Skip to main content
Dhan SurakshaSecuring Your Wealth, Ensuring Your Peace
Check a message

THE SCAM LIBRARY — A FIELD GUIDE

Know the scam.
Keep your edge.

Explore everyday scams in the United States, with clearly labeled international cases. See how each pattern works, what to notice, and how to respond.

Explore the field guide
24 case studies / 3 regionsReference edition 01 Aug 2026

FIND THE PATTERN — 01

What are you looking for?

A message, a call, an offer.
Start with what felt wrong.

24 of 24 case studies · Loading additional cases…

LOOK A LITTLE CLOSER — 02

The scam, decoded.

Realistic examples. Clear warning signs.
A safer next step for every pattern.

01Government & Tax / United StatesFake IRS Tax Demand Call

A caller claiming to be the IRS threatens arrest unless you pay back taxes immediately.

Who scammers target
Older adults, recent immigrants and first-time taxpayers
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
High risk
Why people fall for this
Fear of arrest overrides caution, and spoofed caller ID makes the number look official.

How it works

  1. A spoofed number shows as "IRS" or a Washington DC area code.

  2. The caller reads a fake badge number and claims a lawsuit has been filed against you.

  3. They demand payment today by gift cards, wire transfer, crypto ATM or a prepaid debit card.

  4. They stay on the line so you cannot verify anything, and threaten police at your door.

Fictional teaching example

Carlos is told he owes $4,300 in back taxes and that a warrant will be issued in one hour. He is instructed to buy Target gift cards and read the numbers out. The IRS never called him.

Notice the pattern

Red flags to notice

  • The IRS generally begins tax collection contact by mail and may call in some circumstances. Gift-card demands and threats of immediate arrest are warning signs.
  • Any government agency asking for gift cards, crypto or wire transfers is fake.
  • Threats of immediate arrest, deportation or licence suspension.
Choose a safer response

What to do immediately

  • Hang up. Check your real balance at irs.gov or call the IRS on their published number.
  • Never pay a tax bill with gift cards, crypto or a wire transfer.
  • Report the call at reportfraud.ftc.gov and to TIGTA.
  • Tell older relatives about this script — it is one of the most repeated in the US.
Back to the field guide
02Government & Tax / United StatesSocial Security Number "Suspension"

A recorded call says your SSN has been suspended for criminal activity and asks you to confirm it.

Who scammers target
Retirees and benefit recipients in the United States
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
High risk
Why people fall for this
Losing benefits or an identity number feels catastrophic, so people cooperate to 'fix' it.

How it works

  1. A robocall claims your Social Security number was linked to drug trafficking or money laundering.

  2. Pressing 1 connects you to a "federal officer" who confirms your name and SSN.

  3. You are told to move your money to a "safe federal account" while the case is investigated.

  4. The account belongs to the fraudsters, and your SSN is now available for identity theft.

Fictional teaching example

Dorothy is told her SSN was found on a car rented at the border. To protect her savings she wires $22,000 to a "secure Treasury account" and buys gift cards for the rest.

Notice the pattern

Red flags to notice

  • A Social Security number can never be suspended — that is not a real thing.
  • You are asked to confirm or read out your SSN to an inbound caller.
  • Instructions to move money to a "safe" government account.
Choose a safer response

What to do immediately

  • Hang up and call the SSA yourself at their published number.
  • Never confirm your SSN, date of birth or bank details to an inbound caller.
  • Freeze your credit with all three bureaus if you shared your SSN.
  • Report it at ssa.gov/fraud and reportfraud.ftc.gov.
Back to the field guide
03Healthcare / United StatesMedicare Card & Equipment Scam

A caller offers a new Medicare card, brace or genetic test and only needs your Medicare number.

Who scammers target
Adults over 65 and their carers
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
Medium risk
Why people fall for this
Health cover feels administrative and confusing, so a routine-sounding request for card details seems normal.

How it works

  1. A caller claims new plastic Medicare cards are being issued and asks to verify your number.

  2. Or they offer a "free" back brace, DNA cancer screening or COVID test kit.

  3. Your Medicare number is then used to bill for equipment and services you never received.

  4. You may only find out when a legitimate claim is denied as already used.

Fictional teaching example

Frank accepts a free knee brace over the phone and gives his Medicare number. Two braces arrive; Medicare is billed $1,900. When he later needs a real brace, the claim is refused.

