The most useful habit: pause and verify

An online scam is an attempt to obtain your money, personal information, or account access through deception. A familiar logo, convincing message, or polished website is not proof that a request is genuine. When a message creates pressure to act, pause and check through a separate channel.

Scams can arrive by email, text, social media, phone, or a search advertisement. They often borrow everyday situations: a missed delivery, a banking alert, an unpaid bill, or an attractive shopping offer. You do not need to identify every trick. You need a repeatable way to check the request.

Notice pressure, payment demands, and impersonation

Be cautious when someone demands immediate action, threatens account closure, or asks you to keep a transaction secret. Other warning signs include unexpected attachments, requests for verification codes, and demands to pay by gift card, cryptocurrency, or a transfer to an unfamiliar person.

Good spelling does not establish authenticity. A scammer can copy a company’s branding or compromise a real account. Check the full sender address, but do not rely on it alone. Never share a one-time login code with someone who contacts you.

A quick checklist

  • Was I expecting this message or payment request?
  • Is the sender asking me to bypass normal procedures?
  • Can I confirm the request without using the message’s links or phone number?

Verify through a channel you already trust

Imagine receiving a text saying your bank account is locked. Instead of following the text’s link, open the bank’s official app or call the number printed on your card. If a friend asks for emergency money, call them using a number you already have. If a workplace payment request is unusual, check through the organization’s established process.

Do not download remote-access software or move money to a “safe account” at the direction of an unexpected caller. End the conversation and independently contact the organization being impersonated.

If you clicked, shared information, or paid

Stop communicating and act according to what happened. Contact your bank or payment provider promptly if money was sent. If you entered a password, change it through the real service, change any reused credentials, and review account sessions and multifactor settings. If an attachment installed software, use your device’s trusted security tools and seek qualified help if needed.

Save useful evidence such as messages, receipts, and transaction details without reopening suspicious links. Report the message in the platform, and report suspected fraud to the appropriate authority. In the United States, the FTC’s ReportFraud service accepts reports. Elsewhere, use your local consumer protection or law enforcement reporting service. Be wary of anyone who promises guaranteed recovery for an upfront fee.

Common questions

Does a padlock mean a website is safe?

No. It indicates an encrypted connection, not that the business or offer is legitimate. Scam sites can use HTTPS too.

Should I reply to check if a message is genuine?

Use an independently verified contact method instead. Replying to the message keeps you in the channel the sender controls.

Sources & further reading

This guide draws on the following official resources. Guidance and service settings can change.

Educational information, not personalized legal, security, or financial advice. Websentials Editorial is the project’s organizational byline, not a claim of an independent expert review. Original editorial illustrations were generated for this publication.

Suggest a correction