# TapSafely: full scam guide library > Check any message, link or screenshot for scams, free. Available worldwide. Published by A.I.T. Multiverse Consulting Ltd. Last reviewed 2026-09-16. ## Fake delivery texts and customs-fee scams URL: https://tapsafely.com/scams/fake-delivery-texts A text says a parcel couldn't be delivered, or is stuck at customs, and you need to pay a small fee or confirm your address. It's one of the most common scams in the world because almost everyone is waiting for something. ### How it works Criminals send huge numbers of texts or emails pretending to be a delivery company: DHL, UPS, FedEx, USPS, Royal Mail, Canada Post, Australia Post, India Post, Correios, J&T, your national post, or simply “Customs”. They don't know whether you're expecting a parcel. They don't need to: most people are. The link opens a copy of the courier's website. It asks for your name, address and date of birth, then a tiny payment, often under 3 dollars, pounds or euros. The fee isn't the point. Your full card details are. Some sites also ask for your bank's name so a second scammer can call you pretending to be your bank's fraud team. That follow-up call is where the real losses happen. The caller knows your details from the fake form, sounds professional, and says your card was “used fraudulently”. Then they talk you into moving money or reading out a code. ### Red flags - The fee is tiny: Real couriers rarely text you asking for a fee of a dollar, pound or euro or two. A small amount makes you less careful about typing in card details. - The link isn't the courier's real website: Look at the part just before the first single slash. royalmail.com is real; royalmail-redelivery.top or royalmail.parcel-help.com are not. - A deadline: “Within 12 hours or it will be returned” is designed to rush you. - Sent from a mobile number or a random email: Big couriers usually message from a named sender or their official app. - You weren't expecting anything from that company: Scammers pick the biggest brands and hope you are. ### What to do - Don't tap the link. If you want to check, open the courier's official app or type their website address yourself and enter your tracking number from the shop's order email. - Forward the text to your phone network's spam number (for example 7726 in the UK, US, Canada and New Zealand, 33700 in France, 8080 in Poland), then delete it. Find your country's number. - Check it with TapSafely if you're unsure. We'll show you who really owns the link. ### If you already paid or shared details - Call your bank using the number on the back of your card and tell them you entered your card details on a fake delivery site. They can block the card and send a new one. - Expect a follow-up call pretending to be your bank. Your bank will never ask you to move money to a “safe account” or read out a one-time code. - Watch your statements for small “test” payments, and report the scam to your national fraud reporting service. ### Why these texts get past spam filters Scammers rotate thousands of cheap domain names and phone numbers, often registering new ones hours before a campaign. That's why the same message keeps arriving from different numbers, and why a very new website is one of the strongest warning signs our checker looks for. ### Questions Q: Can I get hacked just by opening the text? A: Opening the text is very unlikely to harm your phone. The danger is tapping the link and typing information into the page. Q: I only entered my address, not my card. Is that a problem? A: It's lower risk, but scammers may use your details to make later messages or calls more convincing. Be extra careful with calls claiming to be your bank for the next few weeks. Q: How do customs fees work for real? A: Genuine import charges are usually requested by the courier handling your parcel, and you can see them in your tracking page on the official website or app. If in doubt, contact the courier directly. ## The “Hi Mum, this is my new number” scam URL: https://tapsafely.com/scams/hi-mum-new-number-scam “Hi Mum, I dropped my phone, this is my new number.” The chat feels normal at first. Then comes a request to pay an urgent bill because their banking app “doesn't work on the new phone yet”. ### How it works Scammers message thousands of numbers with the same opening. They don't know who you are. They wait for someone to reply “Is that you, Sophie?”, and then they become Sophie. The story is always why they can't just call: a broken microphone, a lost phone, being at work. Then there's a bill due today, and they can't pay because of the new phone. The account details are usually a stranger's name, explained as “a friend's account” or “the landlord”. If you pay, a second or third request often follows. With AI voice cloning, some versions now include a short voice note that sounds like your relative. ### Red flags - A new number and a reason not to call: Anyone who's really your child can take a 10-second call or answer a question only they'd know. - Asking you to delete the old number: This stops you from checking with the real person. - An urgent payment to someone else's account: Real family members rarely need money sent to a stranger's name today. - Pet names but no real details: They say “Mum” or “Dad” but avoid names, places or shared memories. ### What to do - Stop and call your relative on the number you already have saved, even if the message says that phone is broken. - Ask a question only they'd know, or ask for your family safe word. Set one up in two minutes. - Report the number inside WhatsApp (open the chat → tap the name → Report) and block it. ### If you already paid or shared details - Call your bank immediately. The faster you report, the better the chance of stopping or recovering the payment. - Report it to the police or your national fraud reporting service, and keep screenshots of the chat. - Warn other family members. Scammers sometimes try the same trick on grandparents or siblings. ### Why it works so well It skips every technical defence. There's no link to block and no virus to detect. It works on love and a sense of duty. That's why a simple family rule helps more than any app: no money moves until we've spoken on a known number. ### Questions Q: The voice note sounded exactly like my son. Could it still be fake? A: Yes. AI can copy a voice from a few seconds of audio taken from social media videos. Always verify with a call to the known number or a safe word. Q: Should I reply to see who it is? A: Don't reply. Check with your family directly instead. Replying tells scammers your number is active. ## AI voice-clone emergency calls URL: https://tapsafely.com/scams/ai-voice-clone-calls The phone rings. It's your grandson, crying: he's been in an accident, he's been arrested, he needs money now and please don't tell Mum. The voice is his. But it may not be him. ### How it works Modern AI tools can imitate someone's voice from a short clip, such as a birthday video, a voicemail greeting or a social media post. The scammer types the words and the tool speaks them in that voice. The call is short and emotional so you don't have time to notice odd pauses. Then a second person takes over, a “lawyer”, “police officer” or “kidnapper”, to arrange payment by bank transfer, gift cards, crypto or even a courier who comes to your door to collect cash. The old “grandparent scam” worked the same way with a vague “It's me, Grandma”. AI just makes it more convincing. ### Red flags - Extreme urgency and emotion: Crying, panic and “there's no time” are there to stop you thinking. - “Don't tell anyone”: Secrecy keeps you away from the people who would spot the scam. - A third person handles the money: A lawyer, officer or friend who needs payment in an unusual way. - Payment by gift card, crypto, wire or courier cash collection: Real courts and police don't take bail this way. ### What to do - Hang up. Call your relative back on their known number, or call someone who's with them. - Ask for your family safe word. A cloned voice can't know it. Create one here. - Never hand cash or cards to a courier, and never pay bail over the phone. ### If you already paid or shared details - Contact your bank straight away and report the payment as fraud. - Report to the police. If a courier collected cash, tell them the time and a description. - Talk it through with family. These scams are designed to make good, caring people act fast. It's not your fault. ### Reduce what scammers can copy Set social media accounts to private, and think twice before posting long videos of children or older relatives speaking. Use a generic voicemail greeting instead of your own voice. None of this is perfect, which is why the safe word matters most. ### Questions Q: How can a scammer get my relative's voice? A: From public videos, voice notes shared in groups, or even a short call where they say “Hello? Who is this?” Q: The call came from my son's real number. Is it genuine? A: Not necessarily. Caller ID can be faked (spoofed). Hang up and call the number back yourself. ## Bank impersonation and “safe account” scams URL: https://tapsafely.com/scams/bank-safe-account-scam Someone calls from what looks like your bank's number. They know your name and maybe your last purchase. They say your account has been compromised and you must move your money to a new “safe account” today. ### How it works It often starts with a fake alert text, as above, or a fake delivery form that collected your details. When you call the number, or they call you, a calm, professional “fraud officer” takes over. They say criminals, sometimes even staff inside your branch, are about to empty your account. To protect it, you must move everything to a new account they've set up for you. They may coach you to lie to your real bank if it asks questions: “say it's for a family member”. Other versions ask you to read out one-time codes to “cancel” fraudulent payments, install a remote access app, or hand your card to a courier. ### Red flags - Moving money to a “safe account”: No genuine bank will ever ask you to do this. Ever. - Being told to lie to bank staff: “Don't tell the branch, they may be involved” is a script line. - Asking for one-time codes or your PIN: Your bank will never ask you to read these out. - Caller ID shows the bank's real number: Numbers can be spoofed. The display proves nothing. - A courier coming to collect your card: Banks don't collect cards from your door. ### What to do - Hang up. Then call your bank using the number on the back of your card, ideally from a different phone, or wait five minutes, because some scammers keep the line open. - Some countries have a safe shortcut to your bank. In the UK, for example, you can call 159. - Never move money, share codes or install apps because a caller told you to. ### If you already paid or shared details - Call your bank immediately and say you've been the victim of an authorised push payment (APP) scam. In some countries, including the UK, many victims are entitled to reimbursement. - Report it to the police or your national fraud service. See where to report in your country. - Change your online banking password and check for new payees or devices. ### Questions Q: They knew my name, address and recent transactions. Doesn't that prove it's my bank? A: No. Personal details are easy to obtain from data breaches or fake forms. Knowing about you is not proof of who they are. Q: What if the call really is from my bank? A: Then there's no harm in hanging up and calling back on the official number. A real bank will understand and encourage it. ## Fake tax refunds, government payments and fines URL: https://tapsafely.com/scams/fake-tax-refund-messages “You are eligible for a tax refund of 312.60.” “Your benefit payment is ready.” “You have an unpaid fine. Pay now to avoid court.” Good news or a threat, the goal is the same: your card and identity details. ### How it works Fake government messages copy logos and official-sounding language. Refund versions promise money. Fine and tax-debt versions threaten penalties, court action or even arrest. The link leads to a copy of a government portal asking for your ID details, bank login or card. Phone versions may demand immediate payment by gift card or crypto “to avoid arrest”. ### Red flags - You're told to claim a refund by clicking a link: Tax offices generally don't send refund links by text or email. - Threats of arrest or immediate court action: Real authorities send letters and give you time and ways to query. - Payment by gift card, crypto or transfer to a personal account: No government takes these. - The website address isn't the official government domain: Look for the official domain (for example gov.uk, irs.gov, canada.ca, gov.in, gov.br, gob.mx) as the ending of the address. ### What to do - Log in to your tax or government account by typing the official address yourself, or use the official app. Any real refund or debt will be shown there. - Forward phishing emails to your government's reporting address if it has one (for example report@phishing.gov.uk in the UK). Find yours. - If someone calls threatening arrest, hang up. Real officials won't mind you calling back through the official number. ### If you already paid or shared details - Contact your bank about any payment or card details you entered. - If you shared ID documents or your national insurance or social security number, contact the tax office and consider an identity-theft protection or credit monitoring service. - Report it to the national fraud service. ### Questions Q: Can the tax office text me at all? A: Some tax offices do send texts, for example reminders, but they won't ask for bank details or send refund links. When in doubt, log in yourself. ## “Unpaid toll” and parking-fine texts URL: https://tapsafely.com/scams/unpaid-toll-parking-texts “You have an outstanding toll of $6.99. Pay by tomorrow to avoid a $50 late fee.” Toll and parking texts have become one of the fastest-spreading scam waves, because so many drivers use electronic toll roads. ### How it works The texts copy the name of a real toll operator or city parking service and threaten a late fee or penalty. Some ask you to reply “Y” and reopen the message so the link becomes tappable. That also confirms your number is active. The payment page steals your card details, and sometimes your driving licence number and date of birth. ### Red flags - Sent from an international or random number: Toll agencies don't text from overseas mobile numbers. - Asks you to reply “Y” to activate a link: A trick to get around phone safety features. - Threatens licence suspension over a few dollars: Out-of-proportion threats are a script. - A strange web address: Cheap endings like .icu, .top or .xyz are very common in these campaigns. ### What to do - Don't reply and don't tap. Check your account on the toll operator's official website or app, which you find yourself. - Report the text to your mobile network (in many countries you can forward it to a short code such as 7726), then delete it. ### If you already paid or shared details - Call your bank to block the card. - If you entered your driving licence details, contact the licensing authority for advice and watch for identity misuse. ### Questions Q: I really did drive on a toll road recently. Could it be real? A: Possibly, but check by logging in to the official toll account yourself, never through the text. ## Crypto and investment scams URL: https://tapsafely.com/scams/crypto-investment-scams An ad shows a famous person “revealing” a trading platform. A friendly stranger on social media shares their crypto profits. The dashboard shows your money growing, until you try to withdraw it. ### How it works Scam platforms look like real trading apps. After a small deposit, a “personal account manager” calls, often from abroad, and encourages bigger deposits. The balance shown is fake. When you ask to withdraw, you're told to pay a “tax”, “unlock fee” or “verification deposit” first. Paying it only leads to another fee. Deepfake videos and fake news articles featuring celebrities, business leaders or TV hosts are used to build trust. These people have not endorsed the product. In long-con versions, sometimes called “pig butchering”, a scammer builds a friendship or romance over weeks before introducing the investment. ### Red flags - Guaranteed or very high returns: