How to Spot an Online Scam Before It Costs You Money

Online scams are no longer always easy to recognise. A fraudulent email may appear to come from your bank, a message may seem to have been sent by someone you know, and a fake website can look almost identical to the genuine one.

Scammers may also use information from social media, artificial intelligence and sophisticated technology to make their stories more believable. However, most scams still rely on familiar tactics: surprise, fear, urgency, trust and the promise of a reward.

Learning to recognise these tactics—and pausing before you respond—can prevent an unexpected message from becoming an expensive mistake.

Anyone can be caught by a convincing scam

Falling for a scam is not a sign of foolishness or carelessness. Fraudsters deliberately create situations in which people feel rushed, frightened, helpful, curious or excited.

A scam may arrive when you are busy, tired or distracted. It may refer to a genuine delivery you are expecting, imitate a company you use or appear to come from a relative experiencing an emergency.

Treating every unexpected contact with suspicion is unrealistic. A better defence is to develop a simple habit: pause whenever a message asks you to provide information, transfer money, download something or act urgently.

Be suspicious of pressure and urgency

Scammers frequently claim that something must happen immediately. You may be told that:

• Your account is about to be suspended.
• Money is being taken from your bank.
• You owe an overdue payment or fine.
• A relative needs emergency assistance.
• A special offer is about to expire.
• An investment opportunity is available for a limited time.
• You must act now to protect your money.

Urgency is intended to prevent you from thinking clearly, checking the story or asking somebody else for advice.

A legitimate organisation should allow you to end the conversation and verify what you have been told. If someone objects to you doing that, treat it as a serious warning sign.

Do not trust appearances alone

A familiar logo, professional website or official-looking document does not prove that a message is genuine. These elements can be copied easily.

Telephone numbers and caller identification can also be manipulated. A call may appear to come from a local number, your bank or another trusted organisation when it originated somewhere entirely different.

Look carefully at email addresses and website domains, but do not depend on finding spelling mistakes. Modern fraudulent messages can be polished, personalised and grammatically correct.

The safest approach is independent verification, even when everything appears convincing.

Verify the story using a separate route

Do not use a telephone number, email address or link supplied in the suspicious message.

Instead:

• Open the organisation’s official app or type its known website address yourself.
• Use the telephone number printed on your bank card, statement or other trusted document.
• Contact a friend or relative through a number you already have.
• Ask the organisation whether the message, payment request or account problem is genuine.
• Search independently for the company rather than following an advert or sponsored result.

If someone claims to be a relative in trouble, ask a question that a stranger would be unlikely to answer. With convincing voice imitation now possible, recognising the voice alone may not be sufficient.

Some families choose a private word or phrase to use when verifying genuine emergencies.

Protect passwords and security codes

A genuine bank or reputable organisation should not contact you unexpectedly and ask for your complete password, banking PIN or one-time security code.

These codes may be described as verification numbers, passcodes or one-time passwords. Their purpose is often to authorise access, a payment or a change to your account. Giving one to another person may allow them to complete the very transaction they claim to be preventing.

Never approve a login request or payment notification you did not initiate. If an unexpected code arrives, do not share it—contact the organisation independently.

Watch how you are being asked to pay

The requested payment method can reveal a scam.

Be particularly cautious if someone insists on payment through:

• Gift cards
• Cryptocurrency
• Bank or wire transfers
• Payment apps
• Cash sent by courier
• Money-transfer services
• Access to your computer or online banking

Scammers favour methods that can be difficult to trace, cancel or recover. No legitimate government department, police service or reputable business should require gift cards as payment. The US Federal Trade Commission describes an unexpected demand for payment by gift card as a clear scam warning. FTC

Never transfer money to a supposedly “safe” account. A bank will not need you to move your money elsewhere to protect it.

Be careful with links and attachments

A fraudulent message may ask you to follow a link to confirm a delivery, receive a refund, prevent an account closure or view an important document.

