Field guide
The eight tells
Scam texts, emails, calls and pop-ups lean on a handful of moves, again and again. One tell is a reason to slow down; two or more, and you can stop and check another way.
Way too urgent
A deadline in minutes or hours, a threat, a prize about to expire. Pressure is there to stop you checking.
Elsewhere links
The link or address belongs to someone else. Find the first single slash after "https://": the last two words before it, separated by a dot (three for addresses like .co.uk), say whose site it is. Anything in front of them is decoration.
Lookalike senders
A swapped letter, an extra word, a free email address, a brand-new account wearing a familiar name.
Don't tell anyone
Secrecy, "email only", "don't hang up": anything that cuts you off from a quick check with someone you trust.
Odd ways to pay
Never pay someone who insists you can only pay by gift card, crypto, a wire transfer service or a payment app. And if you have to pay to get a prize, it is a scam.
Never the code
A sign-in code is for typing into a site you opened. Anyone asking you to read it out is breaking in.
Personal details on request
A PIN, a password, a Social Security number, a bank login, asked for out of the blue.
Call this number
A phone number inside a warning, an invoice or a pop-up. Call the number you already have instead.
Two things that are not proof
The padlock. It means the connection is encrypted, not that the site is honest. Scam pages have padlocks too.
The logo. Logos, colours and a real company's name are free to copy.
What to do instead
Stop, and check another way: open the app, type the address yourself, or call the number on the back of your card, on your bill or in your contacts. Tell someone you trust. A real problem will still be there in ten minutes; a scam will not.
Already happened? Act now
If you already clicked, paid, read out a code or let someone into your computer, act fast: it can limit the damage. Use numbers you already trust, never the ones the scammer gave you.
- Paid by card. Call your card company or bank now, on the number on the back of the card, and ask them to stop or refund the payment.
- Paid with a gift card. Contact the company that issued the gift card right away (the number on the back of the card), say a scammer has the number and ask for a refund. Keep the card and the receipt.
- Sent a wire or used a payment app. Report it to the wire transfer company or the app right away and ask them to reverse it.
- Gave a password or a sign-in code. Change that password now, and anywhere else you used it, then turn on two-step sign-in. If it was your bank login, call the bank as well.
- Let someone into your computer. Ask your IT people to check it. If you have none, update your security software, run a scan and remove what it finds. Then change your passwords.
- Gave your Social Security number. Go to IdentityTheft.gov, the FTC's site, for a recovery plan.
Then tell someone you trust, and report it at ReportFraud.ftc.gov. These steps follow the FTC's page What To Do if You Were Scammed, which has more detail for each case.
Sources and where to report
- US Federal Trade Commission: How To Avoid a Scam (never pay someone who insists you can only pay with crypto, a wire transfer service, a payment app or a gift card)
- FTC: How To Recognize and Avoid Phishing Scams
- FTC: How To Spot, Avoid, and Report Tech Support Scams (real security warnings never ask you to call a phone number)
- FTC: Avoiding and Reporting Gift Card Scams (only scammers tell you to pay with a gift card)
- FTC: Fake Prize, Sweepstakes, and Lottery Scams (if you have to pay to get your prize, it is a scam)
- FTC: What To Do if You Were Scammed
- Report a scam in the US: ReportFraud.ftc.gov; identity theft: IdentityTheft.gov; internet crime: ic3.gov (FBI)
The eight names are Tellcase's own way of grouping these warning signs. Where a tip comes from the FTC, its page is linked above; the rest, such as how to read a web address, is general good practice rather than a quote from the FTC.