No legitimate investment guarantees profits, let alone daily ones. - Celebrity endorsement in an ad: Assume it's fake. Celebrities regularly warn about this. - Pressure to deposit more, fast: “The window closes tonight.” - Fees to withdraw your own money: This is the clearest sign of all. - Asked to install remote access software “to help you trade”: This gives them control of your device and your bank. ### What to do - Check the company on your financial regulator's register and warning list, such as the SEC/CFTC in the US, the FCA in the UK, ASIC in Australia, SEBI in India or CVM in Brazil, before investing anything. - Search the platform name plus “scam” or “reviews”, and check how old its website is with our link checker. - Never let anyone else control your computer or open accounts on your behalf. ### If you already paid or shared details - Stop sending money, including any “fees” to release your balance. - Contact your bank or card provider and report to the police and your financial regulator. - Be ready for recovery scams: people who promise to get your money back for a fee. Read how they work. ### Questions Q: The app shows my balance growing. Isn't that proof it's real? A: No. The numbers are controlled by the scammers. The only real test is withdrawing, and scam platforms always find a reason you can't. Q: Can I report a fake celebrity ad? A: Yes. Use the platform's “report ad” option. Reports help get them removed faster. ## Task-based job scams URL: https://tapsafely.com/scams/task-job-scams An unexpected message offers flexible remote work, often “optimising apps” or “boosting products”, for a surprisingly good daily wage. The first small payouts are real. That's the hook. ### How it works You're added to a group where others (fake accounts) celebrate their earnings. You complete simple tasks in a website or app and see commission building up. You may even withdraw a small amount. Then you get a “combination task” or “premium order” that puts your account in negative balance. To continue, and to get your earnings, you must deposit your own money, usually in crypto. The deposits grow until you give up. ### Red flags - A job you never applied for: Real recruiters rarely offer a job without an interview. - High pay for trivial tasks: Liking videos or rating products doesn't pay hundreds a day. - Moving to WhatsApp or Telegram: Scammers avoid platforms with protections. - Paying to work or to unlock earnings: A real employer never asks you to pay them. ### What to do - Don't reply, and block the sender. Report the chat in the app. - Look up the company yourself and contact it through its official website. ### If you already paid or shared details - Stop depositing. The “negative balance” will never clear. - Report to your bank or crypto exchange and to the police. Keep all chat history and wallet addresses. - Watch for recovery scams offering to get your money back. ### Questions Q: They paid me at the start. Doesn't that make it legitimate? A: Early payouts are a deliberate trust-building step. They are small amounts compared with what they plan to take. ## Romance scams URL: https://tapsafely.com/scams/romance-scams They're attentive, kind and seem perfect. They can't quite meet yet because of work overseas. Weeks or months later, a crisis needs money, or an investment opportunity comes up that they want to share with you. ### How it works Romance scammers use stolen photos and invented jobs that explain why they are far away: military posts, offshore engineering, international medicine. They move quickly to private chat and talk every day. Money requests start small or come as a “chance to invest together”. They always come with a reason why video calls or meetings keep falling through. ### Red flags - Can't video call or meet: Excuses every time: bad connection, camera broken, security rules. - Moves fast emotionally: Declarations of love within days or weeks. - Any request for money, gift cards or crypto: Including “investing together” or paying fees for them. - Stories about customs, inheritances or frozen accounts: Classic script elements. ### What to do - Do a reverse image search of their photos. Stolen images often turn up under other names. - Insist on a live video call before any further contact. Genuine people agree. - Talk to a friend you trust. Scammers try to isolate you. ### If you already paid or shared details - Stop sending money and report to your bank and the police. - Report the profile to the dating site or app. - Be kind to yourself. These criminals are professionals, and victims are often smart, generous people. ### Worried about a friend or parent? Arguing about whether the partner is real often pushes people closer to the scammer. Ask gentle questions instead: “Have you seen them on video?” “What would happen if you said no to this payment?” Offer to do a photo search together. ### Questions Q: They sent me a photo of their ID. Is that proof? A: No. Fake and stolen ID images are easy to find or create. ## Marketplace buyer and seller scams URL: https://tapsafely.com/scams/marketplace-seller-scams You list a sofa. Within minutes a buyer wants it, no questions asked, and sends a link to “receive your payment” through a delivery service. Or you find a bargain phone that the seller can only post after you pay by bank transfer. ### How it works Targeting sellers: fake buyers send links to pages that look like the marketplace or a courier, asking for card details to “receive” money. Others “overpay” with a fake payment confirmation and ask you to refund the difference. Targeting buyers: fake sellers list popular items cheaply, push for bank transfer or “friends and family” payments with no protection, and disappear, or send a link to a fake checkout. ### Red flags - You need to enter card details to receive money: Receiving money never requires your card number or CVV. - The buyer doesn't want to see the item: Especially for expensive goods. - Payment screenshots or emails instead of money in your account: Check your actual balance. - Pressure to leave the platform's messaging and payments: You lose the platform's protection. - Prices that are too good: Especially phones, consoles, tickets and pets. ### What to do - Keep all messages and payments inside the platform's official system. - As a seller, only hand over items when money is visible in your real account. As a buyer, prefer in-person collection or protected payment methods. - Check any link with TapSafely before entering details. ### If you already paid or shared details - Report the user to the marketplace and contact your bank or payment provider. Card and protected payments can often be disputed. - If you entered card details on a fake page, block your card immediately. ### Questions Q: Is PayPal “friends and family” safe for buying from strangers? A: It usually removes buyer protection. Use “goods and services” or the platform's own checkout. ## Tech support and remote-access scams URL: https://tapsafely.com/scams/tech-support-scams A loud pop-up says your computer is infected and to call a number. Or someone phones claiming to be from Microsoft, Apple or your broadband provider. Or an email says a pricey subscription just renewed. Call to cancel. ### How it works When you call, a “technician” asks you to install a remote access app such as AnyDesk, TeamViewer or Quick Assist. They show you fake “errors”, then charge for a fix. Or, in the refund version, they claim to have refunded you too much and ask you to send the difference back from your online banking while they watch. With remote access they can also install malware or move money themselves. ### Red flags - A pop-up with a phone number: Real security warnings never ask you to call someone. - Unsolicited calls from big tech companies: Microsoft and Apple don't cold-call about viruses. - Being asked to install remote access software: Only do this with IT support you contacted yourself and trust. - A “refund” that went wrong: The overpayment refund story is a script. ### What to do - Close the browser. If it won't close, restart the computer. Don't call the number. - If someone calls you, hang up. - For subscription emails, log in to the real account yourself to check. ### If you already paid or shared details - Disconnect the device from the internet and uninstall any remote access app they asked you to install. - From a different device, change your email and banking passwords and turn on two-step verification. - Call your bank. Then run a reputable security scan or get help from a trusted local repair shop. ### Questions Q: Can a web page really infect my computer by showing a warning? A: The scary pop-up itself is just a web page. Closing it is usually enough. The danger starts when you call and give access. ## Verification-code and account-takeover scams URL: https://tapsafely.com/scams/verification-code-scams A friend messages: “Sorry, I sent a 6-digit code to your phone by mistake, can you forward it?” The friend's account has already been taken over. The code is the key to yours. ### How it works One-time codes confirm that you are the owner of an account. When a scammer tries to log in to your WhatsApp, email or bank, the service sends you a code. If you share it, they're in, and you may be locked out. Taken-over accounts are then used to message your contacts with the same trick or with money requests. ### Red flags - Anyone asking for a code, even a friend: Codes are for you only. No exceptions. - A code arrives that you didn't request: Someone is trying to access your account. - Calls from “support” asking you to read a code to verify you: Real support never asks for this. ### What to do - Never share codes. Ignore and delete unexpected ones. - Turn on two-step verification: in WhatsApp, go to Settings → Account → Two-step verification and set a PIN. - Use a password manager and unique passwords so one breach doesn't open everything. ### If you already paid or shared details - Try to log back in straight away. The service will send you a new code. - Change your password and enable two-step verification. Warn your contacts that messages from you may be fake. - If a bank code was shared, call your bank now. ### Questions Q: My friend really did send it. Can I trust them? A: Your friend's account may already be hacked. Call them to check. Either way, never forward a code. ## Fake online shops URL: https://tapsafely.com/scams/fake-online-shops An ad shows designer trainers at 80% off in a “closing down sale”. The website looks polished. You pay, and either nothing arrives or a cheap fake does, and the site vanishes. ### How it works Fake shops are cheap to build from templates, often using stolen product photos and copied reviews. They advertise on social media, usually for a few weeks, before switching to a new domain. ### Red flags - The website is only weeks old: Our link check shows the domain's age. Brand-new shops with huge discounts are high risk. - Unrealistic discounts and countdown timers: Pressure plus bargain. - No real contact details: Just a form or a free email address, no company registration. - Payment only by bank transfer or crypto: Or card payments that fail and push you to another method. - Reviews only on the site itself: Check independent review sites. ### What to do - Paste the shop's address into our link checker to see the domain's age and warning signs. - Search the shop's name plus “reviews” or “scam”. - Pay by credit card or another method with buyer protection, so you can ask for a chargeback if nothing arrives. (In the UK, for example, credit card purchases between £100 and £30,000 also have Section 75 protection.) ### If you already paid or shared details - Contact your card provider and ask for a chargeback or claim. - Report the site to your national fraud service and to the platform where you saw the ad. ### Questions Q: The site has a padlock. Doesn't that mean it's safe? A: No. The padlock only means the connection is encrypted. Scam sites have padlocks too. ## Fund-recovery scams URL: https://tapsafely.com/scams/recovery-scams You've lost money to a scam. Then someone contacts you, or appears in comments and search ads, saying they can trace and recover it. They just need a fee first. ### How it works Scammers share lists of past victims. Recovery scammers pose as lawyers, “ethical hackers”, regulators or even police, sometimes with official-looking badges and case numbers. They take upfront fees and then vanish, or ask for more. ### Red flags - They contacted you first: Especially if they know about your loss. - Upfront fees: Genuine help from police or regulators is free. - Guarantees of recovery: No one can honestly guarantee this. - “Hackers” who can reverse crypto transactions: This isn't possible. ### What to do - Only work with your bank, the police, your financial regulator and well-known, regulated law firms that you find yourself. - Don't pay upfront recovery fees. ### If you already paid or shared details - Report the recovery scam to the police too, as a separate crime. - Tell your bank so it can watch your account. ### Questions Q: Is it ever worth using a recovery company? A: Be very cautious. Start with your bank and the police. If you consider a law firm, check that it's regulated in your country and never pay based on promises. ## QR code scams (“quishing”) URL: https://tapsafely.com/scams/qr-code-scams A QR code on a parking meter, a restaurant table or in an email looks harmless, but you can't see where it leads until you scan it. Scammers use that. ### How it works Criminals stick their own QR codes over real ones on parking meters and charging points, or put codes in emails to get past security filters. The code opens a fake payment or login page. ### Red flags - A sticker placed over another code: Look for tampering. - An email asking you to scan a code to log in: A common trick to move you from a protected computer to your phone. - The preview address doesn't match the organisation: Most phone cameras show the link before opening. Read it. ### What to do - Use the official app or type the official website address for parking and payments. - Before opening a scanned link, read the address in the preview. If unsure, copy it into our link checker. ### If you already paid or shared details - Contact your bank if you paid or entered card details. - Change your password if you entered login details, and turn on two-step verification. - Tell the car park operator or venue about the fake sticker. ## Prize, lottery and giveaway scams URL: https://tapsafely.com/scams/prize-and-giveaway-scams “Congratulations! You've been selected to receive a free phone.” Or your loyalty points are about to expire. Or a celebrity is giving away money. All you have to do is pay shipping or a processing fee. ### How it works Fake prizes collect card details through small “shipping” fees, or sign you up to hidden recurring subscriptions. Lottery versions ask for “taxes” or “release fees” before paying out. The prize never exists. ### Red flags - You didn't enter: You can't win a competition you never joined. - A fee to claim: Real prizes don't require payment. - Expiring points or rewards: Check in the official app instead. ### What to do - Ignore and delete. Check any real loyalty balance in the official app. - Report the message to your carrier or email provider. ### If you already paid or shared details - Call your bank to block the card, and look for recurring charges you didn't agree to. ## Phishing links and fake login pages URL: https://tapsafely.com/scams/phishing-links Most online scams end in the same place: a web page that looks real and asks you to log in or pay. Learning to read a web address takes two minutes and protects you from almost all of them. ### How it works Phishing pages copy logos and layouts perfectly. The only part a scammer can't fake is the real domain name: the name right before the first single “/”, together with its ending (.com, .co.uk and so on). ### Red flags - The brand appears, but not as the real domain: paypal.com.account-verify.info belongs to account-verify.info. Read from the right. - Look-alike spelling: paypa1, arnazon, micros0ft, or special characters that look like normal letters. - Extra words: secure-login-, -verify, -support, -refund. - Shortened links: bit.ly and similar hide the destination. Our checker follows them for you. - Brand-new domains: Days-old websites asking for logins are almost always phishing. ### What to do - Don't log in from links in messages. Use the app, or type the address yourself. - Paste unsure links into TapSafely. We show the real owner, age and where the link really goes. - Use a password manager: it won't auto-fill your password on a fake domain, which is a great early warning. ### If you already paid or shared details - Change the password on the real site, and anywhere else you used it. - Turn on two-step verification and check account settings for new forwarding rules or devices. - If you entered card details, call your bank. ### Read a link from right to left LinkReal ownerVerdicthttps://www.amazon.co.uk/ordersamazon.co.ukGenuine domainhttps://amazon.co.uk.refund-centre[.]toprefund-centre.topFakehttps://login.microsoftonline.commicrosoftonline.comGenuine domainhttps://micros0ft-login[.]commicros0ft-login.comFake (zero instead of o) ### Questions Q: Is a link safe if it starts with https? A: No. https only means the connection is encrypted, not that the site is honest. ## Is this website legit? How to check in two minutes URL: https://tapsafely.com/scams/is-this-website-legit Scam websites can look perfect: real logos, reviews, a padlock and a live chat. The good news is that a few quick checks catch almost all of them, and none of them need technical skills. ### How it works Fake sites are cheap to make with shop templates and copied photos. They are promoted through social media ads, search ads and messages, and usually only live for a few weeks before moving to a new address. Some sell nothing at all. Others send cheap copies, or exist only to collect card details and logins. Phishing sites copy banks, delivery companies and government portals to steal passwords and codes. ### Red flags - The domain doesn't match the brand: Read the name just before the first single slash. nike.com is Nike; nike-outlet-clearance.shop is not. - The website is only days or weeks old: Paste the address into our checker to see when it was registered. New shops with huge discounts are high risk. - Prices far below everyone else: Big brands rarely sell at 70 to 90 percent off, especially on new products. - No real company details: Look for a registered company name, a physical address and a way to contact a person. A form or a free email address alone is a warning sign. - Only strange payment options: Bank transfer, crypto, gift cards or payment apps without buyer protection are red flags for a shop. - Reviews exist only on the site itself: Search the site name with the word “reviews” and check independent review platforms. - Pressure tactics: Countdown timers, “only 2 left” banners and pop-ups that won't close. ### What to do - Paste the address into the TapSafely checker. It shows who really owns the site, how old it is and where the link leads. - Search for the site name plus “scam” or “reviews”, and look at results from independent sources. - Go to well-known brands by typing their address yourself or using their official app, not through ads or links. - Pay only with a credit card or a method that offers buyer protection, so you can ask for your money back. - Never enter a password or one-time code on a page you reached from a message or ad. ### If you already paid or shared details - Contact your card provider or payment app immediately and ask about a chargeback or dispute. - If you entered a password, change it on the real site and turn on two-step verification. - Report the website to the ad platform where you saw it, and to the official service in your country. ### What a padlock does and doesn't mean The padlock (https) only means your connection to the site is encrypted. It says nothing about who runs the site. Most scam sites have a padlock too, because certificates are free. ### Questions Q: Is a site safe if it appears at the top of search results? A: Not necessarily. Scammers buy search ads too. The top result can be a paid ad that copies a real brand. Q: Can I trust a site that has a live chat? A: A chat window proves nothing. Scam shops often use chat to reassure buyers. Q: What if the site is real but the deal still looks odd? A: Contact the company through contact details you find independently, not the ones on the page you're unsure about. ## Deepfake video scams URL: https://tapsafely.com/scams/deepfake-video-scams A famous person recommends an investment app. Your “boss” joins a video call and asks for an urgent payment. A new online friend finally agrees to video chat. With today's AI tools, all three can be fake. ### How it works Deepfake tools can put someone's face and voice onto another person in a video, using public interviews and social media clips. Scammers use them in three main ways. Fake endorsements: videos of celebrities, business leaders or news presenters promoting investment platforms, giveaways or miracle products. Fake meetings: a video call where a “manager”, “finance director” or “lawyer” asks an employee to make an urgent, confidential payment. Fake relationships: romance and friendship scammers who use a face-swapped video call to prove they are real, then ask for money or investments. ### Red flags - A famous person selling an investment or giveaway: Treat every celebrity investment ad as fake until proven otherwise. - Urgency and secrecy on a call: “Do this now and don't tell anyone” is a warning sign, even from someone who looks like your boss. - Odd video details: Blurry edges around the face, strange blinking, lips out of sync, or a call that keeps “breaking up” when you ask questions. - A new payment method or new bank details: Real companies don't change where money goes during a surprise call. - Refusal to switch channels: The person avoids calling you back on a known number or meeting in person. ### What to do - Pause. Say you'll call back, then contact the person through a number or channel you already trust. - Ask a question only the real person would know, or use a family or team code word. See our safe-word kit. - For businesses: require a second person and a call-back check for every payment or bank-detail change. - Report fake celebrity ads to the platform showing them. ### If you already paid or shared details - Contact your bank or the exchange immediately and ask them to stop or recall the payment. - Report to the police and keep screenshots, links and call details. - Be wary of anyone offering to “recover” the money for a fee. ### Can I rely on spotting glitches? Less and less. Deepfakes are improving quickly, so the safest habit is not to judge the video at all. Verify the request through a separate, trusted channel instead. ### Questions Q: Is it only famous people who get deepfaked? A: No. A few photos or a short video from social media can be enough to imitate an ordinary person. Q: Can a live video call really be fake? A: Yes. Real-time face and voice swapping tools exist and are used in business payment fraud and romance scams. ## Rental and holiday booking scams URL: https://tapsafely.com/scams/rental-scams Housing is tight in many cities, and scammers know it. They copy real listings, lower the price, and ask for a deposit before you can see the place. Holiday versions copy real hotels and villas. ### How it works Scammers copy photos and descriptions from real listings, post them at an attractive price on rental sites, social media groups or classifieds, and move the conversation to email or WhatsApp. They explain why you can't view the property, then ask for a deposit, first month's rent or a “holding fee” by bank transfer or a money transfer service. Some send a fake contract to seem official. Holiday versions use fake villas, cloned hotel websites or messages that pretend to come from a booking platform, asking you to pay outside the platform. ### Red flags - You can't view the property: The owner is abroad, busy or “in hospital”, and keys will be posted after payment. - Payment before viewing or signing: Especially by bank transfer, money transfer, crypto or gift cards. - The price is well below similar places: A bargain in a high-demand area is a classic lure. - Pressure to pay today: “Lots of people are interested” is meant to rush you. - Paying outside the booking platform: Real hosts don't ask you to pay by bank transfer or through a link sent by message. ### What to do - View the property in person, or through a trusted person, before paying anything. - Do a reverse image search of the listing photos to see if they appear elsewhere under another name or city. - Check that the landlord or agent really owns or manages the property where your country allows it, and use registered agents. - Keep bookings and payments inside the platform, and use payment methods with buyer protection. ### If you already paid or shared details - Contact your bank or payment provider immediately and ask them to recall the transfer. - Report the listing to the website or group where you found it. - Report it to the police or the official fraud service in your country. ### Questions Q: Is a signed contract proof that it's real? A: No. Scammers send convincing fake contracts and copied ID documents. Q: The booking platform emailed me asking to pay by transfer. Is that normal? A: No. Log in to the platform directly and check your booking and messages there. ## Fake charity and disaster appeal scams URL: https://tapsafely.com/scams/fake-charity-scams When disaster strikes, people want to help quickly. Scammers take advantage with fake charities, copied appeals and emotional crowdfunding pages that send the money to their own accounts. ### How it works Fake appeals appear on social media, messaging apps, email and even door to door, often within hours of a disaster. They use real photos, copy the names of real charities, or invent official-sounding ones. Crowdfunding scams tell a moving personal story that isn't true, or collect money in the name of real victims without their knowledge. ### Red flags - Pressure to give immediately: Real charities welcome donations tomorrow too. - Payment by bank transfer to a person, crypto or gift cards: Registered charities offer secure, traceable ways to donate. - A name that sounds almost like a well-known charity: Small spelling changes and new web addresses are common. - No registration details: Genuine charities can usually be found on their country's official charity register. - Vague claims about where money goes: “100% goes directly to families” with no details of how. ### What to do - Give through charities you already know, by typing their website address yourself. - Check the charity on your country's official charity register where one exists. - Check the donation link with the TapSafely checker before paying. - On crowdfunding sites, look for a clear connection between the organiser and the people being helped. ### If you already paid or shared details - Contact your bank or card provider and explain that you donated to a fake appeal. - Report the page or post to the platform where you saw it. - Report it to the official fraud service in your country. ### Questions Q: Are all crowdfunding appeals risky? A: No, many are genuine. Look for verified organisers, updates, and a clear link to the people or cause being helped. ## Where to report scams See https://tapsafely.com/been-scammed for official reporting services in 34 countries. # Fake brand messages: what the real organisations say ## USPS scam texts: how to spot a fake URL: https://tapsafely.com/scams/usps-scam-texts USPS says it will not send you texts or emails unless you first asked for updates using a tracking number, and those messages will not contain a link. Genuine USPS text tracking uses a short code that you start yourself. Real web addresses: usps.com, uspis.gov Common fakes: - Package on hold because of an incomplete address, with a link to update it - Unpaid postage or redelivery fee payment link - Missed delivery notice asking you to click to reschedule - Request to update shipping preferences - Fake USPS page asking for card number, PIN or Social Security number How to check: - Type usps.com into your browser yourself and enter your tracking number there - If you did not request tracking for a package, ignore the text - Check shipping and tracking details with the retailer or account you ordered from - For tracking by text, send your tracking number to 28777 (2USPS) yourself How to report: - Email USPS-related scam texts to the US Postal Inspection Service at spam@uspis.gov, with a screenshot showing the sender number and date (https://www.uspis.gov/news/scam-article/smishing-package-tracking-text-scams) - Forward the scam text to 7726 (SPAM) to alert your mobile carrier (https://www.uspis.gov/news/scam-article/smishing-package-tracking-text-scams) - Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov (https://consumer.ftc.gov/consumer-alerts/2025/04/think-text-message-usps-it-could-be-scam) Sources: U.S. Postal Inspection Service, Smishing (https://www.uspis.gov/news/scam-article/smishing-package-tracking-text-scams); Federal Trade Commission, Think that text message is from USPS? It could be a scam (https://consumer.ftc.gov/consumer-alerts/2025/04/think-text-message-usps-it-could-be-scam); USPS, Text Tracking FAQs (https://www.usps.com/text-tracking/welcome.htm) ## Royal Mail scam texts: how to spot a fake URL: https://tapsafely.com/scams/royal-mail-scam-texts Royal Mail says it only sends email and text notifications when the sender asked for them on a tracked service, and the only time it asks for payment by email or text is when a customs fee is due. It never asks for card numbers, passwords or personal details by email, or asks you to enter details on a page that is not part of Royal Mail. Real web addresses: royalmail.com Common fakes: - Text asking for a small fee (about 1 to 3 pounds) to reschedule a delivery - Fake customs charge or failed delivery email - Link to confirm parcel details on a lookalike site - Fake Royal Mail stamp shops offering big discounts - Missed parcel text that tries to get you to install a fake tracking app How to check: - Enter the tracking number yourself at royalmail.com/track-your-item - Genuine fees are usually explained on a grey Fee to Pay card left by Royal Mail - Type royalmail.com into your browser instead of tapping links in messages How to report: - Forward scam emails, or send a screenshot of scam texts, to reportascam@royalmail.com (https://www.royalmail.com/help/scam-examples) - Forward the scam text to 7726, free on most UK networks (https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-text-message) - If you lost money, report it to Report Fraud (reportfraud.police.uk), or to Police Scotland on 101 in Scotland (https://www.reportfraud.police.uk/) Sources: Royal Mail, Help with online security (https://www.royalmail.com/help/scam-protection); Royal Mail, Typical online scams to look out for (https://www.royalmail.com/help/scam-examples); National Cyber Security Centre, Report a scam text message (https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-text-message) ## DHL scam messages: how to spot a fake URL: https://tapsafely.com/scams/dhl-scam-messages DHL says the only payments it requests by email or SMS are customs duties and taxes, and a one-time passcode is sent to the recipient's registered contact before payment. Official DHL emails come from dhl.com and related DHL domains, never from free services like Gmail or Yahoo. Real web addresses: dhl.com, dpdhl.com, dhl-news.com, dhl.de Common fakes: - Customs duty or tax payment link for a held shipment - Text with a shortened link (such as bit.ly) from a generic sender name like Delivery - Text from a phone number with an unexpected foreign country code - Phishing email with an urgent tone or a fake shipping attachment - Fake DHL social media accounts or job offers How to check: - Enter your tracking number yourself on the official DHL tracking page at dhl.com - Check that any email comes from dhl.com or another official DHL domain, not a free email service - Legitimate customs payment requests include a one-time passcode sent to your registered contact - Send shipment or invoice questions to DHL customer support via dhl.com How to report: - Forward scam emails as attachments, or send screenshots of scam texts and social media accounts, to phishing@dhl.com (https://www.dhl.com/global-en/home/footer/fraud-awareness.html) Sources: DHL, Fraud