Notice the pattern

Red flags to notice

  • Unsolicited offers of free medical equipment or genetic testing.
  • A request for your Medicare number over the phone or at a health fair.
  • Pressure to accept something "at no cost to you".
Choose a safer response

What to do immediately

  • Treat your Medicare number like a credit card number — never give it to an inbound caller.
  • Check your Medicare Summary Notices for services you did not receive.
  • Only accept equipment ordered by your own doctor.
  • Report suspected fraud to 1-800-MEDICARE and reportfraud.ftc.gov.
Back to the field guide
04Phishing / United StatesBank Fraud Alert Text (Smishing)

A text asks you to confirm a suspicious charge — then a "fraud agent" calls to walk you through it.

Who scammers target
Everyone with a bank account — sent in bulk to millions of numbers
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
High risk
Why people fall for this
The message warns of fraud, so acting fast feels like the safe choice rather than the risky one.

How it works

  1. You get a text: "Did you authorize a $612 purchase? Reply Y or N."

  2. Replying N triggers a call from a spoofed bank number.

  3. The "fraud agent" already knows your name and last four digits, which builds trust.

  4. They ask for the one-time code, or tell you to transfer money to a "secure account" — often via Zelle to yourself.

Fictional teaching example

Jordan replies N to a Chase fraud alert. The agent who calls sounds professional and asks him to read a code to cancel the charge. The code gives the caller access to his account; a $3,000 transfer follows.

Notice the pattern

Red flags to notice

  • An unexpected caller asks for a sign-in code while claiming to cancel a payment.
  • Instructions to send money to yourself to "reverse" fraud.
  • The caller creates a countdown: act now or lose the money.
Choose a safer response

What to do immediately

  • Do not reply to the text. Open your banking app or call the number on your card.
  • Never read out a verification code, even to a caller claiming to be your bank.
  • Sending money to yourself is never how fraud gets reversed.
  • Forward the text to 7726 (SPAM) and report at reportfraud.ftc.gov.
Back to the field guide
05Payment App Fraud / United StatesZelle Instant Transfer Scam

A scammer pushes you to send money through Zelle before you independently verify the recipient or the request.

Who scammers target
Bank customers using instant transfers, particularly under 45
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
High risk
Why people fall for this
The 'send it to yourself to cancel the fraud' instruction sounds protective and comes from a spoofed bank number.

How it works

  1. A seller, landlord or "bank agent" pushes you to pay or move money by Zelle.

  2. A transfer can be difficult to recover. Contact your bank promptly; available options depend on the circumstances.

  3. Common covers: a rental deposit, concert tickets, a puppy, or a fraud-department 'safety transfer'.

  4. The recipient may move the money quickly, making recovery harder.

Fictional teaching example

Aisha pays a $1,200 apartment deposit by Zelle after a video tour. The listing was copied from a real agency; the apartment was never available and she contacts her bank to ask about stopping or disputing the payment.

Notice the pattern

Red flags to notice

  • Anyone insisting on Zelle instead of a card or escrow for goods or deposits.
  • A "bank agent" telling you to Zelle money to yourself or a safe account.
  • A deal that requires payment before you can see the item or property in person.
Choose a safer response

What to do immediately

  • Use Zelle only for people you personally know and trust.
  • Consider a payment method with appropriate purchase protections; check the issuer’s terms.
  • Verify any bank instruction by calling the number on your card.
  • Report suspected fraud to your bank promptly and follow its instructions for disputes.
Back to the field guide
06Payment App Fraud / United StatesVenmo & PayPal Fake Invoice

A real-looking invoice or payment notice arrives, with a support number that belongs to the scammer.

Who scammers target
Frequent users of peer-to-peer payment apps
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
Medium risk
Why people fall for this
The invoice or alert arrives inside the real app or from real-looking email, so it inherits the platform's trust.