The link may lead to a convincing imitation of a genuine website designed to collect your password, payment information or other personal details. An attachment may install harmful software.

If you receive an unexpected message:

• Do not follow its link.
• Do not open an unfamiliar attachment.
• Do not call a telephone number shown in it.
• Visit the organisation through its official website or app instead.
• Delete the message once you have confirmed it is fraudulent.

Be cautious even if the message appears in an existing conversation. An account belonging to somebody you know may have been compromised.

Question offers that seem too good to be true

Unexpected prizes, guaranteed investment returns and unusually cheap products are common ways to attract attention.

Ask yourself:

• Did I enter this competition?
• Why was I selected?
• Is the price realistic?
• Am I being asked to pay before receiving a prize?
• Are investment returns described as guaranteed or risk-free?
• Is a stranger encouraging me to move the conversation away from a regulated platform?
• Can I verify the company through an official register or regulator?

Fake reviews, celebrity endorsements and news articles can all be manufactured. Do not invest or make a substantial purchase solely because an advert, influencer or online contact appears convincing.

Common scams to recognise

The details change, but many online scams follow familiar patterns:

Bank and government impersonation

Someone claims that your account, tax, benefit, identity or legal status is at risk and demands information or payment.

Delivery and shopping scams

A message claims that a parcel is awaiting a small fee, or an online shop offers goods that do not exist.

Family emergency scams

Someone impersonates a child, grandchild or friend who supposedly needs money urgently and cannot speak normally.

Romance and friendship scams

A person develops an online relationship before requesting money, gifts, travel expenses or help with an emergency.

Investment scams

An apparently knowledgeable contact promises unusually high or guaranteed returns, often involving cryptocurrency.

Technical-support scams

A caller or pop-up claims that your computer has a problem and asks for remote access, payment or banking details.

Refund and purchase scams

A message describes an expensive purchase you did not make and tells you to telephone a number for a refund. The number connects to the scammers.

The Australian government’s Scamwatch service identifies unexpected contact, urgency and mismatched sender details as common phishing warning signs. Scamwatch

Build simple protective habits

A few routine precautions can limit the harm a scammer can cause:

• Use a different strong password for every important account.
• Store passwords in a reputable password manager.
• Enable two-step or multi-factor authentication where available.
• Keep your phone, computer, browser and applications updated.
• Review bank and card transactions regularly.
• Limit publicly visible personal information on social media.
• Set account alerts for payments and security changes.
• Discuss suspicious contact with someone you trust before acting.
• Use official apps or saved bookmarks for banking and important services.

These measures cannot prevent every fraudulent approach, but they can make accounts harder to access and help you notice suspicious activity sooner.

What to do if you have responded to a scam

Act quickly, but do not panic.

• Contact your bank, card issuer or payment provider immediately.
• Explain exactly what happened and ask whether the transaction can be stopped or recovered.
• Change any password you disclosed, starting with your email account.
• Change the same password anywhere else you reused it.
• Contact the relevant gift-card, money-transfer or cryptocurrency provider.
• Disconnect a device from the internet if you allowed remote access.
• Ask a trusted technician or appropriate support service to inspect the device.
• Report the incident to the relevant fraud or law-enforcement service in your country.
• Keep messages, receipts, account details and screenshots as evidence.
• Monitor your accounts and credit information for further activity.

If identification details were exposed, seek advice from the appropriate identity-protection or credit-reporting services in your country.

Be alert for recovery scams afterwards. A second fraudster may claim they can retrieve your money in return for an advance fee.

Do not let embarrassment stop you seeking help

Scammers depend on secrecy and shame. They may tell you not to contact your bank, family or police, or persuade you that admitting what happened will make matters worse.

Report the incident even if no money was lost. Your information may help an organisation block an account, remove a fraudulent website or protect another person.

If a friend or relative has been scammed, remain calm and supportive. Criticism may make them reluctant to disclose important information or ask for further assistance.