Awareness (https://www.dhl.com/global-en/home/footer/fraud-awareness.html); DHL, DHL Tracking (https://www.dhl.com/global-en/home/tracking.html) ## FedEx scam texts: how to spot a fake URL: https://tapsafely.com/scams/fedex-scam-texts FedEx says it does not ask for payment or personal information in exchange for releasing a package, and does not request account details by unsolicited mail, email or text. It may send secure links to pay duties and taxes on international shipments, which you can check with the FedEx Import Tool. Real web addresses: fedex.com Common fakes: - Text with a tracking code asking you to set delivery preferences - Failed delivery email with a harmful attachment - Fake survey or free prize that asks for a card to pay shipping - Fee demanded to release a held package or ATM card - Links to lookalike or misspelled domains such as fedx or fed-ex How to check: - Enter your tracking number yourself at fedex.com/en-us/tracking.html - For international duties and taxes, verify the request with the FedEx Import Tool - Check that the sender uses fedex.com and not a misspelled domain - Contact FedEx using a website or number you know is real, not details from the message How to report: - Email suspicious FedEx messages to abuse@fedex.com, or call the FedEx fraud department on the number listed on its report fraud page (https://www.fedex.com/en-us/trust-center/report-fraud.html) - Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov (https://consumer.ftc.gov/consumer-alerts/2020/02/text-message-about-your-fedex-package-really-scam) Sources: FedEx, Report Fraud (https://www.fedex.com/en-us/trust-center/report-fraud.html); Federal Trade Commission, Is that text message about your FedEx package really a scam? (https://consumer.ftc.gov/consumer-alerts/2020/02/text-message-about-your-fedex-package-really-scam); FedEx, FedEx Tracking (https://www.fedex.com/en-us/tracking.html) ## UPS scam texts: how to spot a fake URL: https://tapsafely.com/scams/ups-scam-texts UPS says it does not ask for payments, personal or financial information, account numbers, IDs or passwords in unsolicited emails, mail, phone calls or faxes. The only legitimate charges are collect on delivery, duties or taxes, and these can be checked through tracking on ups.com. Real web addresses: ups.com Common fakes: - Text about a delivery with a link to a harmful site or malware - Request for a delivery fee before a package can be delivered - Email asking you to verify account or payment details - Fake websites made to look like ups.com - Job offers involving processing checks, reshipping or returns How to check: - Open a new browser, go to ups.com yourself and enter the tracking number - Log in to your UPS account on ups.com to check any billing - If someone calls, get their name and call UPS back on an official number from ups.com How to report: - Report suspicious UPS emails, texts or websites using the fraud email form linked from the UPS fight fraud page (https://www.ups.com/us/en/support/shipping-support/legal-terms-conditions/fight-fraud) - Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov (https://www.ups.com/us/en/support/shipping-support/legal-terms-conditions/fight-fraud) Sources: UPS, Protect Yourself From Fraud and Scams (https://www.ups.com/us/en/support/shipping-support/legal-terms-conditions/fight-fraud); UPS, Learn to Recognize Fraud (https://www.ups.com/us/en/support/shipping-support/legal-terms-conditions/learn-to-recognize-fraud) ## Evri scam texts: how to spot a fake URL: https://tapsafely.com/scams/evri-scam-texts Evri says it will never ask you to pay or to reschedule a delivery by text or email, and will never ask you to install an app. Genuine Evri texts show the sender as Evri rather than a mobile number, and the only links are tracking links starting https://evri.link/. Real web addresses: evri.com, evri.link, hermes-europe.co.uk, myhermes.co.uk Common fakes: - Text asking for a small fee to reschedule a missed delivery - Email with a generic Dear Customer greeting and an unfamiliar link - Message urging you to act quickly without giving real parcel details - Prompt to install an app to track or release a parcel - Unexpected parcels sent to you as part of a brushing scam How to check: - Track your parcel yourself at evri.com/track - Check the text sender shows as Evri, not a mobile number, and emails come from evri.com - Contact Evri using the details on evri.com, not the numbers or addresses in the message How to report: - Forward scam texts to 7726, free on most UK networks (https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-text-message) - Forward scam emails to report@phishing.gov.uk (https://www.evri.com/cyber-security) Sources: Evri, How to spot and report fraud (https://www.evri.com/cyber-security); Evri, Is this Evri text or email genuine? (https://www.evri.com/faqs/receiving-a-parcel/is-this-evri-text-email-genuine); National Cyber Security Centre, Scam missed parcel SMS messages (https://www.ncsc.gov.uk/guidance/scam-missed-parcel-sms-messages) ## Australia Post scam texts: how to spot a fake URL: https://tapsafely.com/scams/australia-post-scam-texts Australia Post says it will never call, text or email you asking for personal or financial details such as passwords or card numbers, or to request payment. Its tracking texts no longer include links and instead point you to auspost.com.au or the AusPost app. Real web addresses: auspost.com.au Common fakes: - Undelivered parcel message asking for action or a fee - Request to verify or update your delivery address - Link to schedule a redelivery - Confirm your details message with a fake tracking number - Unexpected call asking for payment How to check: - Check tracking in the official AusPost app with notifications turned on - Type auspost.com.au yourself instead of using links in messages - Genuine texts use the registered sender names AusPost or StarTrack, so be wary of messages marked Unverified - Do not use contact numbers given in the message, look them up yourself How to report: - Send Australia Post themed scams to scams@auspost.com.au (reports only, no personal reply) (https://auspost.com.au/about-us/about-our-site/online-security-scams-fraud) - Report the scam to Scamwatch, run by the ACCC (https://www.scamwatch.gov.au/report-a-scam) Sources: Australia Post, Online security, scams and fraud (https://auspost.com.au/about-us/about-our-site/online-security-scams-fraud); Australia Post, Scam alerts (https://auspost.com.au/about-us/about-our-site/online-security-scams-fraud/scam-alerts); Scamwatch (ACCC), Report a scam (https://www.scamwatch.gov.au/report-a-scam) ## Canada Post scam texts: how to spot a fake URL: https://tapsafely.com/scams/canada-post-scam-texts Canada Post says it will never text you or send unsolicited email asking for card or banking details, login details, or payment to track or release a delivery. It does not charge you to track or release a delivery. Real web addresses: canadapost-postescanada.ca, canadapost.ca Common fakes: - Package held in a warehouse, confirm a small payment to deliver it - Link to arrange delivery of a package - Reward offered as an apology for a bad delivery experience - Social media giveaway of phones that only asks for a shipping fee How to check: - Enter your tracking number yourself at canadapost-postescanada.ca - Genuine Canada Post texts come only from the short codes and numbers listed on its support page - Canada Post leaves a delivery notice card at your door rather than sending unsolicited emails - Contact Canada Post directly through its website if unsure How to report: - Forward spam texts to 7726 (SPAM) (https://www.canadapost-postescanada.ca/cpc/en/support/kb/company-policies/privacy-security/what-do-to-if-you-get-suspicious-email.page) - Report fraud to the Canadian Anti-Fraud Centre online or by phone (https://antifraudcentre-centreantifraude.ca/report-signalez-eng.htm) Sources: Canada Post, Recognizing spam, fraudulent emails and text messages (https://www.canadapost-postescanada.ca/cpc/en/support/kb/company-policies/privacy-security/what-do-to-if-you-get-suspicious-email.page); Canada Post, Protecting yourself against brand-spoofing fraudsters (https://www.canadapost-postescanada.ca/blogs/personal/perspectives/protecting-yourself-against-brand-spoofing-fraudsters/); Canadian Anti-Fraud Centre, Report fraud and cybercrime (https://antifraudcentre-centreantifraude.ca/report-signalez-eng.htm) ## Amazon scam messages: how to spot a fake URL: https://tapsafely.com/scams/amazon-scam-messages Amazon says it will only take payment on its website, in its app or in its physical stores, never over the phone or by email, and it will never ask you to buy gift cards. It also says it will not ask you to install software or give remote access to your device to get customer service. Real web addresses: amazon.com, amazon.jobs Common fakes: - Fake order confirmations or shipping updates for purchases you did not make - Calls or messages claiming a problem with your account that needs your password or a one-time code - Fake refund offers or product recall emails with links to non-Amazon websites - Requests to pay with gift cards or to install remote access software - Job offers promising high daily pay for simple remote tasks How to check: - Open the Amazon app or type the Amazon website address yourself and check Your Orders - Look in the Message Center in your Amazon account, where genuine Amazon messages also appear - In Gmail, Yahoo and other common email apps, look for the Amazon smile logo icon next to genuine Amazon emails - Do not call phone numbers from an unexpected text or email, contact Amazon through its app or website instead How to report: - Report a suspicious message, call or website using the report a scam page at amazon.com/reportascam (https://trustworthyshopping.aboutamazon.com/focus/scam-prevention) - Email reportascam@amazon.com, which also works if you are not an Amazon customer (https://trustworthyshopping.aboutamazon.com/focus/scam-prevention) Sources: Amazon, 6 tips to help you spot and avoid scams impersonating Amazon (https://www.aboutamazon.com/news/retail/how-to-avoid-amazon-scams); Amazon, How Amazon Protects Customers from Scams (https://trustworthyshopping.aboutamazon.com/focus/scam-prevention); Amazon, The latest scam trends from Amazon (https://trustworthyshopping.aboutamazon.com/amazon-scam-trends) ## PayPal scam emails: how to spot a fake URL: https://tapsafely.com/scams/paypal-scam-emails PayPal says genuine messages address you by the full name on your PayPal account, and that passwords and verification codes should never be shared with anyone, not even someone claiming to be PayPal customer service. It advises never giving personal, card or account details by email, text or phone. Real web addresses: paypal.com Common fakes: - Emails with generic greetings such as Dear user or Hello PayPal member - Urgent warnings that your account will be limited unless you act immediately - Links asking you to log in or verify your account on a look alike website - Unexpected attachments that may contain malware - Phone calls with a faked caller ID asking for codes or account details How to check: - Open the PayPal app or type www.paypal.com into a new browser window and log in to see any real alerts - Check the greeting, as genuine PayPal messages use the full name on your account - Look for the PayPal logo with a checkmark next to the message in supported email inboxes - Contact PayPal only through the Contact page in the PayPal Help Center How to report: - Forward the whole suspicious email, or a suspicious text message, to phishing@paypal.com, then delete it (https://www.paypal.com/us/security/report-suspicious-messages) Sources: PayPal, Report suspicious messages (https://www.paypal.com/us/security/report-suspicious-messages); PayPal, Learn about fake messages (https://www.paypal.com/us/security/learn-about-fake-messages) ## Netflix scam emails: how to spot a fake URL: https://tapsafely.com/scams/netflix-scam-emails Netflix says it will never ask for your card numbers, bank details or Netflix password in a text or email. It also says it never asks for payment through a third party vendor or website. Real web addresses: netflix.com Common fakes: - Emails or texts saying your payment failed and your membership will be suspended - Links to fake Netflix login or payment pages - Fake websites, apps or phone numbers pretending to be Netflix customer service - Messages asking you to confirm your password or card details How to check: - Do not tap the link, go to netflix.com yourself or open the Netflix app and check your account - Check the sender address and hover over or press and hold links to see where they really go - Review signed in devices in Manage Access and Devices and sign out any you do not recognise How to report: - Forward suspicious emails or text messages, and details of fake websites, apps or phone numbers, to phishing@netflix.com (https://help.netflix.com/en/node/65674) Sources: Netflix, Phishing or suspicious emails or texts claiming to be from Netflix (https://help.netflix.com/en/node/65674); Netflix, How to keep your account secure (https://help.netflix.com/en/node/13243) ## Apple scam messages: how to spot a fake URL: https://tapsafely.com/scams/apple-scam-messages Apple says it will never ask for your password, device passcode or two-factor authentication code, and will never ask you to enter them on a website. It also says it will never ask you to turn off any security feature on your device or account. Real web addresses: apple.com, icloud.com Common fakes: - Fake App Store or Apple Music receipts for purchases you did not make - Pop-ups falsely warning that your device has a security problem - Unexpected calls from people claiming to be Apple Support - Fake promotions offering free Apple products - Messages with links asking you to update your Apple Account details How to check: - Check purchases and account details in Settings on your iPhone or iPad, or sign in at account.apple.com yourself - Genuine App Store receipts include your current billing address, which scammers are unlikely to have - Check that the link address matches Apple's real website before tapping it - If you get an unexpected call claiming to be Apple Support, hang up and contact Apple directly How to report: - Forward suspicious emails, or screenshots of suspicious texts, to reportphishing@apple.com (https://support.apple.com/en-us/102568) - In the Messages app, tap Report Junk under a suspicious message (https://support.apple.com/en-us/102568) Sources: Apple, Recognize and avoid social engineering schemes including phishing messages, phony support calls, and other scams (https://support.apple.com/en-us/102568); Apple, Identify legitimate emails from the App Store or iTunes Store (https://support.apple.com/en-us/102406) ## Microsoft scam calls and emails: how to spot them URL: https://tapsafely.com/scams/microsoft-scam-calls-and-emails Microsoft says it does not make unsolicited calls or send unsolicited emails asking for personal or financial information, and its real error messages never include a phone number. It also says it will never ask you to pay for support with cryptocurrency or gift cards. Real web addresses: microsoft.com, accountprotection.microsoft.com Common fakes: - Unexpected calls from fake Microsoft technicians who want remote access to your computer - Browser pop-ups or fake blue screen errors telling you to call a support number - Emails urging you to click, call or open an attachment immediately - Links to look alike addresses with small misspellings of microsoft.com - Requests to pay for support with gift cards or cryptocurrency How to check: - Treat any pop-up or error message that shows a phone number as a scam, genuine Microsoft errors never include one - Microsoft account emails from an address ending in @accountprotection.microsoft.com are genuine, and you can check the message headers to confirm - Hover over links without clicking to see the real web address - Get help only through Microsoft's official support website rather than numbers in pop-ups, calls or emails How to report: - Report tech support scams to Microsoft at www.microsoft.com/reportascam (https://support.microsoft.com/en-us/windows/protect-yourself-from-tech-support-scams-2ebf91bd-f94c-2a8a-e541-f5c800d18435) - In Outlook, select the message and choose