How it works

  1. You receive a genuine PayPal or Venmo notification for a purchase you did not make.

  2. The scammer created the invoice, so the email really is from the platform.

  3. The "dispute this charge" number in the note is the scammer's call centre.

  4. They then ask for remote access or a refund transfer to fix it.

Fictional teaching example

Nina gets a PayPal invoice for $749 of crypto. She calls the number in the note, is told to install a support app, and watches $2,400 leave her checking account.

Notice the pattern

Red flags to notice

  • A support phone number written inside the invoice or note field.
  • A charge you don't recognize for an unusually large round amount.
  • Any instruction to install software to obtain a refund.
Choose a safer response

What to do immediately

  • Never call a number printed inside an invoice — use the app's official help centre.
  • Check your real transaction list inside the app; unpaid invoices take no money.
  • Report and cancel the invoice from within the platform.
  • Enable two-factor authentication on all payment apps.
Back to the field guide
07Impersonation / United StatesFake Amazon Support Call

"Amazon" calls about a suspicious order, then converts the call into a refund and remote-access scam.

Who scammers target
Regular online shoppers, especially older adults
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
Medium risk
Why people fall for this
An unexpected large order feels like an emergency, and the 'refund' path leads straight to remote access.

How it works

  1. An automated call or email reports a large order — an iPhone, a laptop — that you did not place.

  2. You are transferred to "account security", who asks to verify your identity.

  3. They connect remotely to "process the refund" and show a fake overpayment on screen.

  4. You are then pressured to return the difference in gift cards, crypto or wire transfer.

Fictional teaching example

Helen is told a $1,299 laptop shipped to another state. During the "refund", the screen shows $9,000 credited instead of $900, and she is begged to return the difference before the agent "loses his job".

Notice the pattern

Red flags to notice

  • Amazon does not phone customers about orders or ask to access your device.
  • A refund that mysteriously overpays you.
  • Emotional pressure: the agent will be fired unless you help.
Choose a safer response

What to do immediately

  • Hang up and check your order history in the Amazon app.
  • Never allow remote access to your computer for a refund.
  • Banks and retailers never ask for gift cards to correct a refund.
  • Report the call at reportfraud.ftc.gov.
Back to the field guide
08Employment / United StatesRemote Job Offer & Check Scam

A well-paid remote job hires you instantly, sends a check for equipment, and the check later bounces.

Who scammers target
Students, new graduates and people looking for remote work
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
Medium risk
Why people fall for this
The cheque clears on screen for several days, which looks like proof the employer is real.

How it works

  1. You are recruited by text or on a job board for a remote role with unusually good pay.

  2. The "interview" happens entirely over chat, often on Telegram or Signal.

  3. You are sent a check or deposit to buy equipment from a specified vendor.

  4. The check bounces days later; the money you forwarded to the vendor is gone and you owe the bank.

Fictional teaching example

Devon is hired as a "data QA associate" at $38/hour. A $4,200 check arrives for a home-office setup; he wires $3,600 to the recommended supplier. The check is returned as fraudulent and his account goes negative.

Notice the pattern

Red flags to notice

  • Hired without a video interview, or interviewed only in a chat app.
  • Any job that sends you money to spend on their behalf.
  • Requests for your bank login, SSN or a fee before you start.
Choose a safer response

What to do immediately

  • Never buy equipment with funds an employer sent you — legitimate companies ship it.
  • Verify the company through its official website and call its published number.
  • Wait for a check to fully clear (weeks, not days) before spending it.
  • Report job scams to the FTC and to the job board.
Back to the field guide
09Payment App Fraud / United StatesSend $50, get $500?

Don’t pay a stranger who promises to multiply your money.

Who scammers target
Payment app users
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
Medium risk
Why people fall for this
An appealing offer can make an unexpected payment or credential request seem necessary.

How it works

  1. Send $50 through Cash App. Get $500 back in 10 minutes. Limited spots!

  2. Promises to multiply a payment are a cash-flip scam pattern. A logo and screenshots are not evidence of a real offer.

Fictional teaching example

A social media account using the Cash App logo says it can turn your $50 into $500 in minutes. It needs your payment first to ‘activate’ the offer.

