19 Online scams to avoid today

Last Updated: August 27, 2026

Advertisement

How criminals actually approach people online, with the tell in each case.

Most of us assume we would notice. Reported losses say otherwise, and the age group that loses money most often is not the one you would guess: younger adults report fraud less but lose money more often when they do. Tactics range from old mass-mail schemes that still work to targeted approaches built from what you posted publicly last week.

The target is always the same. It is money, or the credentials that lead to money. Use the list below to jump to the scheme you were sent, or read it through once and recognise the pattern later.

More than a third of security incidents start with a phishing email. The message looks like it came from your bank, your employer, or a delivery service, and it carries a story that makes you hurry: an account under threat, a payment held, a document waiting. The link leads to a login page that is a pixel-accurate copy of the real one, and the credentials you type there are used within minutes or sold on.

The oldest scheme on the internet and still in circulation. Someone claims to be a wealthy relative, an official, or a widow who needs help moving a large sum, and offers you a share. Getting it moving requires a small payment for paperwork, then another for a clearance, then another for a transfer fee. Documents arrive to make it feel real. The share never does.

A holiday card seemingly from someone you know. Opening it installs software rather than showing a card: adware at best, a banking trojan at worst, and your machine quietly joins a botnet reporting to somebody else's server. The season is the whole disguise.

An offer arrives already approved, with generous terms and no questions about your finances. Ask the obvious one: how would a lender approve a sum without looking at anything? The scheme lives on the mandatory processing fee you pay before the money that never arrives.

You have won a sum you never played for, and only a small administrative fee stands between you and it. It does not matter that you never bought a ticket, because the message is written to bypass that thought and go straight to what the money would change. Pay the fee and a second one appears.

An email threatens harm, exposure, or a family member unless you pay within a stated window. The message is stuffed with real details about you, all of it scraped from social accounts and old breaches, which is exactly what makes it land. Nothing in it requires the sender to have any access to your life.

Dating apps work, and so does this. The approach is patient: weeks of daily messages, a life story that fits yours, and a reason the video call keeps slipping. Researchers who studied the transcripts found the pressure techniques closely resemble those documented in domestic abuse. Then comes the emergency, or the investment they want to let you in on.

A window announces an infection and offers to clean it. Best case it is a nuisance selling nothing. Worst case the download is the infection: a keylogger, or ransomware that encrypts your files and asks for payment. No real security product warns you through a browser pop-up.

Either your account is taken over, or a copy of a friend's is made. Either way the request for money arrives from someone you trust, which is the entire mechanism. Protect a social account the way you protect email or banking, because it opens onto everyone you know.

A method, a system, a work-from-home position with no experience needed. It works because it addresses a real need at a bad moment, the same emotional lever the romance scam pulls. What is collected is your identity documents and bank details, and sometimes a fee for the training.

Seasonal, and timed for the weeks when people book. An exceptional price on an exotic destination, expiring shortly. Sometimes the trip exists and the costs were hidden: airport taxes, transfers, meals, entry tickets. Sometimes there is no trip. Price the same itinerary yourself before you pay anything.

Fake exchanges, pyramid structures dressed as funds, wallet-draining malware, and plain theft. Crypto is attractive to fraudsters for one structural reason: a confirmed transfer cannot be recalled by anyone, including the exchange.

A site you recognise, at an address one character off, running a story built to be shared. The article ends at a purchase page, and the card details go nowhere legitimate. Read from sources you reached yourself, not from links that reached you.

Product photos lifted from real listings, prices well under everyone else, and a checkout that collects card numbers. A quieter variant sits on a genuine shop and redirects only the payment page. Check what domain you are on at the moment you type the number.

Points and coupons are money, and they sit behind accounts nobody watches. The email looks exactly like your loyalty programme's, and one click is enough to hand over the account or install something. These are harder to spot than bank phishing precisely because the stakes feel low.

A call or a message from a recruiter at a company you know, who saw your CV and wants to move quickly. Whether or not you applied, the offer is flattering and the onboarding paperwork asks for your identity documents and account details.

Phishing by text, and more effective than email because a phone is checked immediately and a small screen hides the address. A parcel is held, a card is blocked, a fine is due today, and the link goes to a copy of your bank's login page.

You list something for sale. A buyer pays generously above the asking price and then explains that the extra was meant for a shipping agent, and asks you to forward it. Confirmation emails arrive to support the story. The original payment is later reversed or was never real, and the money you forwarded is gone.

Someone calls claiming your computer has been compromised and offers to walk you through the fix. They read out a serial number, have you open a system window, and interpret ordinary entries as evidence of an attack. What they want is remote access and a card payment for software you do not need. For anyone without technical background this is genuinely convincing.

Report to your bank first, then to the body that covers you. Fast reporting occasionally recalls a transfer and always feeds the pattern that gets these operations shut down.

The schemes are well organised and the people behind them are hard to reach, so the practical defence is habit rather than vigilance: verify on a second channel, refuse deadlines, and keep something running that checks links and messages while you are not thinking about it.

By proceeding, you confirm you are 18 or older.