Report, then Report phishing. From other email apps, send the phishing email as an attachment to phish@office365.microsoft.com (https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44) - Report a suspicious website with Microsoft's report unsafe site tool at microsoft.com/wdsi/support/report-unsafe-site (https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44) Sources: Microsoft, Protect yourself from tech support scams (https://support.microsoft.com/en-us/windows/protect-yourself-from-tech-support-scams-2ebf91bd-f94c-2a8a-e541-f5c800d18435); Microsoft, Protect yourself from phishing (https://support.microsoft.com/en-us/windows/protect-yourself-from-phishing-0c7ea947-ba98-3bd9-7184-430e1f860a44); Microsoft, Can I trust email from the Microsoft account team? (https://support.microsoft.com/en-us/account-billing/can-i-trust-email-from-the-microsoft-account-team-685fd302-f52f-1a9f-cc13-065dec46fe25) ## WhatsApp scams: how to spot them and stay safe URL: https://tapsafely.com/scams/whatsapp-scams WhatsApp says the app is free and you never have to pay to use it, and warns against sharing card or bank details, your birth date or passwords in chats. It advises setting a two-step verification PIN and never sharing it with anyone. Real web addresses: whatsapp.com Common fakes: - Messages from a new number pretending to be a friend or family member who needs money - Job offers promising high pay for simple work from home - Investment offers promising low risk and high returns - Messages asking you to tap a link, activate a new feature or download an app - Claims that you must pay to keep using WhatsApp How to check: - If a contact claims to be someone you know, call them on the number you already have or ask a question only they would know - Make a voice or video call to confirm who you are talking to - Do not tap links, share details or forward messages from contacts you are unsure about How to report: - Report the message or contact inside WhatsApp, then block the sender and delete the message. WhatsApp does not tell the sender you reported them (https://www.whatsapp.com/security) Sources: WhatsApp, About suspicious messages and scams (https://faq.whatsapp.com/2286952358121083); WhatsApp, WhatsApp Security (https://www.whatsapp.com/security); Meta, New WhatsApp Tools and Tips to Beat Messaging Scams (https://about.fb.com/news/2025/08/new-whatsapp-tools-tips-beat-messaging-scams/) ## Facebook and Instagram scams: how to spot them URL: https://tapsafely.com/scams/facebook-instagram-scams Meta says it will never ask for your password in an email or Facebook message, and Instagram says it will never send you a direct message about your account. Instagram contacts you about your account through the Emails from Instagram section in your settings. Real web addresses: facebook.com, instagram.com, facebookmail.com Common fakes: - Direct messages claiming your account will be banned or has broken copyright rules - Messages saying your photos are being shared elsewhere, with a link to log in - Fake celebrity endorsements and giveaways in ads that lead to scam websites - Fake customer support pages pretending to represent well known companies - Suspicious job offers and cryptocurrency investment pitches in messages How to check: - On Instagram, check the Emails from Instagram section in your settings, which is the only place for genuine account messages from Instagram - For Facebook, check that an email came from facebookmail.com and compare it with the recent emails listed in your Security and Login settings - Open the Facebook or Instagram app yourself instead of tapping links in messages How to report: - Report the message, post or profile inside Instagram (tap the three dots, or press and hold a message) and block the account (https://about.fb.com/news/2021/07/keeping-instagram-safe-and-secure/) - Report suspicious ads and scam content with the in-app reporting tools on Facebook and Instagram (https://about.fb.com/news/2024/10/testing-combat-scams-restore-compromised-accounts/) Sources: Meta, Our Commitment to Keeping People Safe (https://about.fb.com/news/2020/02/keeping-people-safe/); Meta, Keeping Instagram Safe and Secure (https://about.fb.com/news/2021/07/keeping-instagram-safe-and-secure/); Meta, Testing New Ways to Combat Scams and Help Restore Access to Compromised Accounts (https://about.fb.com/news/2024/10/testing-combat-scams-restore-compromised-accounts/) ## Booking.com scam messages: how to spot a fake URL: https://tapsafely.com/scams/booking-com-scam-messages Booking.com says no genuine transaction or reservation change will ever require you to pay with gift cards or give your card details by phone, text message or email. It advises never sharing payment details through email, text or messaging apps. Real web addresses: booking.com Common fakes: - Urgent messages saying your booking will be cancelled unless you confirm your card details - Requests to pay by bank transfer in advance - Attempts to move the conversation off Booking.com to another messaging app - Messages with spelling mistakes, mixed languages or odd sender addresses - Payment links that lead to fake Booking.com pages How to check: - Open the Booking.com app or website yourself and check your booking confirmation and payment details there - Check that the web address matches the real booking.com domain before entering any details - Keep all messages and payments on the Booking.com platform - Contact Booking.com customer service through official channels if a payment request seems odd How to report: - Contact Booking.com customer service, which is available 24 hours a day, through the official app or website to report suspicious messages or payment requests (https://news.booking.com/de/booking-tipps-fuer-mehr-sicherheit-bei-der-online-reisebuchung/) Sources: Booking.com, Online Travel Scams Are on The Rise. Here's How to Stay Safe (https://news.booking.com/online-travel-scams-are-on-the-rise-heres-how-to-stay-safe/); Booking.com, Sommerferien 2026: Booking.com-Tipps für mehr Sicherheit bei der Online-Reisebuchung (https://news.booking.com/de/booking-tipps-fuer-mehr-sicherheit-bei-der-online-reisebuchung/) ## HMRC scam texts and calls: how to spot them URL: https://tapsafely.com/scams/hmrc-scam-texts-and-calls HMRC says it will never tell you about a tax rebate or ask for personal or payment details by text message, and only emails about rebates from addresses ending in hmrc.gov.uk. It also says it will never threaten arrest, leave voicemails threatening legal action, or ask you to pay with gift or payment vouchers. Real web addresses: gov.uk, hmrc.gov.uk, tax.service.gov.uk Common fakes: - Unexpected tax refund or rebate offers sent by text, email or social media - Calls or voicemails threatening arrest or legal action over unpaid tax - Messages asking for bank or card details to receive a refund or grant - Pressure to transfer money or pay with gift or payment vouchers - Contact through WhatsApp claiming to be HMRC How to check: - Do not use links or numbers in the message; sign in to your HMRC online account by typing gov.uk into your browser - Check the contact against HMRC's list of genuine HMRC contacts on GOV.UK - Remember HMRC does not send tax rebate notices by text, so treat any such text as a scam How to report: - Forward suspicious HMRC texts to 60599 (charged at your network rate) and forward suspicious emails to phishing@hmrc.gov.uk (https://www.gov.uk/government/organisations/hm-revenue-customs/contact/reporting-fraudulent-emails) - Report suspicious phone calls using HMRC's online suspicious phone call form, and report fake social media accounts to branddefence@hmrc.gov.uk (https://www.gov.uk/government/organisations/hm-revenue-customs/contact/reporting-fraudulent-emails) Sources: HM Revenue and Customs (GOV.UK), Report suspicious HMRC emails, text messages and phone calls (https://www.gov.uk/government/organisations/hm-revenue-customs/contact/reporting-fraudulent-emails); HM Revenue and Customs (GOV.UK), Identify tax scam phone calls, emails and text messages (https://www.gov.uk/guidance/identify-hmrc-related-scam-phone-calls-emails-and-text-messages) ## IRS scam calls and texts: how to spot them URL: https://tapsafely.com/scams/irs-scam-calls-and-texts The IRS says it normally makes first contact by mail, only emails or texts people who have opted in, and never sends direct messages on social media. It does not make threatening, rushed demands or ask for payment by gift card or wire transfer. Real web addresses: irs.gov Common fakes: - Unsolicited texts or emails about a tax refund or credit with a link to claim it - Calls threatening arrest or deportation unless you pay immediately - Demands for payment by gift card or wire transfer - Social media messages or posts promoting fake credits or refunds - Requests for personal or financial information to verify your identity How to check: - Sign in to your IRS online account at irs.gov to see any balance or notices - Look up any letter or notice using the IRS search for notices and letters - Remember first contact is normally by mail, and a social media direct message is never from the IRS How to report: - Email phishing@irs.gov (for texts use the subject Text and include the sender number, message, date and time), or forward the text to 7726 (SPAM) (https://www.irs.gov/help/report-fraud/report-fake-irs-treasury-or-tax-related-emails-and-messages) - Report IRS impersonation to the Treasury Inspector General for Tax Administration (TIGTA) at tigta.gov (https://www.irs.gov/help/report-fraud/report-fake-irs-treasury-or-tax-related-emails-and-messages) Sources: Internal Revenue Service, Report fake IRS, Treasury or tax-related emails and messages (https://www.irs.gov/help/report-fraud/report-fake-irs-treasury-or-tax-related-emails-and-messages); Internal Revenue Service, How to know it's the IRS (https://www.irs.gov/help/how-to-know-its-the-irs); Internal Revenue Service, Recognize tax scams and fraud (https://www.irs.gov/help/tax-scams/recognize-tax-scams-and-fraud) ## E-ZPass and unpaid toll texts: how to spot a fake URL: https://tapsafely.com/scams/e-zpass-toll-scam-texts The E-ZPass Group says it does not hold customer accounts or collect tolls, so any message saying it is owed toll money is a scam, and advises going directly to your toll agency's website instead of using links or numbers in a text. New York's E-ZPass says it will never text or email asking for sensitive details such as card numbers or Social Security numbers. Real web addresses: e-zpassgroup.org, e-zpassny.com Common fakes: - Texts claiming you owe a small unpaid toll with a link to pay - Threats of late fees or penalties if you do not pay quickly - Links to fake toll payment sites that collect card details and driver's license numbers - Nearly identical messages sent from changing phone numbers across many states How to check: - Go directly to your own state's toll agency website by typing the address yourself, not from the text - Call your toll agency using a customer service number you know is real - Check your toll account online for any genuine balance How to report: - Forward the text to 7726 (SPAM) or use your phone's report junk option, then delete it (https://consumer.ftc.gov/consumer-alerts/2025/01/got-text-about-unpaid-tolls-its-probably-scam) - File a complaint with the FBI Internet Crime Complaint Center, including the sender's phone number and the website link in the text (https://www.ic3.gov/) Sources: Federal Trade Commission, Got a text about unpaid tolls? It's probably a scam (https://consumer.ftc.gov/consumer-alerts/2025/01/got-text-about-unpaid-tolls-its-probably-scam); FBI Internet Crime Complaint Center (IC3), Smishing Scam Regarding Debt for Road Toll Services (https://www.ic3.gov/PSA/2024/PSA240412); E-ZPass Group, E-ZPass Group home page scam warning (https://www.e-zpassgroup.org/) ## eBay scam messages: how to spot a fake URL: https://tapsafely.com/scams/ebay-scam-messages eBay says it will never ask you for confidential information such as your password or card details, will not use threatening language, and will not include attachments in its emails. Real web addresses: ebay.com Common fakes: - Urgent or threatening emails telling you to act quickly on your account - Generic greetings such as Attention eBay member - Links to lookalike web addresses such as signin-ebay style domains - Requests for full card numbers, PINs or passwords - Phone calls claiming to be eBay asking for account details How to check: - Check Messages in My eBay; if eBay sent the message, a copy will appear there too - Type the eBay address into your browser yourself instead of using a link - Look carefully at the web address for misspellings or extra words How to report: - Forward suspicious emails as an attachment to spoof@ebay.com, then delete them (https://www.ebay.com/help/account/protecting-account/recognizing-phishing-phone-calls-emails?id=4195) Sources: eBay, Recognizing phishing phone calls and emails (https://www.ebay.com/help/account/protecting-account/recognizing-phishing-phone-calls-emails?id=4195) ## Coinbase scam messages: how to spot a fake URL: https://tapsafely.com/scams/coinbase-scam-messages Coinbase says its support agents will never ask for your password, 2-step verification code or seed phrase, ask you to move or secure your funds, or ask you to install software or remotely access your device. It also says it will never call or text you with a new seed phrase or wallet address to move funds to. Real web addresses: coinbase.com, help.coinbase.com, mail.coinbase.com Common fakes: - Calls or texts from fake Coinbase support saying your account is compromised - Requests to move funds to a new safe wallet or seed phrase - Requests for your password or 2-step verification code - Instructions to install remote access software - Spoofed caller IDs and lookalike web addresses such as misspelled Coinbase domains How to check: - Go to coinbase.com directly by typing it, not through a link - Contact Coinbase only through the official Contact Us page on its Help Center - Check that emails come from an official coinbase.com address listed in Coinbase Help - If something seems wrong, lock your account from the official site or app How to report: - Email security@coinbase.com with the full URL of a phishing site, full headers of a phishing email, or screenshots of a scam text (https://help.coinbase.com/en/coinbase/privacy-and-security/avoiding-phishing-and-scams/reporting-phishing-sites) - Forward scam text messages to 7726 (SPAM) (https://help.coinbase.com/en/coinbase/privacy-and-security/avoiding-phishing-and-scams/reporting-phishing-sites) Sources: Coinbase Help, Technical support and impersonation scams (https://help.coinbase.com/en/coinbase/privacy-and-security/avoid-scams/tech-support-scams); Coinbase Help, Reporting phishing sites (https://help.coinbase.com/en/coinbase/privacy-and-security/avoiding-phishing-and-scams/reporting-phishing-sites) ## Binance scam messages: how to spot a fake URL: https://tapsafely.com/scams/binance-scam-messages Binance says it will never request funds or tokens through private communications, and warns that any message telling you to move your assets to a secure wallet is a scam. Real web addresses: binance.com Common fakes: - Spoofed SMS messages that appear to come from Binance - Fake Binance support agents contacting you directly - Threats that your account will expire unless you move assets to a secure wallet - Fake social media or Telegram accounts impersonating Binance How to check: - Use Binance Verify on binance.com to check a link, email address, phone number or social account, no account needed - Turn on your anti-phishing code and ignore emails that do not show it - Type binance.com yourself rather than using links in messages How to report: - Report scams through the Binance scam report page, the Report Scam button on a transaction, or Binance support chat (https://www.binance.com/en/support/faq/how-to-report-scams-on-binance-support-49b6dbdd87ed4c60b527375918ab5683) Sources: Binance, Binance Verify (https://www.binance.com/en/official-verification); Binance, How to Prevent Phishing Attacks (https://www.binance.com/en/support/faq/how-to-prevent-phishing-attacks-360020819031); Binance, How to Report Scams on Binance Support (https://www.binance.com/en/support/faq/how-to-report-scams-on-binance-support-49b6dbdd87ed4c60b527375918ab5683) ## Zelle