Notice the pattern

Red flags to notice

  • A large promised payout
  • An upfront payment
  • An urgent offer
Choose a safer response

What to do immediately

  • Don’t send money; report the account and verify any offer independently.
  • Don’t pay a stranger who promises to multiply your money.
  • Save the message and report suspected fraud at ReportFraud.ftc.gov.
Back to the field guide
10Student & College Safety / United StatesA scholarship requires a gift card

Verify financial aid through trusted school contacts rather than an unsolicited offer.

Who scammers target
Students, parents, and borrowers
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
Medium risk
Why people fall for this
An appealing offer can make an unexpected payment or credential request seem necessary.

How it works

  1. Congratulations! Your $3,000 scholarship is reserved after a $75 gift card processing payment.

  2. An unsolicited award that requires a gift card is a warning sign. Trusted school staff can help you verify scholarship information and find legitimate aid resources.

Fictional teaching example

A high school senior gets an email saying they won a $3,000 college scholarship. It asks for a $75 gift card to reserve the award, even though they never applied.

Notice the pattern

Red flags to notice

  • An award you didn’t apply for
  • A gift card required to claim it
Choose a safer response

What to do immediately

  • Don’t pay; ask my school counselor or college financial aid office to help verify it.
  • Verify financial aid through trusted school contacts rather than an unsolicited offer.
  • Save the message and report suspected fraud at ReportFraud.ftc.gov.
Back to the field guide
11Student & College Safety / United StatesLoan forgiveness with an upfront fee

Use official federal student aid channels and never share your StudentAid.gov password.

Who scammers target
Students, parents, and borrowers
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
Medium risk
Why people fall for this
An appealing offer can make an unexpected payment or credential request seem necessary.

How it works

  1. Final notice: Pay $699 and provide your StudentAid.gov password to erase your loans tonight.

  2. You can access federal loan repayment and forgiveness information through your servicer or StudentAid.gov without paying this caller. Eligibility depends on the program; a caller’s promise cannot guarantee it. Keep your account credentials private.

Fictional teaching example

A caller promises to erase your federal student loans if you pay $699 today and give them your StudentAid.gov password. They say the offer expires tonight.

Notice the pattern

Red flags to notice

  • Guaranteed forgiveness
  • An upfront fee and account password
  • A same-day deadline
Choose a safer response

What to do immediately

  • End the call and check options with my loan servicer or StudentAid.gov.
  • Use official federal student aid channels and never share your StudentAid.gov password.
  • Save the message and report suspected fraud at ReportFraud.ftc.gov.
Back to the field guide
12AI & Deepfake / GlobalAI Voice Cloning "Family Emergency"

A cloned voice of your child or parent calls in distress and begs you to send money now.

Who scammers target
Parents and grandparents of teenagers and young adults
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
High risk
Why people fall for this
The voice is genuinely familiar, the story is frightening, and the caller allows no time to think or verify.

How it works

  1. A short voice recording from social media can be used to imitate someone’s voice.

  2. You get a call that sounds exactly like your child, grandchild or spouse, crying or panicking.

  3. The story is always the same shape: an accident, an arrest, a hospital, and a need for money in minutes.

  4. A second "official" voice — a lawyer, officer or doctor — takes over and gives you payment instructions.

Fictional teaching example

Linda answers a call at 11pm. Her grandson's voice says he crashed a rental car and needs $9,000 for bail. A "public defender" gets on the line and tells her to buy gift cards. Her grandson was asleep at home the whole time.

Notice the pattern

Red flags to notice

  • Extreme urgency plus a demand for secrecy: "don't tell mom".
  • Payment by gift cards, wire transfer, crypto or a courier collecting cash.
  • The caller avoids answering a personal question only the real person would know.
Choose a safer response

What to do immediately

  • Hang up and call the person back on the number you already have saved.
  • Agree a family code word in advance and ask for it on any emergency call.
  • Never send gift cards, crypto or wire transfers on the strength of a phone call.
  • Report the call to your national fraud reporting service.
Back to the field guide
13Impersonation / Global"Hi Mom" WhatsApp Impersonation

A message from a new number claims to be your family member who lost their phone — and needs a payment.

