How to Spot Online Scams and Phishing: Signs and What to Do
How to spot online scams and phishing: the 4 warning signs, real-world examples, how to check a message safely, protect your accounts, and report a scam.
This guide is general information only, not professional financial, legal or technical advice. Menus and rules can vary by device and country.
Most online scams share four warning signs: someone pretends to be from an organization you know, says there's a problem or prize, pressures you to act right now, and asks you to pay in a specific way like gift cards, crypto or a wire transfer. If a message has any of these, stop and check it yourself through a website or phone number you already trust.
Phishing is a type of scam that uses fake emails, texts or websites to trick you into sharing passwords, card numbers or other personal details.
Quick answer
- Be suspicious of any unexpected message asking for money, passwords or personal details.
- Watch for urgency, threats, prizes, and requests to pay by gift card, crypto, wire transfer or payment app.
- Never click links or call numbers in a suspicious message. Contact the company directly.
- Turn on multi-factor authentication and keep your devices updated.
- If you paid or shared details, contact your bank immediately, then report the scam.
This article is general information, not personal financial advice.
The 4 Warning Signs of a Scam
The US Federal Trade Commission (FTC) describes four signs that show up again and again.
| Warning sign | What it looks like |
|---|---|
| They pretend to be someone you trust | A "bank," government agency, delivery company, tech support or even a family member. Caller ID and email names can be faked. |
| There's a problem or a prize | "Your account is locked," "you owe tax," "suspicious login," or "you've won, just pay a small fee." |
| They pressure you to act now | Countdown deadlines, threats of arrest or account closure, "don't hang up," "don't tell anyone." |
| They ask you to pay in a specific way | Gift cards, cryptocurrency, wire transfers, payment apps, or depositing a check and sending money back. |
One sign is enough to slow down.
How to Recognize Phishing Messages
Common phishing clues include:
- A generic greeting like "Dear customer" instead of your name.
- A claim of a problem with your account, a payment or a login.
- An invoice or receipt for something you didn't buy.
- A link to "confirm," "verify" or "update" your payment details.
- An offer of a refund, free gift or government payment you didn't expect.
- A sender address or link that's slightly off from the real company's.
Real companies don't send links asking you to update payment details by email or text. When in doubt, ask yourself: do I even have an account with this company? If not, it's almost certainly phishing.
How to Check a Suspicious Message Safely
- Don't click, reply or call back. Links, attachments and phone numbers inside the message may lead straight to the scammer.
- Pause. Scammers rely on panic. Honest organizations give you time to decide.
- Contact the organization yourself. Type the website address you know, use the official app, or call the number on your card or statement.
- Talk to someone you trust. Explaining the situation to a friend or family member often makes a scam obvious.
- Report and delete it. See the reporting table below.
Common Online Scams to Know
| Scam type | How it works | Red flag |
|---|---|---|
| Bank or account alerts | Fake message about suspicious activity sends you to a look-alike login page | Link asking you to log in or "verify" |
| Delivery scams | Text says a parcel is held and asks for a small fee | Payment request for a delivery you didn't expect |
| Impersonation scams | Caller claims to be from a bank, government or tech support and says your money is at risk | Told to move money, buy gift cards or use a crypto ATM |
| Job and task scams | Unexpected job offer; you "earn" by doing tasks, then must deposit money to withdraw | Paying to get paid |
| Investment and crypto scams | Promises of guaranteed or huge returns, often with fake celebrity endorsements | "Guaranteed profit," pressure to invest fast |
| Romance scams | An online partner you've never met asks for money or offers investment tips | Mixing online dating with money requests |
| Prize and lottery scams | "You've won," but you must pay a fee or tax first | Paying to collect a prize |
| Fake check scams | You're sent a check and asked to send part of it back | Any request to deposit and return money |
If you're looking for ways to earn extra cash, our guide to legitimate ways to make money online covers job and task scams in more detail.
How to Protect Yourself From Scams
- Turn on multi-factor authentication (MFA). A one-time code, authenticator app, security key or fingerprint keeps your account safer even if a scammer gets your password.
- Use strong, unique passwords. Never reuse your email or banking password. See our guide on how to create a strong password.
- Keep software updated. Set your phone, computer and security software to update automatically.
- Back up your data. Regular backups protect you from losing files to malicious software. Learn how to back up your phone.
- Block and filter. Use your phone's call blocking and message filtering features.
- Never pay with gift cards, crypto or wire transfers to someone who contacted you unexpectedly. Only scammers demand payment in cryptocurrency.
- Keep personal details private. Legitimate organizations won't ask for passwords or full card details by phone, email or text.
What to Do if You've Been Scammed
Act quickly to limit the damage.
- Contact your bank or payment provider immediately. Report the fraud and ask whether the payment can be stopped or reversed.
- Change your passwords. Start with your email and any account you think was exposed, and turn on MFA.
- Scan your device. If you clicked a link or opened an attachment, update your security software and run a full scan.
- Protect your identity. If you shared ID or account numbers, follow your country's identity theft guidance. In the US, go to IdentityTheft.gov.
- Report the scam. Reporting helps authorities track scammers and warn others.
- Watch out for "recovery" scams. Fraudsters often contact victims offering to get money back for a fee. The FBI's IC3 says it doesn't contact people asking for money and doesn't work with private recovery services.
Where to report scams
| Country | Where to report |
|---|---|
| United States | ReportFraud.ftc.gov (FTC); online crime to the FBI's Internet Crime Complaint Center (ic3.gov) |
| US phishing emails and texts | Forward emails to reportphishing@apwg.org; forward texts to 7726 (SPAM) |
| England, Wales and Northern Ireland | Report Fraud (reportfraud.police.uk), which replaced Action Fraud, or call 0300 123 2040 |
| Scotland | Police Scotland on 101 |
| UK suspicious emails and texts | Forward emails to report@phishing.gov.uk; forward texts to 7726 |
If anyone is in immediate danger, call your local emergency number.
Common Mistakes
- Trusting caller ID or a familiar logo. Both are easy to fake.
- Clicking "just to check." Links in scam messages can lead to fake login pages or harmful downloads.
- Feeling too embarrassed to report. Scams fool careful people every day.
- Paying a fee to claim a prize. Real prizes don't require you to pay first.
- Believing your money is "at risk." Real banks and agencies don't contact you out of the blue to ask you to move money or buy crypto to keep it safe.
Frequently Asked Questions
What is the most common sign of a scam?
Pressure to act immediately, combined with a request to pay in an unusual way, is one of the clearest signs. Real organizations give you time and don't demand gift cards or crypto.
How can I tell if an email is phishing?
Look for a generic greeting, an urgent problem, and a link to verify or update details. Instead of clicking, go to the company's website or app yourself and check your account there.
What should I do if I clicked a phishing link?
Don't enter any information. If you already did, change that password right away and turn on MFA. Update your security software, run a scan, and contact your bank if you shared financial details.
Can I get my money back after a scam?
Sometimes, especially if you contact your bank or payment provider quickly. Payments by gift card, crypto or wire transfer can be very hard to recover, which is why scammers prefer them.
Is it a scam if someone asks me to pay in cryptocurrency?
If they contacted you unexpectedly, almost certainly yes. Legitimate businesses and government agencies don't demand crypto payment upfront.