Recognising scams

Scams are mostly a numbers game. The same handful of scripts are sent to millions of people, and a small fraction respond. Recognising the script is most of the defence.

The fake parcel SMS

You receive a text from what looks like Royal Mail, La Poste, Deutsche Post, PostNL or your local equivalent. There is a delivery problem. A small customs fee, a redelivery slot, a missed signature. Click the link to fix it. The link goes to a fake page that captures your card details or installs an app. Real postal services do not ask for payment details by SMS. If you are expecting a parcel, open the carrier's official app or website yourself rather than tapping the link.

The fake bank call or text

Someone claiming to be from your bank's fraud team says there has been suspicious activity. They need to verify the transaction or move your money to a 'safe account'. They may already know your name, address and the last digits of your card. They will press for urgency. Real banks never ask you to move money to a different account, share a one-time code, or read out your full card number to confirm anything. Hang up. Call the number on the back of your card from a different phone if you are unsure.

The AI voice clone

A relative calls in distress. They have been in an accident, arrested abroad, mugged. They need money urgently and you must not tell anyone. The voice sounds right because it has been cloned from a few seconds of audio scraped from social media. Hang up and call the person back on the number you already have for them. Agree a family code word now, before you need it, that no scammer would know.

The QR code (quishing)

QR codes on parking meters, restaurant tables and posters can be replaced by stickers placed over the real one. The fake code goes to a page that looks like the real service and captures your payment. If a QR code asks for payment details on a page you do not recognise, stop. Pay through the official app for that service or use coins or card.

The job offer or romance match

An attractive opportunity arrives unsolicited. A recruiter offering remote work with a generous package. A new match from a dating app who quickly moves the conversation off the platform. After a while, an investment opportunity appears, or a small upfront payment is needed for a visa, a customs fee, a sick relative. Real recruiters and real partners do not ask you to send money or to invest in their crypto platform. Slow down. Check the company exists. Reverse-image search the photos. If they refuse a video call, that answers the question.

Common signals

Urgency. Secrecy. Authority. A small action that unlocks something bigger. A payment in gift cards, crypto or wire transfer. A reluctance to be checked. Any of these in combination should slow you down. Almost no real situation requires you to act in the next ten minutes without telling anyone.

What to do if you spot one

In the EU, report to your national cybercrime authority (in Ireland, the Garda; in Germany, the BSI; in France, cybermalveillance.gouv.fr; in the UK, Action Fraud). Forward suspicious texts to 7726 in most European countries; it is the universal short code for spam reporting and it is free. Tell people you know who might be targeted, especially older relatives, before they receive the same message.