Who scammers target
Parents, especially those whose children live away from home
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
Medium risk
Why people fall for this
A lost phone is a completely normal thing to happen, so the excuse never sounds suspicious.

How it works

  1. You receive a WhatsApp or SMS from an unknown number: "Hi Mom, this is my new number."

  2. The sender is warm and chatty, and mirrors how your family actually talks.

  3. Within a day they explain a locked bank app and ask you to pay a bill for them.

  4. The account details belong to a money mule and the funds move on within minutes.

Fictional teaching example

Priya gets a message from an unknown number saying her son changed phones. Two messages later he asks her to pay an urgent invoice of $1,850 because his banking app is locked. She pays. Her son never messaged her.

Notice the pattern

Red flags to notice

  • The contact refuses a voice or video call, always with an excuse.
  • A new, unsaved number claims to be someone you know well.
  • The first real request is money, an app code, or a gift card.
Choose a safer response

What to do immediately

  • Call the person on their old, saved number before doing anything.
  • Ask a question only they can answer — and don't accept a vague reply.
  • Never forward verification codes, even to family.
  • Report and block the number inside the messaging app.
Back to the field guide
14AI & Deepfake / GlobalDeepfake Celebrity Investment Pitch

A video of a famous investor or news anchor promotes a platform that does not exist.

Who scammers target
First-time investors and people following financial news on social media
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
High risk
Why people fall for this
A recognisable face plus polished video makes the pitch feel vetted by someone trustworthy.

How it works

  1. A short, well-produced video ad shows a public figure endorsing a trading platform.

  2. The face and voice are synthetic; the clip is stitched from real footage.

  3. You sign up with a small deposit and see a dashboard showing fast gains.

  4. An "account manager" pushes bigger deposits, then withdrawals stop working.

Fictional teaching example

Tom sees a video of a well-known TV anchor announcing a national AI-trading programme. He deposits $250, watches it 'grow' to $3,100, deposits $20,000 more, and is then told he must pay a 15% release fee before he can withdraw.

Notice the pattern

Red flags to notice

  • A celebrity endorsement that appears only in an advert, never on their own verified channels.
  • Lip movement, blinking or audio timing that feels slightly off.
  • An assigned personal 'account manager' who calls you repeatedly.
Choose a safer response

What to do immediately

  • Check whether the public figure has ever mentioned the platform on their verified accounts.
  • Look up the company on your national financial regulator's register before depositing.
  • Treat any request to pay a fee to unlock your own money as proof of fraud.
  • Screenshot the advert and report it to the platform hosting it.
Back to the field guide
15Marketplace / GlobalMarketplace Buyer Reversal

A "buyer" sends you a payment request instead of paying, and you end up paying them.

Who scammers target
Private sellers on classifieds and social marketplaces
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
Medium risk
Why people fall for this
The screenshot of a payment looks like proof, and sellers feel rude asking a buyer to wait.

How it works

  1. You list an item on a classifieds site, Facebook Marketplace or a social app.

  2. A keen buyer says they've paid and shares a screenshot of a fake success message.

  3. They then send you a payment request or QR code to "confirm you received it".

  4. Approving it sends the sale amount from you to them.

Fictional teaching example

Faiz sells a phone for the equivalent of $150. The buyer sends a QR code and says "scan this to receive payment". Faiz scans, approves, and the money leaves his account. The buyer disappears.

Notice the pattern

Red flags to notice

  • The buyer refuses to pay first and pushes a QR code or request at you.
  • A payment-success screenshot arrives before any money reaches your account.
  • The buyer insists on overpaying and asks for the difference back.
Choose a safer response

What to do immediately

  • Never scan a QR code or approve a request in order to receive money.
  • Check your own bank statement or app balance, never the buyer's screenshot.
  • Meet in a public place and prefer cash or a confirmed credit before handing over goods.
  • Keep the conversation on the platform so there is a record.
Back to the field guide
16Investment & Crypto / GlobalFake Investment & Task Platforms

An app or site promises guaranteed daily returns, pays small amounts first, then vanishes.

Who scammers target
Students, gig workers and anyone seeking extra income
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
High risk
Why people fall for this
Small early withdrawals really do arrive, which turns scepticism into confidence.