scams: how to spot them and stay safe URL: https://tapsafely.com/scams/zelle-scams Zelle tells people not to give out any information when someone calling claims to be from their bank, and to hang up and ring the number on the back of their debit card or on the bank's official website instead. Because Zelle works through your own bank or credit union, problems are handled by that bank, and the FTC notes a real bank will never contact you to tell you to move money or to ask for passcodes. Real web addresses: zelle.com, zellepay.com Common fakes: - Fake bank fraud alert text asking if you approved a Zelle payment - Caller posing as your bank telling you to send money to yourself to reverse a charge - Request to read out a one-time code to cancel a payment - Marketplace seller or landlord who insists on Zelle before you see the item - Message saying you won a prize but must pay a fee to collect it How to check: - Do not reply to the text or trust a caller who contacts you first, even if the caller ID shows your bank - Hang up and call the number on the back of your debit card or on your bank's official website - Check your transaction history in your own banking app, not through a link - Only use Zelle with people you know and trust, since payments are hard to get back How to report: - Report the payment to your bank or credit union straight away, or call Zelle support if you use the Zelle app (https://www.zelle.com/support/report-scam) - Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov (https://reportfraud.ftc.gov/) Sources: Zelle, Report a Fraud or Scam (https://www.zelle.com/support/report-scam); Zelle, Tips for Safe Payments (https://www.zelle.com/tips-safe-payments); Zelle, Understanding Fraud and Scams (https://www.zelle.com/understanding-fraud-scams); Federal Trade Commission, Do you use payment apps like Venmo, CashApp, or Zelle? Read this (https://consumer.ftc.gov/consumer-alerts/2023/08/do-you-use-payment-apps-venmo-cashapp-or-zelle-read) ## Cash App scams: how to spot them and stay safe URL: https://tapsafely.com/scams/cash-app-scams Cash App says it will never ask for your sign-in code or PIN, and anyone who does is not from Cash App. It asks you to report suspicious payments and contacts inside the app itself, where support is available by chat. Real web addresses: cash.app Common fakes: - Fake Cash App giveaway or cash flip that asks you to pay first - Fake support agent asking for your sign-in code or PIN - Payment sent to you by mistake with a request to send it back - Fake payment notification email or screenshot - Job offer that pays you through Cash App then asks for money back How to check: - Never share your sign-in code or PIN with anyone, including someone who says they are Cash App support - Open the Cash App app yourself and check your activity feed for real payments - Get help only through in-app chat or the contact details on cash.app - Be wary of anyone who asks you to pay a fee to receive money How to report: - Report the payment or account in the app: open the activity feed, select the transaction and tap Report (https://cash.app/security) - Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov (https://reportfraud.ftc.gov/) Sources: Cash App, Cash App Security (https://cash.app/security); Cash App, How to identify scams: red flags and safety tips (https://cash.app/outsmart-scams/how-to-identify-and-prevent-scams); Cash App, The most common types of scams and how they actually work (https://cash.app/learn/protect-your-money/the-most-common-types-of-scams-and-how-they-actually-work); Federal Trade Commission, Do you use payment apps like Venmo, CashApp, or Zelle? Read this (https://consumer.ftc.gov/consumer-alerts/2023/08/do-you-use-payment-apps-venmo-cashapp-or-zelle-read) ## Venmo scams: how to spot them and stay safe URL: https://tapsafely.com/scams/venmo-scams Venmo says nobody at Venmo will contact you to ask for your password or verification code, and it will never ask for remote access to your device, ask you to install another app, or ask you to send money to verify your account. Real Venmo emails greet you by your name rather than a generic greeting, and anything urgent can be found by signing in to the app. Real web addresses: venmo.com Common fakes: - Fake prize or cash reward with a link to claim it - Caller posing as Venmo support who asks for your verification code - Payment from a stranger followed by a request to refund it - Buyer who sends a fake payment screenshot - Friend's account asking for money after the profile was changed How to check: - Never share the verification code Venmo texts you with anyone - Open the Venmo app yourself to check for any real account notices - Check whether the message greets you by your full name, not 'Dear user' - Use the Help Center on venmo.com instead of phone numbers found in search results or messages How to report: - Forward fake Venmo emails as an attachment, or send a screenshot of the text showing the full phone number, to phishing@venmo.com (https://help.venmo.com/cs/articles/reporting-fake-or-suspicious-messages-or-emails-vhel245) - Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov (https://reportfraud.ftc.gov/) Sources: Venmo, Reporting Fake or Suspicious Messages or Emails (https://help.venmo.com/cs/articles/reporting-fake-or-suspicious-messages-or-emails-vhel245); Venmo, Common Scams on Venmo (https://help.venmo.com/cs/articles/common-scams-on-venmo-vhel167); Venmo, Venmo Security (https://venmo.com/about/security); Federal Trade Commission, Do you use payment apps like Venmo, CashApp, or Zelle? Read this (https://consumer.ftc.gov/consumer-alerts/2023/08/do-you-use-payment-apps-venmo-cashapp-or-zelle-read) ## Chase scam texts: how to spot a fake URL: https://tapsafely.com/scams/chase-bank-scam-texts Chase says it will never ask you to send money to yourself, and it will not ask you to send it your personal or account details. If a text, email or call about your account worries you, Chase asks you to contact it using the number on your card or statement. Real web addresses: chase.com Common fakes: - Fake fraud alert asking you to confirm a large purchase - Text saying your account is locked with a link to sign in - Caller posing as Chase staff who says your account has been hacked - Request to move money to a new 'secure' account or send it to yourself with Zelle - Request to share a one-time passcode to stop a payment How to check: - Do not tap the link; open the Chase app or type chase.com into your browser yourself - Call the number on the back of your card or on your statement - Never send money to yourself or to a 'safe' account because someone told you to - Treat Zelle, wires and gift cards like cash, since money sent to a scammer is hard to get back How to report: - Forward suspicious emails that claim to be from Chase to phishing@chase.com (https://www.chase.com/digital/resources/privacy-security/security/how-you-can-protect) - Forward the scam text to SPAM (7726) to alert your mobile carrier (https://www.chase.com/personal/credit-cards/education/credit-score/what-is-smishing) - Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov (https://reportfraud.ftc.gov/) Sources: Chase, How to spot scams (https://www.chase.com/digital/resources/privacy-security/security/how-to-spot-scams); Chase, How you can protect yourself (https://www.chase.com/digital/resources/privacy-security/security/how-you-can-protect); Chase, What is smishing (https://www.chase.com/personal/credit-cards/education/credit-score/what-is-smishing) ## Bank of America scam texts: how to spot a fake URL: https://tapsafely.com/scams/bank-of-america-scam-texts Bank of America says it may ask you to confirm account activity, but it will never ask for your password or verification code, or ask you to send money to it or anyone else as part of that check. It also says it will never text you asking for account details. Real web addresses: bankofamerica.com, bofa.com Common fakes: - Fake fraud alert asking you to reply or tap a link about a charge - Text saying your online banking has been suspended - Caller who says a bank employee is under investigation and your money must be moved - Request for your one-time verification code - Instructions to buy gift cards or crypto to protect your funds How to check: - Do not use any link or number from the message - Open the Bank of America app or type bankofamerica.com yourself to check alerts - Call the number on the back of your card or on your statement - Never share a password or verification code, even with someone who says they are from the bank How to report: - Forward suspicious emails that use Bank of America's name to abuse@bofa.com (https://web.bankofamerica.com/en/security/report-suspicious-activity) - Forward suspicious texts to 7726 (SPAM) to alert your mobile carrier (https://web.bankofamerica.com/en/security/report-suspicious-activity) - Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov (https://reportfraud.ftc.gov/) Sources: Bank of America, Report Suspicious Activity (https://web.bankofamerica.com/en/security/report-suspicious-activity); Bank of America, Learn About the Latest Scams (https://web.bankofamerica.com/en/security/library/review-scam-alert); Bank of America, What is smishing and how to prevent it (https://business.bankofamerica.com/en/resources/what-is-smishing-how-to-prevent-it) ## Wells Fargo scam texts: how to spot a fake URL: https://tapsafely.com/scams/wells-fargo-scam-texts Wells Fargo says it will never ask for your password, PIN or one-time access code by email or text, and it will never ask you to move money to anyone, including yourself, to reverse a transfer or get a refund. Most of its genuine texts come from a small set of short codes, such as 93557. Real web addresses: wellsfargo.com Common fakes: - Fake fraud alert asking you to reply or call about a transaction - Text saying your account is locked or your card is suspended - Request to share a one-time access code - Caller asking you to send money to yourself to reverse a transfer - Request to download screen sharing software How to check: - Check the sender: most real Wells Fargo texts come from 93557, 93733, 93729, 93767, 20342, 22981 or 93000 - Sign in through the Wells Fargo app or by typing wellsfargo.com yourself - Call the number on your card if you are unsure - Never share a one-time code or move money because someone contacted you How to report: - Email the suspicious message to reportphish@wellsfargo.com, then delete it (https://www.wellsfargo.com/privacy-security/fraud/report/phish/) - Forward suspicious texts to 7726 (SPAM) to alert your mobile carrier (https://www.wellsfargo.com/privacy-security/fraud/bank-scams/bank-imposter/) - Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov (https://reportfraud.ftc.gov/) Sources: Wells Fargo, Report Phishing (https://www.wellsfargo.com/privacy-security/fraud/report/phish/); Wells Fargo, Tips to Avoid Bank Imposter Scams (https://www.wellsfargo.com/privacy-security/fraud/bank-scams/bank-imposter/); Federal Trade Commission, How To Recognize and Avoid Phishing Scams (https://consumer.ftc.gov/articles/how-recognize-avoid-phishing-scams) ## Geek Squad scam emails: how to spot a fake URL: https://tapsafely.com/scams/geek-squad-scam-emails Best Buy says trusted brands, itself included, will not contact you asking for personal information or payment for a support issue unless you have already been in touch with them, and it generally does not make unsolicited calls. If you are unsure, it asks you to call 1-888-BEST BUY or use the contact options on BestBuy.com. Real web addresses: bestbuy.com Common fakes: - Invoice saying you were charged hundreds of dollars to renew Geek Squad - Urgent request to call a number within 24 hours to cancel - Refund offer that needs remote access to your computer - Claim that too much was refunded and you must pay it back with gift cards - Request for bank or card details to process a refund How to check: - Do not call the number in the email or let anyone connect to your computer - Sign in to your Best Buy account yourself to see any real memberships or orders - Check your bank or card statement for an actual charge - Contact Best Buy using 1-888-BEST BUY or the details on BestBuy.com How to report: - Email scams that use the Best Buy or Geek Squad name to abuse@bestbuy.com (https://www.bestbuy.com/site/privacy-policy/protect-yourself/pcmcat266100050002.c?id=pcmcat266100050002) - Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov (https://reportfraud.ftc.gov/) Sources: Best Buy, Protect Yourself (https://www.bestbuy.com/site/privacy-policy/protect-yourself/pcmcat266100050002.c?id=pcmcat266100050002); Federal Trade Commission, How to recognize a fake Geek Squad renewal scam (https://consumer.ftc.gov/consumer-alerts/2022/10/how-recognize-fake-geek-squad-renewal-scam); Federal Trade Commission, How To Spot, Avoid, and Report Tech Support Scams (https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams) ## Norton and McAfee renewal scams: spot a fake invoice URL: https://tapsafely.com/scams/norton-mcafee-renewal-scams Norton says its real emails never ask for passwords, Social Security numbers or card details, and they will not try to start remote access to your device out of the blue. McAfee says it will never make you call a phone number from an email or text, never call to charge you for customer service, and never ask for your SSN or passwords. Real web addresses: norton.com, nortonlifelock.com, mcafee.com Common fakes: - Invoice saying your antivirus subscription renewed for hundreds of dollars - Order confirmation with a phone number to call to cancel - Pop-up warning that your computer is infected and your protection has expired - Refund offer that needs remote access to your computer - Email from a free webmail address using the Norton or McAfee logo How to check: - Check the sender address: real Norton emails come from domains such as @norton.com, and McAfee lists its real sender addresses on mcafee.com - Sign in to your Norton or McAfee account yourself to see your actual subscription - Do not call numbers in the message or allow remote access - Look for a real charge on your bank or card statement How to report: - Forward fake Norton emails as an attachment to spam@norton.com (https://support.norton.com/sp/en/us/home/current/solutions/v138341527) - Send fake McAfee emails or content to scam@mcafee.com (https://www.mcafee.com/en-us/cyber-scam/customer-scam-awareness.html) - Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov (https://reportfraud.ftc.gov/) Sources: Norton, Report a spam or scam email to Norton (https://support.norton.com/sp/en/us/home/current/solutions/v138341527); Norton, Verify that an email you receive from Norton is legitimate (https://support.norton.com/sp/en/us/home/current/solutions/v71088498); McAfee, How to Recognize McAfee Scam Emails and Fake Popups (https://www.mcafee.com/en-us/cyber-scam/customer-scam-awareness.html); Federal Trade Commission, How To Spot, Avoid, and Report Tech Support Scams (https://consumer.ftc.gov/articles/how-spot-avoid-and-report-tech-support-scams) ## Walmart scam messages: how to spot a fake URL: https://tapsafely.com/scams/walmart-scam-messages Walmart says it does not tell contest winners about prizes by text, and it does not send texts about product recalls, which it shares on official websites and by direct email instead. It also says it will never mail you a check to deposit and ask you to keep part of it as payment. Real web addresses: walmart.com Common fakes: - Text saying you won a Walmart gift card - Fake product recall notice with a link - Official looking email asking for personal or financial details - Mystery shopper job that sends you a check to deposit - Request to pay someone with Walmart gift cards How to check: - Remember you cannot win a contest you did not enter, and Walmart does not text winners - Check recalls on official websites rather than through a text link - Sign in to walmart.com or the Walmart app yourself to check orders - Never pay anyone with gift cards because they asked you to How to report: - Send fake Walmart emails as an attachment (not forwarded or pasted) to OnlineAbuse@walmart.com (https://corporate.walmart.com/privacy-security/fraud-alerts) - Call Walmart gift card fraud on (888) 537-5503 if you were asked to pay with gift cards (https://corporate.walmart.com/privacy-security/fraud-alerts) - Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov (https://reportfraud.ftc.gov/) Sources: Walmart, Fraud Alerts (https://corporate.walmart.com/privacy-security/fraud-alerts); Walmart, Don't Fall for It: Protecting Yourself from Online Scams (https://corporate.walmart.com/news/2020/11/16/dont-fall-for-it-protecting-yourself-from-online-scams); Federal Trade Commission, How To Recognize and Avoid Phishing Scams (https://consumer.ftc.gov/articles/how-recognize-avoid-phishing-scams) ## Google and Gmail scams: how to spot them and stay safe URL: https://tapsafely.com/scams/google-gmail-scams Google says it will never call you about your account security, and it will not ask for your password, ask you to read out a verification code or ask you to approve a sign-in prompt. Gmail also says it will not ask for personal information such as your password by email. Real web addresses: google.com, gmail.com Common fakes: - Phone call from 'Google support' about a hacked account - Email saying your storage is full and your files will be deleted - Request to read out a verification code or approve a sign-in prompt - Fake Google prize or lottery win - Fake invoice for Google Ads or a Google Maps listing How to check: - Hang up on anyone who calls saying they are from Google about your account - Never share a verification code or approve a sign-in you did not start - Go to your Google Account yourself and run Security Checkup to review recent activity - Hover over links to check where they really go before clicking How to report: - In Gmail, open the message, select More next to Reply, then choose Report phishing (https://support.google.com/mail/answer/8253?hl=en) - Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov (https://reportfraud.ftc.gov/) Sources: Google (Gmail Help), Avoid and report phishing emails (https://support.google.com/mail/answer/8253?hl=en); Google, Google Account Security Scam via Phone Call (https://support.google.com/faqs/answer/17170932?hl=en); Google, Avoid and report scams (https://support.google.com/faqs/answer/2952493?hl=en) ## Social Security (SSA) scams: how to spot them and stay safe URL: https://tapsafely.com/scams/social-security-scams Social Security says it will never tell you your Social Security number is suspended, threaten you with arrest, demand an immediate payment, or ask for gift cards, cash or card numbers over the phone. It does not ask for sensitive details by email, text or social media, and for a problem with your number or account it normally sends a letter. It may phone you if you recently applied, asked for a call back or have ongoing business with it. Real web addresses: ssa.gov, oig.ssa.gov Common fakes: - Your Social Security number has been suspended because of suspicious activity - Pay a fine now by gift card, crypto or wire transfer or face arrest - Email saying your Social Security statement is ready to download - Letter or text claiming your benefits will be stopped unless you call a number - Caller who transfers you to a fake police officer or investigator and asks you to keep it secret How to check: - Hang up and call Social Security yourself using the phone number listed on ssa.gov - Sign in to your account by typing ssa.gov/myaccount into your browser instead of using an email link - Remember that SSA emails only come from addresses ending in .gov - Treat any demand for gift cards, crypto, wire transfers or cash as a scam How to report: - Report the scam to the Social Security Office of the Inspector General using its online scam form (https://oig.ssa.gov/scam-awareness/report-the-scam/) - Report it to the Federal Trade Commission at ReportFraud.ftc.gov (https://consumer.ftc.gov/articles/how-avoid-government-impersonation-scam) - If you lost money or clicked a link in a fake SSA email, also report it to the FBI at ic3.gov (https://oig.ssa.gov/scam-alerts/2026-02-20-ssa-office-of-the-inspector-general-warns-public-of-surge-in-fraudulent-social-security-statement-emails/) Sources: Social Security Administration, Protect Yourself from Social Security Scams (https://www.ssa.gov/scam/); Social Security Administration, Social Security and OIG Partner for the Seventh Annual National Slam the Scam Day (https://www.ssa.gov/news/en/press/releases/2026-03-05.html); SSA Office of the Inspector General, SSA Office of the Inspector General Warns Public of Surge in Fraudulent Social Security Statement Emails (https://oig.ssa.gov/scam-alerts/2026-02-20-ssa-office-of-the-inspector-general-warns-public-of-surge-in-fraudulent-social-security-statement-emails/); Federal Trade Commission, How To Avoid a Government Impersonation Scam (https://consumer.ftc.gov/articles/how-avoid-government-impersonation-scam) ## Medicare scam calls: how to spot them URL: https://tapsafely.com/scams/medicare-scam-calls Medicare says it will never call you to sell you anything or come to your home, and it only phones in limited cases, such as returning a call you made. The FTC adds that real Medicare will not call, text or email out of the blue to ask for your Medicare number or a payment, and Medicare cards are free. Real web addresses: medicare.gov, cms.gov Common fakes: - You need a new or updated Medicare card, just confirm your Medicare number - Pay a small fee to keep your Medicare coverage active - Free back brace, genetic test or medical supplies if you share your Medicare number - Pushy call during Open Enrollment to switch you to a new plan - Caller who already knows some of your details and asks for bank or card information How to check: - Hang up and call 1-800-MEDICARE (1-800-633-4227) yourself - Never give your Medicare number to someone who contacts you unexpectedly - Compare plans at Medicare.gov or with your local State Health Insurance Assistance Program (SHIP) - Check your Medicare statements for services or equipment you never received How to report: - Call 1-800-MEDICARE (1-800-633-4227) or report Medicare fraud online through the HHS Office of Inspector General (https://www.medicare.gov/basics/reporting-medicare-fraud-and-abuse) - Report the scam to the Federal Trade Commission at ReportFraud.ftc.gov (https://consumer.ftc.gov/consumer-alerts/2025/09/medicare-open-enrollment-season-learn-how-protect-yourself-scams) - Get free help from your Senior Medicare Patrol on 1-877-808-2468 (https://consumer.ftc.gov/consumer-alerts/2026/05/medicare-fraud-affects-everyone-so-heres-what-know-and-do) Sources: Medicare.gov, Reporting Medicare fraud & abuse (https://www.medicare.gov/basics/reporting-medicare-fraud-and-abuse); Federal Trade Commission, This Medicare Open Enrollment season, learn how to protect yourself from scams (https://consumer.ftc.gov/consumer-alerts/2025/09/medicare-open-enrollment-season-learn-how-protect-yourself-scams); Federal Trade Commission, Medicare fraud affects everyone, so here's what to know and do (https://consumer.ftc.gov/consumer-alerts/2026/05/medicare-fraud-affects-everyone-so-heres-what-know-and-do) ## DVLA scam texts: how to spot a fake URL: https://tapsafely.com/scams/dvla-scam-texts DVLA says it never asks for bank or card details by text or email, and it never sends texts about vehicle tax refunds. Tax refunds are paid automatically, so a message with a refund link is a scam. Use GOV.UK for DVLA services, because copycat sites charge extra for things that are free or cheaper there. Real web addresses: gov.uk Common fakes: - You are due a vehicle tax refund, click to claim - Your last vehicle tax payment failed, update your card details - Verify your driving licence details or your licence will be suspended - Your vehicle is untaxed and will be clamped today - Paid search ads for copycat sites that add fees to licence or tax services How to check: - Type gov.uk into your browser and use the official vehicle tax or driving licence service - Remember that refunds are sent automatically, so never click a refund link - Check your vehicle's tax status for free on GOV.UK using the registration number - Ignore any text or email asking for bank or card details How to report: - Forward suspicious texts to 7726, free on most UK networks (https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-text-message) - Forward scam emails to the National Cyber Security Centre at report@phishing.gov.uk (https://www.gov.uk/government/news/dvla-releases-latest-scam-images-to-help-keep-motorists-safe-online) - If you lost money, report it to Report Fraud online or on 0300 123 2040 (https://www.reportfraud.police.uk/) Sources: GOV.UK (DVLA), DVLA's top tips for avoiding scams (https://www.gov.uk/government/news/dvlas-top-tips-for-avoiding-scams); GOV.UK (DVLA), DVLA releases latest scam images to help keep motorists safe online (https://www.gov.uk/government/news/dvla-releases-latest-scam-images-to-help-keep-motorists-safe-online); National Cyber Security Centre, Report a scam text message (https://www.ncsc.gov.uk/collection/phishing-scams/report-scam-text-message) ## TV Licensing scam emails: how to spot a fake URL: https://tapsafely.com/scams/tv-licensing-scam-emails TV Licensing says it will never text you about a refund or ask for bank details by text, and it will not ask you to enter personal details on its website until you have signed in to your licence. Its genuine emails greet you only by name and/or part of your postcode, and come from addresses such as donotreply@tvlicensing.co.uk. Real web addresses: tvlicensing.co.uk Common fakes: - Your TV Licence payment failed, update your billing information - You are owed a refund, click to claim it - Your licence has expired, renew now to avoid prosecution - Action required: correct your licensing information - Security alert asking you to confirm your account and bank details How to check: - Check whether the email uses your name or part of your postcode, not a generic greeting - Look closely at the sender address and hover over links before clicking - Go to tvlicensing.co.uk yourself and sign in to check your licence - Call TV Licensing on a number listed on tvlicensing.co.uk if you are unsure How to report: - Forward scam emails to report@phishing.gov.uk (https://www.tvlicensing.co.uk/faqs/FAQ288) - Screenshot scam texts and email them to TV Licensing at textscams@tvlicensing.co.uk (https://www.tvlicensing.co.uk/faqs/FAQ288) - If you lost money or shared bank details, contact your bank and report it to Report Fraud on 0300 123 2040 (https://www.reportfraud.police.uk/) Sources: TV Licensing, Helping you avoid TV Licensing scams, and how to report one (https://www.tvlicensing.co.uk/faqs/FAQ288); Action Fraud, Action Fraud warns against fake TV licensing emails, as over 2,500 reports are made in two months alone (https://www.actionfraud.police.uk/alert/action-fraud-warns-against-fake-tv-licensing-emails-as-over-2500-reports-are-made-in-two-months-alone) ## ATO scam calls and texts: how to spot them URL: https://tapsafely.com/scams/ato-scam-calls-and-texts The ATO says it will never send unsolicited texts or emails with links or QR codes, ask for personal identifying details by email or text, threaten arrest or cancel your TFN, or ask for payment by gift card, crypto or cash. It may contact you by phone, email, SMS, post or myGov, and its calls show as No Caller ID. If you are not sure, call the ATO on 1800 008 540. Real web addresses: ato.gov.au, my.gov.au Common fakes: - You have a tax refund waiting, sign in to myGov through this link - You owe a tax debt and will be arrested unless you pay today - Email with an attachment to book an ATO phone appointment - Fake DocuSign email about a tax notice or refund - Robocall saying your tax file number has been suspended How to check: - Type my.gov.au into your browser yourself rather than using a link - Call the ATO on 1800 008 540 to check whether the contact is real - Check that email sender addresses end in ato.gov.au, and remember they can still be faked - Never pay a tax debt by gift card, crypto or cash How to report: - Forward scam emails, or email screenshots of scam texts, to the ATO at ReportScams@ato.gov.au, or use its online report form (https://www.ato.gov.au/online-services/scams-cyber-safety-and-identity-protection/verify-or-report-an-ato-scam) - If you lost money or shared details, call the ATO on 1800 008 540 and contact your bank (https://www.ato.gov.au/online-services/scams-cyber-safety-and-identity-protection/verify-or-report-an-ato-scam) - Report the scam to Scamwatch (https://www.scamwatch.gov.au/report-a-scam) Sources: Australian Taxation Office, Verify or report an ATO scam (https://www.ato.gov.au/online-services/scams-cyber-safety-and-identity-protection/verify-or-report-an-ato-scam); Australian Taxation Office, Scam alerts (https://www.ato.gov.au/online-services/scams-cyber-safety-and-identity-protection/scam-alerts); Scamwatch (ACCC), Report a scam (https://www.scamwatch.gov.au/report-a-scam) ## CRA scam calls and texts: how to spot them URL: https://tapsafely.com/scams/cra-scam-calls-and-texts The CRA says it will never send refunds by Interac e-Transfer or text, demand immediate payment by e-Transfer, crypto, prepaid cards or gift cards, or threaten to arrest or deport you. It only texts for sign-in verification codes if you enrolled with a phone, and its emails never contain links asking you to enter personal or financial information. Real web addresses: canada.ca, cra-arc.gc.ca Common fakes: - You have a CRA refund waiting, accept it by Interac e-Transfer - You owe taxes and police will arrest you unless you pay today - Claim a benefit or tax credit you never applied for through this link - Your CRA account is locked, verify your identity and SIN - Pay your balance with gift cards or cryptocurrency How to check: - Sign in to My Account by typing canada.ca into your browser to see real messages and balances - Call the CRA on a number listed on canada.ca to check whether it contacted you - Remember the CRA never sends refunds by text or e-Transfer - Hang up on anyone threatening arrest or asking for gift cards or crypto How to report: - Tell the CRA about suspicious activity on your account using its online form or by phone (1-833-995-2336 for individuals) (https://www.canada.ca/en/revenue-agency/corporate/scams-fraud/report-scam.html) - Report the scam to the Canadian Anti-Fraud Centre online or on 1-888-495-8501 (https://antifraudcentre-centreantifraude.ca/report-signalez-eng.htm) - Forward suspicious texts to 7726 (SPAM) (https://www.canada.ca/en/revenue-agency/campaigns/fraud-scams.html) Sources: Canada Revenue Agency, Recognize a scam (https://www.canada.ca/en/revenue-agency/corporate/scams-fraud/recognize-scam.html); Canada Revenue Agency, Report a scam (https://www.canada.ca/en/revenue-agency/corporate/scams-fraud/report-scam.html); Canadian Anti-Fraud Centre, Report fraud and cybercrime (https://antifraudcentre-centreantifraude.ca/report-signalez-eng.htm) ## TikTok scams: how to spot them and stay safe URL: https://tapsafely.com/scams/tiktok-scams TikTok says it will never contact you to ask for your password, verification codes or other sensitive personal details. Official messages arrive as in-app notifications or from email addresses ending in tiktok.com, and TikTok warns that messages paying you to like or follow videos are scams. Real web addresses: tiktok.com, bytedance.com Common fakes: - Your account will be banned unless you verify it with the code we just sent - Free followers, likes, coins or gift cards on an outside website - Get paid to like and follow TikTok videos, join our group chat - Fake investment or crypto account promising big, low risk returns - Cheap in-game items or loans that need an upfront fee How to check: - Check for the notice in your TikTok app notifications, not in a DM or text - Never share your password or a verification code, even with someone claiming to be TikTok - Check that emails come from an address ending in tiktok.com - Treat any offer to pay you for likes or follows as a scam How to report: - Report the account or message in the TikTok app and choose Frauds and Scams (or Scam or Fraud for TikTok Shop listings) (https://www.tiktok.com/safety/en/scams) - In the US, also report task and job scams to the FTC at ReportFraud.ftc.gov (https://consumer.ftc.gov/consumer-alerts/2025/08/how-spot-avoid-task-scams) Sources: TikTok Support, Avoid fraudulent message attacks on TikTok (https://support.tiktok.com/en/safety-hc/account-and-user-safety/avoid-fraudulent-message-attacks-on-tiktok); TikTok