Scam red flag library

Urgency and pressure

The message pushes you to act immediately - a deadline, a countdown, or a threat of losing access - so you react before you can check.

Suspicious or mismatched link

The message wants you to tap a link that does not clearly match the real organisation's official website.

One-time code (OTP) request

Someone asks you to share, read out, or forward a verification code sent to your phone or email.

Unexpected payment or fee request

The message asks you to pay a small fee - delivery, customs, toll, release - usually through a link.

Fake authority or official

The sender claims to be the police, a government body, a bank's fraud team, or another official to make you comply.

Remote access or screen sharing

You're asked to install an app or allow remote access/screen sharing so someone can 'help' or 'fix' a problem.

Too-good-to-be-true job or task

An unsolicited offer promises easy work and high pay, often via chat apps, and eventually asks you to pay or 'top up'.

Guaranteed investment returns

A message or group promises high or 'guaranteed' returns, often in crypto, with a mentor or VIP signals.

Recovery promise after a scam

Someone offers to recover money you already lost - for an upfront fee.

Romance or emotional pressure

A new online contact builds a fast, intense connection, then asks for money or to 'invest' together.

Request for secrecy

You're told not to tell anyone - not family, not your bank, not the police.

QR code payment or scan

You're asked to scan a QR code to pay, log in, or 'verify' - often for a parking, delivery, or account task.

Fake payment proof

A buyer or contact sends a screenshot as 'proof' of payment and pressures you to ship or refund.

Login or credential request

You're prompted to 'verify', 'confirm', or 're-enter' your username and password, often via a link or lookalike sender.

Urgent payment demand

A message that pressures you to pay right now - a fee, fine, or 'release' charge - before you have time to check.

Verification code request

Someone asks you to share or forward a verification or login code that was sent to your phone or email.

Suspicious shortened link

A shortened or redirect link (bit.ly-style) that hides where it really leads.

Lookalike domain

A web address that imitates a real brand with small changes - extra words, hyphens, or swapped letters.

QR code payment request

You're asked to scan a QR code to 'receive' a refund or 'verify' an account.

Remote access request

Someone asks you to install software (AnyDesk, TeamViewer, etc.) so they can connect to your device.

Upfront fee

You're told to pay a fee first to get a job, prize, loan, visa, or release of funds.

Guaranteed profit

An offer that promises guaranteed or unusually high returns with little or no risk.

High-pressure deadline

A countdown or 'act now or lose it' deadline designed to make you rush.

Threat of arrest

A caller or message threatens arrest, legal action, or deportation unless you pay or comply.

Account suspension threat

A message warns your account will be disabled, suspended, or deleted unless you 'verify' now.

Keep this secret

You're told not to tell anyone - your bank, family, or the police - about the request.

Move to WhatsApp or Telegram

Early pressure to leave the original platform and continue on WhatsApp or Telegram.

Fake support agent

Someone claims to be official 'support' for your bank, a platform, or a big tech brand.

Fake payment screenshot

A buyer or contact sends a screenshot 'proving' they paid you, to rush you into releasing goods or a refund.

Overpayment refund request

A buyer 'accidentally overpays' and asks you to refund the difference before the payment clears.

Wallet seed phrase request

Anyone asking for your crypto wallet's recovery (seed) phrase to 'verify', 'sync', or 'recover' it.

Connect wallet and sign request

A site asks you to 'connect your wallet' and approve or sign a transaction to claim an airdrop or 'verify'.

Gift card payment

You're asked to pay with gift cards (Apple, Google Play, Amazon, Steam) and read out the codes.

Crypto payment request

A demand to pay in cryptocurrency, often to 'release' funds, settle a 'fine', or invest.

Wire transfer request

Pressure to send a bank wire urgently, often 'confidentially', to a new or changed account.

UPI collect request

A UPI 'collect' or 'request money' prompt dressed up as a way to receive a refund or payment.

Zelle or PayID 'receive money' trick

A buyer claims you must 'upgrade' your account or send a fee to receive a Zelle/PayID payment.

Bad grammar is no longer a reliable sign

Relying on spelling or grammar mistakes to spot scams no longer works - many messages now read perfectly.

AI voice impersonation

A cloned voice of a relative, boss, or official used to fake an emergency or payment order.

Deepfake video call

A live video call faking a real person's face - a relative, executive, or 'official'.

Fake legal document

An official-looking notice, warrant, or court 'document' attached to pressure you.

Fake courier pickup

A 'buyer' arranges a courier and asks you (the seller) to pay a pickup, insurance, or release fee.

Recovery fee request

After a loss, someone offers to recover your money for an upfront 'processing' or 'legal' fee.

Romance-to-investment shift

An online relationship that, after building trust, steers you toward a 'great' crypto or investment opportunity.

Small initial payout

A tiny early 'payout' or 'profit' used to build trust before bigger deposits are demanded.

Blocked withdrawal

Your 'profits' or balance can't be withdrawn until you pay a tax, fee, or minimum.

Tax or unlock fee

A fee framed as 'tax', 'clearance', 'unlock', or 'release' that you must pay before getting money owed.

Malicious attachment

An unexpected attachment (invoice, receipt, 'document to sign') that hides malware or a phishing link.

Fake login page

A page that imitates a real login screen to capture your username, password, and 2FA.

Browser virus popup

A scary popup claiming your device is infected and urging you to call a number or install software.

Calendar invite link

An unsolicited calendar invite or event that contains a phishing or payment link.

Pressure to recruit others

You're pushed to recruit friends or family to earn more - a hallmark of pyramid and task scams.