How it works

  1. A Telegram, WhatsApp or Discord group promotes an app with "guaranteed daily returns".

  2. The app is installed from a link, not from an official app store.

  3. Small early payouts build your trust so you invest more.

  4. When you try to withdraw, you're asked for a "tax" or "clearance fee" — then the operator disappears.

Fictional teaching example

Karan invests a small amount and receives a payout the next day. He adds his savings. When he requests a withdrawal, the platform demands a clearance fee, he pays it, and the group is deleted that night.

Notice the pattern

Red flags to notice

  • The app is sideloaded from a link instead of an official app store.
  • Withdrawals require an upfront fee or tax payment.
  • No licence or registration number from a real financial regulator.
Choose a safer response

What to do immediately

  • Treat any "guaranteed daily return" as fraud — no legitimate investment works that way.
  • Verify the operator on your national regulator's register before paying anything.
  • Never pay a fee to release your own money.
  • Report the group and the app to the platform and to your fraud reporting service.
Back to the field guide
17Investment & Crypto / GlobalLong-Con Crypto "Pig Butchering"

A friendly stranger builds a relationship for weeks, then introduces a crypto platform they control.

Who scammers target
Adults aged 25–55 contacted through dating apps and social media
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
High risk
Why people fall for this
Weeks of genuine-feeling friendship come before any money is mentioned, so it never feels like a cold pitch.

How it works

  1. A wrong-number text or dating-app match turns into daily friendly conversation.

  2. After weeks, they mention a trading platform their "uncle" runs.

  3. You deposit a little, see profits on a dashboard that is entirely fake, and deposit more.

  4. Withdrawal attempts trigger fees, taxes and eventually silence.

Fictional teaching example

A stranger texts "Is this Dr. Chen's office?", apologises, and keeps chatting. Six weeks later Mark has moved $80,000 into a platform showing $210,000 in gains. He cannot withdraw a cent.

Notice the pattern

Red flags to notice

  • A stranger who contacted you first eventually steers the conversation to investing.
  • The platform is only reachable through a link they sent you.
  • Profits look large, smooth and unrealistically consistent.
Choose a safer response

What to do immediately

  • Never invest through a platform introduced by someone you have not met in person.
  • Verify any exchange on your regulator's register and search its name plus the word "scam".
  • Withdraw a small amount early — if that fails, stop immediately.
  • Report it; recovery is rare, but reporting helps freeze mule accounts.
Back to the field guide
18Romance & Social / GlobalRomance Scam

An online partner you have never met in person eventually needs money for a crisis.

Who scammers target
Lonely, widowed or recently separated adults of any age
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
High risk
Why people fall for this
The emotional relationship is real to the victim, and the first request for money is always small and reasonable.

How it works

  1. A profile with attractive photos matches with you and moves fast emotionally.

  2. They always have a reason not to video call: offshore work, deployment, bad signal.

  3. After trust is built, a crisis appears — customs fees, medical bills, a blocked account.

  4. Each payment leads to another, larger request.

Fictional teaching example

After four months of daily messages, Susan's partner — an "engineer on an oil rig" — needs $4,500 to release equipment from customs. Six payments later he stops replying.

Notice the pattern

Red flags to notice

  • They declare strong feelings very quickly and never video call.
  • Photos look professional; a reverse image search shows another person.
  • Money requests arrive as a one-time emergency, then repeat.
Choose a safer response

What to do immediately

  • Do a reverse image search on their photos early.
  • Never send money, crypto or gift cards to someone you have not met in person.
  • Talk to a friend or family member before sending anything — isolation is the scammer's tool.
  • Report the profile to the platform and to your national fraud service.
Back to the field guide
19Tech Support / GlobalTech Support Pop-Up

A scary full-screen warning tells you your computer is infected and gives a support number.

Who scammers target
Older and less confident computer users
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
Medium risk
Why people fall for this
The alarm looks like it came from the computer itself, and the caller sounds patient and professional.