Safety Center, Frauds & scams (https://www.tiktok.com/safety/en/scams); TikTok Newsroom, How TikTok protects our community from frauds and scams (https://newsroom.tiktok.com/how-tiktok-protects-our-community-from-frauds-and-scams?lang=en-150); TikTok Newsroom, Be wary of job scams which appear to originate from TikTok (https://newsroom.tiktok.com/be-wary-of-scams?lang=en-SG) ## Telegram scams: how to spot them and stay safe URL: https://tapsafely.com/scams/telegram-scams Telegram sends login codes only to the verified service notifications chat named Telegram in your chat list, and it says those codes should never be shared with anyone. It recommends turning on 2-Step Verification so a password is needed as well as a code, and it lets you flag scams with the Report button in any chat. Real web addresses: telegram.org, t.me Common fakes: - Telegram support asking you to send the login code you just received - Remote job paying you to like, rate or boost products, if you deposit crypto first - Crypto trading group promising guaranteed daily profits - Recruiter who insists on talking only through Telegram - Free Telegram Premium or gift offer that asks you to log in on another site How to check: - Only trust login codes in the verified Telegram service notifications chat, and never pass them on - Turn on 2-Step Verification in Settings, Privacy and Security - Check job offers on the company's official website, not a link from the chat - Walk away from any job or investment that needs you to pay or send crypto first How to report: - Use the Report button in the Telegram app to flag the scam message or account; if someone is impersonating you, contact @NoToScam (https://telegram.org/faq) - In the US, report job, task and investment scams to the FTC at ReportFraud.ftc.gov (https://consumer.ftc.gov/consumer-alerts/2025/08/how-spot-avoid-task-scams) Sources: Telegram, Telegram FAQ (https://telegram.org/faq); Telegram, Spam FAQ (https://telegram.org/faq_spam); Federal Trade Commission, How to spot and avoid task scams (https://consumer.ftc.gov/consumer-alerts/2025/08/how-spot-avoid-task-scams); Federal Trade Commission, Job offer through Telegram Messenger? Not so fast (https://consumer.ftc.gov/consumer-alerts/2023/07/job-offer-through-telegram-messenger-not-so-fast) ## Steam scams: how to spot them and stay safe URL: https://tapsafely.com/scams/steam-scams Steam keeps a list of known scams in its Support FAQ, including messages saying your account was reported and will be banned, fake tournaments, vote for my team links and offers to buy your items. It locks accounts that post links used for phishing or account theft, and real account help is handled through Steam Support at help.steampowered.com. Real web addresses: steampowered.com, steamcommunity.com Common fakes: - I accidentally reported your account, contact this Steam admin to avoid a ban - Vote for my team or join a tournament, just sign in through this link - Offer to buy your skins or items for real money off Steam - Steam gift card code needed to pay a bill or fine - Cheap Steam accounts or items from a third-party trader How to check: - Type help.steampowered.com into your browser to check your account or contact Steam Support - Check the address bar before signing in: real pages are on steampowered.com or steamcommunity.com - Never share your password or Steam Guard codes, and keep the Steam Guard mobile authenticator turned on - Treat any request to pay with a Steam gift card for something outside Steam as a scam How to report: - Report the scammer or phisher to Steam through Steam Support (https://help.steampowered.com/en/faqs/view/4D07-D139-587C-2080) - If you paid a scammer with a Steam gift card, report it to Steam Support right away, and in the US tell the FTC at ReportFraud.ftc.gov (https://consumer.ftc.gov/articles/avoiding-and-reporting-gift-card-scams) Sources: Steam Support, Scam FAQ (Confidence Scams and Trade Scams) (https://help.steampowered.com/en/faqs/view/70E6-991B-233B-A37B); Steam Support, Scam: I Have Been Reported and Will Be Banned (https://help.steampowered.com/en/faqs/view/3195-9FFB-BA06-F25B); Steam Support, Suspicious Content Lock (https://help.steampowered.com/en/wizard/HelpWithSuspiciousContent); Federal Trade Commission, Avoiding and Reporting Gift Card Scams (https://consumer.ftc.gov/articles/avoiding-and-reporting-gift-card-scams) # Scam statistics (official figures) URL: https://tapsafely.com/scam-statistics ## United States: Federal Trade Commission (2025 data) Source: FTC Testifies before the Joint Economic Committee on Agency's Efforts to Combat Fraud, published 2026-03-25 (https://www.ftc.gov/news-events/news/press-releases/2026/03/ftc-testifies-joint-economic-committee-agencys-efforts-combat-fraud) - Reported fraud losses: $15.9 billion (Reported to the FTC by consumers in 2025, up from over $12 billion the year before) - Fraud reports: 3 million (Up from 2.6 million fraud reports the previous year) - Top category by loss: Investment scams: $7.9 billion (Consumers reported losing the most money to investment scams in 2025) - Most reported fraud: Imposter scams: more than $3.5 billion lost (More than 1 million imposter scam reports; the most reported fraud since 2020) - Top contact method by loss: Social media: $2.1 billion (Nearly 30% of people who reported losing money to a scam said it started on social media (FTC press release, April 27, 2026)) ## United States: Federal Bureau of Investigation, Internet Crime Complaint Center (IC3) (2025 data) Source: 2025 IC3 Annual Report (Internet Crime Report), published 2026-04-06 (https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf) - Reported losses: $20.877 billion (Losses reported to IC3 in 2025) - Complaints: 1,008,597 (Up from 859,532 in 2024) - Top crime type by loss: Investment fraud: $8,648,617,756 - Business email compromise losses: $3,046,598,558 (From 24,768 complaints) - Cryptocurrency-related losses: $11.366 billion (From 181,565 complaints involving cryptocurrency) - Losses reported by people over 60: $7.748 billion (From 201,266 complaints; losses up 59% and complaints up 37% from 2024) ## United Kingdom: UK Finance (2025 data) Source: Annual Fraud Report 2026 (press release: Fraud remains a national security threat as criminals steal almost £1.3 billion), published 2026-06-15 (https://www.ukfinance.org.uk/news-and-insight/press-release/fraud-report-2026-press-release) - Total fraud losses: £1.28 billion (Stolen through payment fraud in 2025, up four per cent) - Unauthorised fraud losses: £703.4 million (Down five per cent) - APP scam losses: £576.4 million (Authorised push payment fraud, up 19 per cent) - Unauthorised fraud prevented: £1.68 billion (Stopped by the banking industry before it could be stolen) - Fraud cases: 3.81 million (Up 11 per cent) - APP losses reimbursed: £354.3 million (Equivalent to 61 per cent of APP losses) ## Australia: Australian Competition and Consumer Commission, National Anti-Scam Centre (2025 data) Source: Targeting scams: report of the National Anti-Scam Centre on scams data and activity 2025 (media release: Continued action critical to combat fraud as annual scam losses exceed $2 billion), published 2026-03-30 (https://www.accc.gov.au/media-release/continued-action-critical-to-combat-fraud-as-annual-scam-losses-exceed-2-billion) - Reported scam losses: $2.18 billion (Australian dollars; losses up 7.8 per cent compared with 2024) - Scam reports: 481,523 (Combined total across reporting agencies in 2025) - Reports with a financial loss: 274,577 - Top scam type by loss: Investment scams: $837.7m (Australian dollars) - Share of losses by people aged 65 and over: 26.5 per cent (This age group is about 17.1 per cent of the population) ## Canada: Canadian Anti-Fraud Centre (2025 data) Source: Fraud Prevention Month to bring hidden crime into the spotlight, published 2026-03-06 (https://antifraudcentre-centreantifraude.ca/news-nouvelles/2026/2026-03-06-eng.htm) - Reported fraud losses: over $704 million (Canadian dollars, lost to fraud in 2025) - Fraud reports: over 112,000 (Received by the Canadian Anti-Fraud Centre in 2025 (Fraud Prevention Month 2026 page)) - Share of frauds reported: only 5% to 10% (Most fraud goes unreported, so real losses are far higher) - Reported losses since 2022: surpassing $2.4 billion (Canadian dollars) - Top fraud types by financial impact: Investment fraud, romance fraud and job fraud ## Global: Global Anti-Scam Alliance (GASA) (2025 data) Source: Global State of Scams Report 2025, published 2025-10-07 (https://gasa.org/knowledge-base/blog/gasa-policy-agenda-2026) - Estimated scam losses: $442 billion (Estimated losses across the 42 countries surveyed, based on a consumer survey) - Adults who lost money to scams: 23% (Of 46,000 people surveyed, in the past year) - Adults who experienced a scam: 57 percent (Share of adults worldwide (GASA and Feedzai launch post, October 7, 2025)) - Survey size: 46,000 adults across 42 markets ## Europe (EEA): European Central Bank and European Banking Authority (2024 data) Source: Joint EBA-ECB report on payment fraud: strong authentication remains effective but fraudsters are adapting, published 2025-12-15 (https://www.ecb.europa.eu/press/pr/date/2025/html/ecb.pr251215~e133d9d683.en.html) - Payment fraud value: €4.2 billion (Total payment fraud in the EEA in 2024, up from €3.5 billion in 2023) - Credit transfer fraud: €2.2 billion (2024, a 16% year on year increase) - Credit transfer losses borne by users: approximately 85% (Share of credit transfer fraud losses borne by payment service users in 2024) - Card fraud outside the EEA: 17 times higher (Card payment fraud when the recipient was outside the EEA, where strong authentication is not legally required) # Scam glossary URL: https://tapsafely.com/scam-glossary - Account takeover: When a criminal gets into one of your accounts, usually with a stolen password or a code you were tricked into sharing, and then locks you out or uses it to scam your contacts. - Advance-fee scam: A promise of a large sum of money, a prize, a loan or an inheritance, as long as you first pay a fee, tax or charge. The money never arrives, and the fees keep growing. - AI voice cloning: Using artificial intelligence to copy someone's voice from a short recording, then calling a relative to fake an emergency and ask for money. - APP fraud (authorised push payment): When you are tricked into sending a bank transfer yourself, for example to a fake 'safe account', a fake builder or a romance scammer. Because you authorised the payment, it can be harder to get back, although some countries now require banks to reimburse many victims. - BEC (business email compromise): A scam where criminals pose as a boss, colleague or supplier by email, often from a hacked or look-alike address, to get a business to pay a fake invoice or change bank details. - Brushing scam: Receiving parcels you never ordered. Sellers send them to create fake 'verified' reviews in your name. It can be a sign your details were leaked, so check your accounts. - Catfishing: Creating a fake online identity, often with stolen photos, to start a relationship. It is the usual first step of a romance scam. - Clone phishing: Copying a real email you received earlier, such as an invoice or delivery notice, and resending it with the link or attachment swapped for a malicious one. - Deepfake: A fake video, image or voice made with AI to look like a real person. Scammers use deepfakes of celebrities in investment ads and of bosses or relatives on video calls. - Fake invoice (renewal) scam: An email or letter saying a subscription, antivirus or service has renewed for a large amount, with a phone number to 'cancel'. The number leads to a scammer who asks for remote access or bank details. - Gift card scam: Any request to pay with gift cards, such as Apple, Google Play, Steam or Amazon cards. No real company, government agency or bank asks for payment this way. - Grandparent scam: A call or message to an older person pretending to be a grandchild in trouble, often with an accomplice posing as a lawyer or police officer, and a request to keep it secret. - Hi Mum scam: A message from an unknown number claiming to be your child with a new phone, which soon asks you to pay an urgent bill for them. - Homograph (look-alike) domain: A web address that uses characters that look like real letters, such as a Cyrillic 'а' instead of a Latin 'a', or swaps like 'rn' for 'm', to imitate a real site. - Impersonation scam: Any scam where the criminal pretends to be someone you trust: a bank, delivery company, government agency, police, a brand, a friend or a family member. - Investment scam: Fake trading platforms, crypto schemes or 'guaranteed' returns that show growing profits on screen but never let you withdraw, often promoted with fake celebrity endorsements. - Malvertising: Malicious adverts, including sponsored search results, that lead to fake websites, fake downloads or scam support numbers. - Money mule: Someone who receives and passes on stolen money through their own bank account, often recruited with fake job offers. It is a crime even if you didn't know. - OTP (one-time passcode) theft: Tricking you into reading out or forwarding a login or payment code sent by text or app. That code lets the scammer into your account or approves a payment. - Overpayment scam: A buyer 'accidentally' pays you too much and asks you to send back the difference. The original payment later bounces or turns out to be fake. - Phishing: Messages designed to trick you into giving away passwords, card numbers or personal details, usually through a link to a fake website. - Pig butchering: A long con where a scammer builds a friendship or romance over weeks, then introduces a 'can't lose' crypto or trading opportunity and takes everything invested. - Quishing: Phishing with QR codes. The code leads to a fake payment or login page, and is used on parking meters, letters and emails to get past filters. - Recovery scam: A second scam that targets people who have already lost money, promising to recover it for an upfront fee. - Remote access scam: Persuading you to install a screen-sharing app such as AnyDesk or TeamViewer so the scammer can control your device and bank account. - Romance scam: A fake online relationship built to get money, usually for a crisis, travel costs, customs fees or an investment. - Safe account scam: A caller claiming to be your bank's fraud team or the police says your money is at risk and asks you to move it to a 'safe account' that belongs to the scammer. - Sextortion: Threats to share intimate images or videos unless you pay. Don't pay and don't keep talking. Save the evidence, report it to the platform and the police, and ask for support. You are not to blame. - SIM swap: A criminal convinces your mobile provider to move your number to their SIM card, so they receive your calls and security codes. Ask your provider about a SIM lock or port-out PIN. - Smishing: Phishing by text message (SMS), such as fake delivery, toll or bank texts. - Social engineering: Manipulating people rather than hacking computers: using trust, fear, urgency or curiosity to get someone to act without thinking. - Spear phishing: A phishing message tailored to one person or organisation, using real names and details to seem believable. - Spoofing: Faking the phone number, email address or name that appears as the sender, so a message looks like it comes from a trusted source. - Task scam: A 'job' that pays small amounts for simple tasks like rating products or liking videos, then requires you to deposit your own money to unlock bigger earnings. - Tech support scam: Pop-ups, calls or emails claiming your device is infected or your account is hacked, pushing you to call a fake support line. - Two-step verification (2FA): An extra check when you sign in, such as a code or an app prompt. It stops most account takeovers, as long as you never share the code. - Typosquatting: Registering web addresses with common typing mistakes, such as 'arnazon' or 'paypa1', to catch people who mistype or don't look closely. - Vishing: Phishing by voice call, where the caller pretends to be a bank, company or official to get details, codes or payments. - Wangiri (one-ring) scam: A missed call from an unknown international number, hoping you call back to a premium-rate line that charges you by the minute.