How do I spot a scam?
The patterns behind almost every scam — urgency, unusual payment methods, and unsolicited contact — and what to do if you've been caught.
- Difficulty
- beginner
- Time
- 20 min
- Read
- 3 min
- Safety
- caution
Short answer
Almost every scam involves at least one of: unexpected contact, artificial urgency, a request to move money or share a code, or an unusual payment method. If any of those are present, stop and verify independently — hang up and call the organisation on a number you looked up yourself.
Scams vary in story but not in structure. They need you to act quickly, without checking, and through a channel they control. Recognising that structure is far more useful than memorising the current crop of specific scams, because the stories change constantly and the structure doesn't.
Safety
Step by step
- Treat any unexpected contact as unverified, whoever it appears to be from.Caller ID, sender addresses and text sender names are all easily faked.
- Notice urgency, and treat it as a warning rather than a reason to hurry.'Your account will be closed', 'act within the hour'. Urgency exists to prevent you checking.
- Never share one-time passcodes with anyone, for any reason.The message containing them says so. No legitimate organisation asks for them.
- Be suspicious of unusual payment methods.Gift cards, cryptocurrency, bank transfer to a new account, or a 'safe account' are all strong indicators.
- Verify independently, through a channel you found yourself.Hang up, wait five minutes, and call the number on your card or the organisation's official website. Don't use any number they gave you.
- Never install remote-access software at someone else's request.This is the mechanism behind a large category of scams. No genuine support call from your bank requires it.
- Check the actual sender address and hover over links before clicking.Display names are trivially faked; the underlying address and URL are harder to disguise convincingly.
- If you've been caught, contact your bank immediately and report it.Speed matters for recovery. Then change passwords on affected accounts and enable two-factor authentication.
Tips
- If a caller claims to be your bank, hang up and call back from the number on your card — but wait a few minutes or use a different phone, since some scams keep the line open.
- Scams targeting older relatives frequently use a family emergency story. Agreeing a family code word in advance is a simple and effective defence.
- Too-good-to-be-true offers, unexpected refunds and unexpected parcels all follow the same structure as more obviously threatening scams.
- Being scammed is not a failure of intelligence — these are professional operations designed by people who do this full time. Report it rather than staying quiet.
Common mistakes
- Trusting caller ID or sender names — Both are easily spoofed, and doing so is a standard part of the technique.
- Calling back a number the caller gave you — It goes to the same operation. Always use a number you looked up independently.
- Sharing a one-time passcode — It's the last barrier protecting the account, and no legitimate organisation ever asks for it.
- Being embarrassed and not reporting it — Speed affects recovery, and reporting helps others. It's a crime committed against you.
Questions people ask
How do I check if a message is genuine?
Don't engage with it. Independently contact the organisation using a number or website address you find yourself — on your card, a bill, or by typing the address in directly.
What should I do if I've been scammed?
Contact your bank immediately, as speed affects whether the payment can be stopped or recovered. Report it to your country's fraud reporting service, change passwords on affected accounts, and enable two-factor authentication.