How it works

  1. A web page hijacks your screen with alarms and a "Microsoft / Apple security alert".

  2. The number on screen belongs to a call centre, not the software vendor.

  3. The "technician" asks you to install remote access software to "clean" the machine.

  4. They then show fake evidence of hacking and charge for a fake service — or open your banking app.

Fictional teaching example

A loud alert fills Robert's screen. He calls the number, lets a technician connect, and is told his bank account has been breached and a "refund" was overpaid. He is talked into wiring back $6,000.

Notice the pattern

Red flags to notice

  • Real security software never shows a phone number to call.
  • You are asked to install AnyDesk, TeamViewer or similar to fix a virus.
  • The technician asks you to log into your bank while they watch.
Choose a safer response

What to do immediately

  • Close the browser (force quit if needed) — the alert is just a web page.
  • Never call a number shown in a pop-up; use the vendor's official website.
  • Refuse all remote-access requests from inbound contacts.
  • If you gave access, disconnect from the internet, uninstall the tool and call your bank.
Back to the field guide
20Phishing / GlobalParcel Delivery Fee Phishing

A text says your parcel is held and asks for a tiny fee — which harvests your card details.

Who scammers target
Anyone who shops online — a large share of people are expecting a parcel
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
Medium risk
Why people fall for this
The tiny fee feels too small to be worth a scam, so people pay without checking the sender.

How it works

  1. You receive an SMS or email from a courier: "Your package is on hold, unpaid customs fee."

  2. The link opens a convincing copy of the courier's site.

  3. A small fee is charged to capture the full card number, expiry, CVV and a one-time code.

  4. Your card is then used for large purchases or added to a mobile wallet.

Fictional teaching example

Ana pays a $1.99 "redelivery fee" on a page that looks exactly like the courier's. Two days later a $1,400 electronics purchase appears on her card.

Notice the pattern

Red flags to notice

  • You are not expecting a delivery, or the message has no real tracking number.
  • The web address is a lookalike domain with extra words or hyphens.
  • A trivial fee page asks for CVV plus a code sent by your bank.
Choose a safer response

What to do immediately

  • Track parcels only in the courier's official app or by typing their address yourself.
  • Never enter card details on a page reached from an unexpected message.
  • If you entered details, freeze the card in your banking app immediately.
  • Report the message as phishing and forward it to your national reporting service.
Back to the field guide
21QR & Merchant Fraud / IndiaThe QR Code Overlay

A fake QR sticker is pasted over the shop's real one, so your money goes to the scammer.

Who scammers target
Shoppers at street stalls, small shops and parking meters
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
Medium risk
Why people fall for this
The code sits exactly where you expect it to, and almost nobody reads the payee name before paying.

How it works

  1. The fraudster prints a QR code linked to their own UPI ID.

  2. They paste it over the shop's genuine QR at a petrol pump, kirana store or parking lot.

  3. You scan and pay as usual — the money lands in the fraudster's account.

  4. The shopkeeper never receives a confirmation, and by then the fraudster has withdrawn the funds.

Fictional teaching example

Rahul fills petrol worth ₹800 and scans the QR taped to the pump. His app shows the payee as "SK ENTERPRISES" instead of the pump's name, but he taps pay in a hurry. The attendant says no payment arrived, so Rahul pays again in cash — losing ₹800.

Notice the pattern

Red flags to notice

  • The payee name in your payment app doesn't match the shop's name or board.
  • The sticker looks freshly pasted, peels at the corners, or sits on top of another QR.
  • The shop has no POS machine or passbook to cross-check the credit.
Choose a safer response

What to do immediately

  • Always read the payee name on the confirmation screen before entering your PIN.
  • Ask the shopkeeper to confirm the name shown on your screen is theirs.
  • Prefer paying by entering the shop's UPI number, or pay in cash if anything looks off.
  • If you already paid, report it in the app immediately and call 1930 (cyber-crime helpline).
Back to the field guide
22Payment App Fraud / IndiaFake Customer Support Collect Request

A fake helpline agent sends you a "refund" request that actually takes money out.

Who scammers target
Anyone searching for a helpline number online after a failed payment
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
High risk
Why people fall for this
The victim made the call themselves, which makes the 'agent' feel legitimate from the first second.

