Cybersecurity
How to Recognize Online Scams
Online scams take many forms — fake shops, fake investments, fake jobs, fake romances, fake refunds — but they share the same warning signs. Learn the five signs that appear in almost every scam, the common stories to recognise instantly, and the quick checks that protect you and your family.
Note. Every scam in this guide uses the same recipe: an unexpected contact, a story that creates urgency or desire, a request that bypasses normal checks, and a payment method that cannot be reversed. Learn the recipe and you can spot the scam whatever story it wears.
The five warning signs in every scam
First, unexpected contact. A message, email, call or friend request from someone you do not know, about an opportunity, a problem or a prize you did not seek. Scams begin with contact you did not invite, because that is how criminals find victims. Second, urgency or excitement: the offer ends today, the account will close, the price will rise, the prize must be claimed now. Urgency is a tool to make you act before you think.
Third, a request that bypasses normal channels: pay by gift card, cryptocurrency, wire transfer or a payment app; share a code; log in through a link; or download an app from outside the official store. Legitimate businesses accept normal payment methods and do not ask you to pay in a way that cannot be traced or reversed. Fourth, secrecy: do not tell your family, keep this between us, the opportunity is exclusive. Secrecy stops you getting a second opinion, which is exactly what the scammer wants.
Fifth, something that is too good — or too bad — to be true. A huge return with no risk, a job with high pay and no experience, a luxury item at a fraction of its price, or a frightening problem that only this person can fix. Both extremes are designed to override judgment, in opposite directions.
- Unexpected contact about an opportunity, problem or prize.
- Urgency: act now, or lose it.
- Payment by gift card, crypto, wire transfer or payment app.
- Secrecy: do not tell anyone.
- Too good — or too frightening — to be true.
The most common scam stories
The fake shop sells a product at an impossible price — a designer item, a popular gadget, a car — and takes payment for goods that never arrive, or sends a counterfeit. The fake investment promises guaranteed returns and shows fake profits, until the victim tries to withdraw. The fake job offers easy money for little work, then asks for a fee, a training payment, or bank details to set up pay.
The romance scam builds a relationship over weeks or months, then invents a crisis — a medical emergency, a blocked account, a travel problem — that only your money can solve. The refund scam claims you are owed money and asks for your card details or a code to release it. The tech support scam claims your computer is infected and offers to fix it, in exchange for remote access and a fee. The government scam claims you owe tax, a fine or a benefits repayment, and threatens arrest unless you pay immediately.
Different stories, same recipe. The moment you recognise the pattern — unexpected contact, urgency, unusual payment, secrecy — you can stop the story, whatever its details.
Quick checks before you pay, click or share
Check one: search the name, the website and the offer separately — add the word scam or review — and read independent results, not the site's own testimonials. Check two: look for the company on your regulator's register or warning list. In the UK, the Financial Conduct Authority publishes warnings about unauthorised firms; most countries have an equivalent.
Check three: look at the payment method. Gift cards, cryptocurrency, wire transfers and payment apps are the scammer's choices because the money cannot be recovered. A legitimate seller accepts cards, which have dispute protections. Check four: verify through a separate channel. If a company contacts you, find its real number on its official website and call it. If a friend messages you asking for money, call them on a number you already have — their account may have been taken over.
Check five: talk to someone you trust before you act. Scammers isolate victims deliberately; a second opinion breaks the spell. And if you have already paid or shared details, stop immediately — no fee will release your money, no further payment will recover it — and report it to your bank and to the official fraud reporting channel in your country.
Fake websites and fake shops
A fake shop often looks entirely convincing: professional photos, copied branding, customer reviews, and a working checkout. The clues are in the details. The price is far below every other seller. The website was registered very recently — you can check the domain's age with a domain lookup tool. Contact details are a web form only, with no address or phone number. The reviews are all short, all recent, and all five stars. The payment page offers only unusual methods, or the site's security certificate belongs to a different name.
Before buying from an unfamiliar site, search for the shop's name with the word review or scam, check how long the domain has existed, and pay by card so you have dispute protection. If the site is offering a well-known brand at a price that makes no sense, it makes no sense — because the seller is not selling the real product. The safest choice with an unknown shop is the smallest possible test order, or no order at all.
- Price far below every other seller — the classic sign.
- Domain registered very recently, with no history.
- No address, no real phone number, web form only.
- Reviews all short, all recent, all five stars.
- Payment by unusual methods, or certificate in a different name.
If you have been scammed
Stop sending money immediately, and do not accept offers to recover it for a fee — recovery scams target people who have already been scammed. Contact your bank or card provider and explain what happened: ask about the dispute process, about blocking the card, and about what can be done. For card payments, act within days, because the dispute window matters.
Report it: in the United States, the FBI Internet Crime Complaint Center at ic3.gov and the Federal Trade Commission at ReportFraud.ftc.gov. In the United Kingdom, Action Fraud, and forward phishing emails to report@phishing.gov.uk. Keep every message, email, receipt and transaction record — investigators need the details, and your bank needs a timeline.
Then protect yourself from the follow-up. The same criminals may contact you again, pretending to be the police, a recovery firm, or the original company, offering to get your money back for a fee. That is a second scam. And change any passwords or details you shared during the scam, turn on two-factor authentication on your email and banking, and tell the people around you — the warning protects them, and it protects you from shame, which is the scammer's last hold over a victim.
Protecting your family
Talk about scams with the people you care about — children, older relatives, colleagues — before they happen. Agree on a simple family rule: no one sends money, gift cards or codes because a message, email or call told them to, and any request for money is checked with another family member first. Share the warning signs, not just the stories: the stories change constantly, but the five signs stay the same.
For older relatives in particular, agree on a code word — a word only the family knows — for any genuine emergency request for money, because voice-clone scams can now imitate a grandchild's voice. And for children, teach the matching rule: never share personal details or photos with people you met online, and always tell an adult about an uncomfortable message. The scams will keep evolving. The habits that stop them do not need to.
Sources
- Federal Trade Commission — How to avoid a scam — last checked 14 November 2026.
- FBI Internet Crime Complaint Center — IC3 — last checked 14 November 2026.
- National Cyber Security Centre (UK) — Scam guidance — last checked 14 November 2026.
Last checked: 14 November 2026.
Frequently asked questions
What are the most common signs of an online scam?
Unexpected contact, urgency, a request to pay by gift card, cryptocurrency, wire transfer or a payment app, secrecy, and an offer that is too good — or a problem that is too frightening — to be true. Those five signs appear in almost every online scam, whatever story it uses.
How can I check if a website is a scam?
Search the shop's name with the words review or scam, check the domain's age, look for a real address and phone number, and read independent reviews. Pay by card for dispute protection, and be suspicious of prices far below every other seller.
What should I do if I already paid a scammer?
Stop sending money immediately. Contact your bank or card provider and ask about the dispute process. Report it to the official fraud channel in your country, and keep every message, receipt and transaction record.
Are gift cards really a scam payment method?
Gift cards are a legitimate product, but no legitimate business asks to be paid in gift cards. If someone asks you to buy gift cards and send the codes — for a bill, a fine, a prize or a relative in trouble — it is a scam.
What is a recovery scam?
A recovery scam targets someone who has already been scammed, offering to get their money back for a fee. No further payment will recover stolen money. Report the original scam, and report the recovery offer too.