Scam red flags library

Bank or card details request

The message tries to collect card numbers, CVV, PIN, or full bank account details.

Your bank will never ask for your full card number, PIN, or CVV by message.

Brand impersonation

The message imitates a well-known brand (Amazon, Apple, PayPal, a bank) to seem trustworthy.

Brands do not ask for payment or login via random messages. Verify on the official site.

Invoice or supplier bank-detail change (BEC)

The message asks to pay an invoice, change supplier bank details, or make an urgent transfer - a pattern used in business email compromise.

Always confirm new or changed bank details by calling the supplier on a number you already hold, never one from the message.

Urgent donation or charity appeal

The message pressures you to donate quickly to a disaster, medical, or charity appeal, often to a personal wallet or link.

Donate only through a charity's official website that you look up yourself - never via a link or wallet in a message.

Crypto wallet or transfer request

The message pushes you toward cryptocurrency, which is fast, irreversible, and hard to trace.

Crypto payments cannot be reversed. Be extremely cautious.

Delivery / customs / tax / toll / parking fee

A small 'fee' is requested to release a parcel or clear a fine, used to steal card details.

Verify any delivery or fine directly with the official carrier or agency.

Emotional manipulation

The message leans on fear, guilt, excitement, or trust to override your judgement.

Strong emotional pressure is a tactic. Step back before acting.

Fake authority / government / bank wording

The message impersonates a bank, tax office, police, or government body to sound official.

Agencies contact you through official channels, not surprise messages demanding payment.

Fake police / digital arrest / voice-clone threat

The message or call impersonates police, courts, customs, or a central bank, often demanding secret payment, remote access, or a video call.

Real police and courts never demand secret transfers, gift cards, crypto, or video calls. Hang up and call official numbers yourself.

Gift card request

Requests for gift cards (Apple, Google Play, Amazon, Steam) are an extremely common scam tactic.

No legitimate business, agency, or employer is paid in gift cards.

Investment / trading scam language

The message promotes an investment, trading, or crypto opportunity that promises easy or guaranteed profit.

Legitimate investments never guarantee returns. Verify any platform with your financial regulator before paying.

Lottery, prize, or reward you did not enter

The message claims you won a prize, lottery, or reward you never entered, then asks for a fee or details to release it.

You cannot win a lottery you never entered, and real prizes never require an upfront payment.

Fake or unverified payment claim

The message claims a payment was sent (often with a screenshot) and pressures you to ship or release goods before the money is truly in your account.

A screenshot is not proof of payment. Confirm the money has actually cleared in your own account before sending anything.

Recovery scam promise

Scammers often target victims again by promising to recover lost money, trace a crypto wallet, or force a chargeback for an upfront fee. Real banks, police, and official agencies do not guarantee recovery through private chat payments.

Do not pay recovery fees. Contact your bank, payment provider, or official reporting authority directly.

Request to move platform

You are pushed off the original app (e.g. to WhatsApp/Telegram) where there is less protection.

Be cautious when a stranger insists on switching to a private chat app.

OTP / verification code request

The message asks for a one-time code. Sharing it can let an attacker take over your account.

Never share a verification code with anyone. Real staff will never ask for it.

Password or login request

The message asks you to log in or hand over a password, often via a link.

Never enter credentials from a link in a message. Open the official app or website yourself.

Payment request

The message asks you to send money, often quickly or to an unfamiliar destination.

Never pay based on a message alone. Verify through an official channel first.

Poor grammar or strange formatting

Spelling, grammar, or formatting errors can indicate a mass-produced scam.

Treat odd wording as one of several signals, not proof on its own.

QR code or attachment risk

QR codes and attachments can hide malicious links or malware.

Do not scan unknown QR codes or open unexpected attachments.

Refusal to verify through official channels

The sender resists or discourages independent verification through official means.

A legitimate request always survives independent verification.

Remote access request

You are asked to install remote-control software or grant device access.

Never give remote access to your device to someone who contacted you unexpectedly.

Request to keep it secret

You are told not to tell anyone, which isolates you from people who could warn you.

Secrecy is a major red flag. Talk to someone you trust.

Romance or emergency story

A relationship or sudden crisis is used to build trust and then ask for money.

Be wary of anyone you have not met in person asking for money or investment.

Mismatched sender or domain

The sender or domain does not match the brand or person it claims to be.

Check the exact spelling of the sender address or domain against the official one.

Sextortion / threat to leak content

The sender threatens to expose private images or information unless you pay.

Do not pay. Do not reply. Preserve evidence and report it to the authorities.

Suspicious link

The message contains a link that pushes you to act outside official, trusted channels.

Do not open links in suspicious messages. Type the official address yourself.

Shortened URL

Short links hide the real destination, a common trick to disguise fake sites.

Treat shortened links in unsolicited messages as untrusted.

Fake support, refund, or security team

The sender claims to be a support, refund, or security team for a well-known company or your bank, steering you toward access or payment.

Companies do not contact you out of the blue to fix your device or refund you. Contact them through their official app or website.

Too-good-to-be-true promise

Guaranteed high returns, big prizes, or large refunds with little effort are classic bait.

If it sounds too good to be true, it almost always is.

Travel, visa, or booking offer with a fee

The message offers a visa, travel document, flight, or booking, then asks for an upfront processing or clearance fee.

Apply for visas and travel only through official government or verified airline/agency websites you look up yourself.

Unsolicited job offer

An out-of-the-blue job or task offer, especially with easy money, is a common lure.

Real recruiters do not ask for fees and can be verified on the official company site.

Upfront fee request

You are asked to pay a fee first to unlock a job, prize, loan, package, or refund.

Paying to receive money or a job is a hallmark of fraud.

Urgent or threatening language

The message tries to create time pressure or fear so you act before you can think or verify.

Real organisations rarely demand instant action. Slow down and verify.