How it works

  1. You search for a bank or wallet helpline online and land on a fake listing or advert.

  2. The "agent" sounds professional, knows banking terms, and promises a quick refund.

  3. They send a UPI collect request framed as the refund.

  4. Approving it debits your account instead of crediting it.

Fictional teaching example

Meena's food order fails and ₹450 is stuck. She calls the number from a search result. The agent sends a request for ₹450 and says "approve to receive your refund". She enters her PIN and ₹450 leaves her account — then he asks her to try again for ₹4,500.

Notice the pattern

Red flags to notice

  • You are asked to APPROVE a request or enter your PIN to RECEIVE money — receiving money never needs a PIN.
  • Heavy urgency: "your card will be blocked in 5 minutes".
  • The request comes from a random personal UPI ID, not a verified merchant.
Choose a safer response

What to do immediately

  • Never enter your UPI PIN to receive money. Money in never needs a PIN.
  • Find helpline numbers only on the official app or the bank's printed statement.
  • Hang up and call back on the number on the back of your card.
  • Reject and report unknown collect requests inside your payment app.
Back to the field guide
23Phishing / IndiaKYC Phishing Link

An SMS says your account will be blocked unless you re-do KYC on a fake bank page.

Who scammers target
Bank and wallet customers, sent in bulk by SMS and email
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
High risk
Why people fall for this
Verification requests are a real part of banking, so a deadline to complete one feels ordinary.

How it works

  1. You receive an SMS or WhatsApp message warning your account will be suspended today.

  2. The link opens a page that looks exactly like your bank's website.

  3. It asks for your card number, CVV, PIN and the OTP — all on one screen.

  4. The fraudster uses those details to empty the account within minutes.

Fictional teaching example

Arjun gets an SMS: "Dear customer, your KYC expires today. Update now: example.com/kyc-verify". The page carries his bank's logo. He fills in his card details and shares the OTP. ₹62,000 is transferred in three transactions before he realises.

Notice the pattern

Red flags to notice

  • The web address isn't the bank's official domain (extra words, hyphens, or a shortened link).
  • One form asks for PIN, CVV and OTP together — real banks never do this.
  • The sender is a 10-digit mobile number instead of the bank's registered SMS header.
Choose a safer response

What to do immediately

  • Never open KYC links from SMS or WhatsApp. Type the bank's address yourself or use its app.
  • Never share OTP, CVV or PIN with anyone, including "bank staff".
  • If you clicked, change your net-banking password and block your card from the app.
  • Report the message as spam and forward it to your bank's official fraud channel.
Back to the field guide
24Tech Support / IndiaScreen-Sharing Remote Drain

You are asked to install a "helper" app that lets the scammer watch and control your phone.

Who scammers target
Less technical users of any age, often after a genuine failed transaction
Financial exposure
Varies by case; example amounts are illustrative.
Risk level
High risk
Why people fall for this
Installing a 'helper app' feels harmless because no password or PIN is ever requested out loud.

How it works

  1. A caller offers to fix a failed transaction or a slow refund.

  2. They ask you to install a remote-access app such as AnyDesk or TeamViewer.

  3. Once you share the code shown by the app, they can see your screen live.

  4. They read your OTPs and make transfers from your own banking app.

Fictional teaching example

Sunita's ₹2,000 recharge fails. "Support" asks her to install an app and read out a 9-digit code. A ₹1 test debit appears, then ₹48,000 leaves her account while she watches, unable to stop it.

Notice the pattern

Red flags to notice

  • Any request to install a screen-sharing or remote-control app is a red flag, always.
  • You are asked to read out a code shown by that app.
  • A small "test" debit appears just before larger transfers.
Choose a safer response

What to do immediately

  • Refuse all screen-sharing requests, no matter how official the caller sounds.
  • If you installed such an app, turn on airplane mode and uninstall it immediately.
  • Call your bank to freeze the account and then file a report at cybercrime.gov.in.
Back to the field guide

IF MONEY HAS ALREADY MOVED

Know where
to turn.

Already lost money? Report it immediately — the first few hours give the best chance of freezing the funds.

Read the recovery steps

PUT YOUR INSTINCTS TO WORK

Think you can spot these in the wild?

Take the quiz