an unexpected caller or message. Contact the bank through its official app or the number on the back of the card.
Can money sent through a payment app be recovered?
Contact the app and linked financial institution immediately. Options depend on how the payment was funded and authorized, and recovery is not guaranteed.
Are AI-generated scams harder to identify?
They can look and sound more convincing. Verify the underlying request rather than judging only the writing, image, or voice.
A step-by-step scam verification process
When a request may be legitimate but something feels wrong, verify it in a fixed order. First, identify what the sender wants: money, credentials, a download, remote access, or an account change. Second, stop using the message itself as evidence. Do not reply, call the displayed number, or follow its link. Third, contact the organization or person through a channel you already trust. Finally, compare the verified information with the original request.
This process is useful even when the message contains correct personal details. Names, addresses, account fragments, and information about relatives can come from public records, social media, prior breaches, or earlier conversations.
Payment methods that deserve extra caution
Gift cards, cryptocurrency, wire transfers, and peer-to-peer payment apps are common in scams because payments can move quickly and may provide limited recovery options. A payment method is not fraudulent by itself. The warning appears when an unexpected person insists on a specific method, creates urgency, or claims that payment is required to prevent arrest, protect an account, receive a prize, or fix a computer.
Government agencies do not demand gift cards or cryptocurrency. A bank should not direct a customer to move money to a separate account controlled through an unsolicited call. A legitimate employer does not send a check and ask a new hire to return part of the money or buy equipment from a designated vendor.
How to report different scams
Report consumer fraud to ReportFraud.ftc.gov. Report internet-enabled crime to the FBI Internet Crime Complaint Center when appropriate. A financial institution or payment provider should receive transaction reports immediately. Platforms should receive reports about fraudulent profiles, ads, stores, and messages so they can investigate the account.
If a scam involved threats or an immediate safety concern, contact local law enforcement. Preserve the sender information, URLs, phone numbers, payment instructions, receipts, and screenshots. Do not continue engaging simply to collect more evidence.
Additional questions about online scams
Is an unexpected refund message legitimate?
Verify it inside the companyâs official account or app. Do not pay a fee or provide remote access to receive a refund.
Can a scammer spoof a real company phone number?
Yes. Caller ID can be manipulated. End the call and contact the company through a verified number.
What if a message knows my full name and address?
Accurate personal details do not prove legitimacy. Verify the request independently and consider whether the information may have come from public sources or a breach.
Should I respond with âSTOPâ to every suspicious text?
Use âSTOPâ for legitimate commercial messages. For an obvious scam, replying may confirm that the number is active; block and report it instead.
Key points to remember: Urgency is a signal to slow down. Verify identities through a channel you choose, never share one-time codes, and match the payment method to the transaction. Fast reporting can improve response options, but no company can guarantee that money sent to a scammer will be recovered.