Learn Dark Web

Safety Center

How to Avoid Online Scams: Red Flags

Almost every online scam runs on the same recipe, whatever the story: unexpected contact, urgency, and a request for money, gift cards, or account details. Learn the shape and you can spot new scams you have never seen before — because the story changes and the shape never does.

By Abdul Hannan · Published 14 November 2026 · Updated 14 November 2026

Try the tool: Online Safety Assessment

The scam recipe: three ingredients

1. Unexpected contact. A parcel you did not order, a bank account warning for an account you do not hold, a prize you never entered, a relative in trouble, an investment that cannot lose. The contact arrives out of nowhere, by email, text, call or social media message.

2. Urgency. "Act now or lose your account." "Your parcel will be returned today." "This offer ends in an hour." Urgency is the engine of the scam: it stops you thinking and pushes you to act before you check.

3. A request. Money, gift cards, cryptocurrency, a password, a verification code, a link to click, an attachment to open. The request is always the point; everything before it was the setup.

Any one ingredient can be innocent. A real bank does send warnings; a real delivery does need attention. Two or three together — unexpected, urgent, asking for money or details — is a strong warning. The safest move is boring: ignore the message and check through the company's official site or app, never through the message itself.

The red flags, in full

  • Unexpected contact about money, an account, a parcel or a prize you did not expect.
  • Pressure to act now — threats, countdowns, "final warning" language.
  • Requests for gift cards, crypto or wire transfers. No legitimate company or agency takes payment this way.
  • Requests for passwords or verification codes. No real support team will ever ask for these.
  • Links to pages that look almost right — a familiar name with an odd spelling, an extra word, a different ending. Check the address bar, not the logo.
  • Attachments you did not ask for — invoices, delivery notes, "voicemail" files.
  • Too good to be true — guaranteed investments, prizes, jobs paying far above the market, romance that moves fast toward a money request.
  • Secrecy. "Don't tell your family." "Keep this between us." A legitimate organisation never needs your silence.

The scams you will actually meet

Phishing emails and texts

The most common scam of all: a message pretending to be your bank, a delivery company, a government agency or a service you use, with a link to a fake login page. Modern phishing is polished — correct logos, correct grammar — because the tools that write it have improved. Grammar is no longer a reliable signal. What still gives it away is the shape: unexpected, urgent, asking you to click or enter details. Our how to spot phishing emails guide covers this in depth, and our what to do if you clicked a phishing link guide covers the recovery.

Fake shops and too-good deals

A shop selling branded goods far below market price, with no contact address, reviews that all sound the same, and payment only by transfer or crypto. Check the domain age, the contact details, and whether the payment method gives you any protection — card payments can be disputed; transfers usually cannot.

Investment and crypto scams

"Guaranteed returns", celebrity endorsements, pressure to invest now, and a dashboard showing your money "growing" — until you try to withdraw it and are asked for a fee first. No investment is guaranteed, and no legitimate investment asks for a fee to release your own money. Our how to spot crypto investment scams guide explains the red flags and the regulator lists to check.

Grandparent and voice-clone scams

A call that sounds like a grandchild in trouble, asking for money urgently — sometimes now using a cloned voice. Agree a family code word in advance, and always verify through a number you already know. Our AI voice clone scams guide covers this highest-harm variant.

What to do if you clicked, paid, or shared details

  1. Do not enter more details. Close the page and do not download anything it offers.
  2. Contact your bank immediately if money or card details were involved — it may be able to stop or reverse the payment, and it deals with this daily.
  3. Change passwords for any account you may have entered details into, and everywhere you reused that password. Turn on two-factor authentication.
  4. Keep the evidence: the message, the payment receipt, any account details the scammer gave you.
  5. Report it. In the US, report to the FTC at ReportFraud.ftc.gov and, for internet crime, the FBI's Internet Crime Complaint Center at ic3.gov. In the UK, report to your bank and your national fraud reporting service. Reporting helps investigators spot patterns even if your own money is recovered.

The "check the address bar" habit

One habit catches more scams than any list of red flags: before you enter a password or a card number, look at the address bar. A real bank's web address is the one printed on your card or the one you type yourself — not the one in the message. Scam pages copy logos and layouts perfectly, but their addresses give them away: a familiar name with an extra letter, a different ending, or a long string of random characters. If the address looks even slightly wrong, close the page and go to the site yourself. The same rule applies to phone numbers: if a caller claims to be your bank, hang up and call the number printed on your card. It takes thirty seconds, and it is the single most reliable defence you have — because a scammer can copy everything about a company except its real address.

The pause rule. Every scam needs you to act before you think. Build one habit: when a message asks for money, details or a click, pause — and check through a route you chose yourself, never through the message. The pause costs thirty seconds. The scam costs far more. Back to the Safety Center.

Sources

Last checked: 14 November 2026.

Frequently asked questions

How can I tell if a message is a scam?

Look for the combination, not one clue: unexpected contact, urgency (“act now or lose your account”), a request for money, gift cards or a password, and a link or attachment you did not ask for. Any one of those can be innocent; two or three together is a strong warning.

What should I do if I clicked a suspicious link?

Stay calm and do not enter any details. Close the page, do not download anything it offers, and check the accounts it may have touched — starting with your email. Change passwords for any account you may have entered details into, turn on two-factor authentication, and tell your bank if money or card details were involved.

What should I do if I already sent money to a scammer?

Contact your bank immediately — it may be able to stop or reverse the payment, especially if you act fast. Keep the message, the payment receipt and any account details as evidence, and report the scam to your national fraud reporting service or local police.

Are gift cards a sign of a scam?

Almost always. No legitimate company, government agency or tech support team will ever ask you to pay with gift cards, cryptocurrency, or wire transfers. A request for gift cards is one of the clearest scam signs there is.

Should I report a scam even if I lost nothing?

Yes. Report it to your national fraud reporting service — in the US, the FTC at ReportFraud.ftc.gov. Reporting helps investigators spot patterns and warn others, even if your own money is safe. It also creates a record if the same scam hits you again.