Online Safety Guide · Updated 2026
How to Recognize Online Fraud Before They Steal Your Money
Seven common scams, the warning signs they share, and the exact steps to take before — or after — money and personal information are exposed.
The pattern behind most online scams
Scammers change the story, logo and platform, but the pressure tactics remain remarkably consistent. They contact you unexpectedly, create a crisis or opportunity that seems time-sensitive, and push you toward crypto, wires, gift cards or payment apps. Recognizing that pattern is more durable than memorizing every new scam script.
Phishing Emails
Criminals impersonate banks, retailers, delivery companies, technology firms or government agencies. Their goal is to make you click a malicious link, open an attachment or surrender passwords, card information or one-time verification codes.
- The sender’s address does not match the real company domain.
- Threats of account closure, arrest or immediate loss.
- Shortened or mismatched links and unexpected attachments.
- Requests for passwords, Social Security numbers or verification codes.
Do not use the link or phone number in the message. Open the company’s official app, type its known address yourself or call a trusted number. Turn on two-factor authentication and never share one-time codes.
Smishing: Fake Text Messages
Text-message scams often claim there is a package problem, unpaid toll, suspicious bank purchase, job offer or wrong-number conversation. Because people check texts quickly, the scam depends on an instant emotional reaction.
- An unfamiliar number and an unexpected account, package or toll problem.
- A suspicious or shortened link.
- A request to reply with personal or banking information.
- A “wrong number” conversation that slowly turns into an investment pitch.
Do not click or reply. Contact the organization using a known channel. Forward spam texts to 7726 and report them in your messaging app.
Fake or Spoofed Websites
Scammers copy the look of banks, retailers and major brands to steal logins, card details or payments for products that never arrive. They may rely on ads, fake search results, phishing links or domains containing tiny spelling changes.
- A misspelled domain, strange extension or extra word in the address.
- Prices that are far below normal market value.
- Broken policy pages, weak contact information or only unusual payment methods.
- Low-quality images, inconsistent fonts or suspiciously uniform reviews.
Type the address yourself, examine every character, search the company name with “scam” or “reviews,” verify customer service and prefer a credit card for stronger dispute rights.
QR-Code Fraud (Quishing)
A QR code hides the destination link, so victims cannot inspect it before scanning. Criminals place fake stickers over real parking or menu codes, include them in emails and mystery packages, or use them in fake toll and court notices.
- A sticker appears to cover another QR code.
- The code arrives in an unexpected email, text or package.
- Scanning leads to a login or immediate payment demand.
- The message uses urgency around a fine, toll or missed delivery.
Inspect physical codes, preview the destination URL, verify the exact official domain and avoid paying bills through a QR code. Go directly to the organization’s website instead.
Fake Job and Task Scams
The offer usually arrives through text, WhatsApp or Telegram and promises easy, high-paying remote work. The scam may demand training or equipment fees, send a fake check, or show fake earnings on a dashboard and require a crypto deposit to “unlock” withdrawals.
- You are recruited unexpectedly through text or messaging apps.
- You must pay before being hired or before withdrawing earnings.
- The “work” is liking, rating or completing game-like tasks.
- A fake check is followed by instructions to return part of the money.
Never pay to get paid. Verify the employer through its official career page and ignore balances displayed on unfamiliar task platforms.
Crypto Scams
Common versions include romance-investment schemes, fake exchanges, rug pulls, fake celebrity giveaways, AI-trading promises and Bitcoin ATM demands. Transactions are attractive to scammers because they are fast and difficult to reverse.
- Guaranteed returns or unusually high yields.
- An online-only friend or romantic interest pushes an investment.
- You cannot withdraw without first paying “taxes” or “fees.”
- Someone asks for your wallet seed phrase or directs you to a crypto ATM.
Never share a seed phrase. Treat guaranteed returns as fraud, verify promotions through official channels and be highly skeptical when someone you have only met online introduces crypto investing.
Facebook Marketplace Scams
Marketplace scams target both buyers and sellers through fake listings, deposits for nonexistent goods, overpayments, forged payment confirmations, off-platform payments and requests for verification codes.
- A seller demands a deposit before you inspect the item.
- A buyer “overpays” and asks you to refund the difference.
- Payment proof exists only as an email or screenshot.
- The other party asks to move to Zelle, wire transfer or another off-platform method.
Meet in a public, well-lit place, stay on-platform, confirm money in your actual account, never share verification codes and walk away when someone creates pressure.
What to Do If You Have Already Been Scammed
Do not send additional money, including fees promised by “recovery” services.
Ask about disputes, chargebacks, wire recalls or fraud procedures.
Use ReportFraud.ftc.gov and IC3.gov, and preserve transaction IDs, wallet addresses, screenshots and contact details.
Use IdentityTheft.gov, change reused passwords, monitor accounts and freeze credit with all three bureaus when appropriate.
Save complaint confirmations and consider a police report for bank disputes, insurance or identity-theft records.
Baseline Defense Everyone Should Use
- Enable two-factor authentication on email, banking and social accounts.
- For unexpected contact, independently find the organization and contact it yourself.
- Do not click unfamiliar links or scan unexpected QR codes.
- Remember the payment warning: crypto, wires, gift cards and urgent payment-app transfers are major red flags.
- Keep devices and apps updated and use reputable security software.
- Pause before acting. A legitimate deadline can survive five minutes of verification.
Trust — but verify independently.
The story may change, but the structure stays the same: unexpected contact, urgency and irreversible payment. Recognizing those three elements can stop a scam before it becomes a loss.
Important caveats
Loss figures in the source are reported losses, not the full scale of fraud. FTC and FBI totals use different datasets and should not be treated as directly comparable. Vendor statistics about phishing, QR fraud and crypto crime are useful directional indicators, but methodologies vary. Scam tactics evolve rapidly, especially as AI improves impersonation, voice cloning and message quality.