The scam avoidance database

A call, often from a number spoofed to look like your bank's, tells you fraud has been spotted on your account. The caller knows your name, sometimes your address and recent transactions (bought or phished beforehand), and sounds exactly like a fraud team: calm, procedural, on your side.

Because 'the fraudsters are inside the bank' or 'the account is compromised', you must move your money to a 'safe account' they have set up in your name. They stay on the line while you make the transfer, coaching you on what to tell the bank if it asks (say it is for a family member, or a car).

• No bank, and no police force, will ever ask you to move money to a 'safe account'. There is no such thing.
• Pressure to act immediately and to keep it secret from staff at your branch.
• You are told what to say to the bank's questions.
• You are asked to withdraw cash, hand over your card, or buy gift cards or cryptocurrency.

A caller says they are a police officer (they give a name, a rank and a collar number) or a bank investigator. Your card has been cloned, or bank staff are issuing counterfeit notes, and you can help the investigation.

You are asked to withdraw a large sum in cash so it can be 'examined', or to hand your cards over to a courier who will collect them, or to buy high-value goods (watches, gold, foreign currency) as evidence. Sometimes you are told to key your PIN into the phone. A 'courier' — often a taxi driver who has no idea — arrives at your door within the hour.

• The police will never ask you to withdraw money, hand over your cards, buy goods or take part in a secret operation.
• The caller asks you to call back to verify them, and the line does not properly clear.
• You are told not to discuss it with anyone.

Two flavours. The threatening one: a call or automated voicemail says there is a warrant for your arrest, a lawsuit, or a tax debt that must be settled today. The friendly one: a text or email says you are owed a tax refund — tap the link, enter your details, and it will be paid.

Both peak around real HMRC deadlines (self assessment in January, the July payment on account) when a message about tax feels plausible.

• HMRC never leaves voicemails threatening arrest, never asks for payment in vouchers or crypto, and never texts or emails a link to claim a refund.
• A refund that needs your card number to be paid.
• A caller who cannot tell you your unique taxpayer reference but wants your bank details.

A text or email in a courier's name: a parcel could not be delivered, or a small fee (£1.45, £2.99) is due for redelivery or customs. The link goes to a convincing copy of the courier's site, which asks for your address and card details.

The £2 charge is not the point. Days later you receive a call from your 'bank': the delivery site was fraudulent, your card has been used, and you must move your money to a safe account. Because you remember paying, the story fits.

• Royal Mail and the couriers do not text a payment link for a fee — a genuine missed delivery leaves a card or shows in the app you already have.
• A link to a domain that is not the courier's (royalmail-redelivery.com, evri-parcel.info).
• A follow-up call that knows about the parcel payment.

A pop-up says your computer is infected and shows a number to call; or a caller from 'Microsoft', 'BT' or 'Amazon' says your machine is sending errors, your broadband has been hacked, or a refund is owed for a subscription. Either way you are guided to install a remote-access app (AnyDesk, TeamViewer and the like) 'so they can fix it'.

In the refund version they 'accidentally' transfer too much — by editing the page you are looking at — and ask you to send the difference back. In the fix-it version they log into your bank while your screen is blanked, or ask you to log in to 'confirm the refund'.

• No company calls you unprompted about a problem on your computer, and none needs remote access to give a refund.
• A refund that requires you to log into your bank while someone watches.
• A blank or frozen screen 'while the fix runs'.

A WhatsApp or text from an unknown number: 'Hi Mum, I've dropped my phone, this is my new number.' A day or an hour later: a bill is due, the bank app is locked out on the new phone, could you pay it and I'll send it straight back. Account details follow.

A newer version uses an AI clone of the relative's voice, from a few seconds of social-media video, in a panicked call: an accident, an arrest, a hospital abroad.

• A new number with an immediate money request.
• They cannot take a call or a voice note ('my mic is broken').
• A question only your child could answer goes unanswered.

A supplier's or a solicitor's email account is compromised, or a look-alike domain registered. At the moment a large payment is due — an invoice, a house deposit — an email arrives saying 'our bank details have changed'. The thread, the names and the invoice numbers are all real.

The CEO version: a message that appears to come from the boss asks a finance employee to make an urgent, confidential payment.

• Any change of bank details, ever. Verify by phone on a number you already had, never one in the email.
• Urgency and confidentiality from a senior name.
• A sender domain one letter off.

A text or email in an official name says you are due a rebate (council tax, an energy support payment, a vehicle tax refund) or that a payment failed (TV licence, road tax) and must be updated to avoid a fine. The link is a faithful copy of GOV.UK, an energy supplier or TV Licensing, ending in a form for your card.

These follow the news: a new government support scheme is announced, and the scam texts arrive before the real letters do.

• GOV.UK services do not text or email links to claim money; genuine rebates are paid automatically or explained by letter.
• A domain that is not gov.uk or the supplier's own.
• Being asked for a card number to receive a payment.

An advert, a social-media post or a message from someone you have been chatting to introduces a trading platform — crypto, forex, gold, an 'AI bot'. A friendly account manager helps you open an account and deposit a small sum, £250 or so. Within days the dashboard shows it has doubled.

You are encouraged to invest more, often by taking out loans or moving pension money. Small withdrawals are allowed early to prove it works. When you try to take out a large sum there is a tax, a fee or a 'verification deposit' to pay first — and then the account manager stops answering.

• Returns that are guaranteed, or far above anything a bank or index pays.
• The firm is not on the FCA register, or is on the FCA Warning List, or is a 'clone' of a real firm using its number with a different phone and email.
• A fee to withdraw your own money.
• Pressure to borrow or to cash in a pension.

A 'free pension review' by phone, online or through a friend leads to a transfer into a self-invested pension holding exotic assets (overseas property, storage pods, forestry, carbon credits, unlisted shares) that pay the introducer a large commission and are worth little. Or you are offered access to your pension before 55 (57 from April 2028) via a loan or 'liberation'.

• An unsolicited cold call about your pension: illegal since 9 January 2019 unless you asked for it.
• A promise of access before the legal minimum age.
• Investments that are overseas, unregulated, or hard to sell.
• Being rushed, or asked to sign forms that are not fully filled in.

You search for the best fixed-rate bond and click a top advert. A professional site, in the name of a real FCA-authorised firm, offers a one-year bond at a rate a little above the best on the market. A polished application pack follows, with the real firm's registration number.

The boiler-room version is a cold call selling shares in a company about to float, with a hard sell and a deadline.

• Contact details that differ from those on the FCA register for that firm — always use the register's number to call back.
• A rate above every rate in the published best-buy tables.
• A savings 'bond' sold by a firm that is not a bank or building society (only banks, building societies and credit unions are FSCS-protected).

Weeks or months after a loss, a 'law firm', 'regulator', 'blockchain analyst' or police unit gets in touch: your funds have been traced, and can be released on payment of a legal fee, a tax, or an 'unlocking' charge. Often it is the original gang, working from their own list of victims.

• Anyone who contacts you offering to recover a loss, for a fee, up front.
• A regulator or police force asking for money — none ever does.

A profile on a dating site or a friend request on social media; attentive, affectionate, quickly moving the conversation to WhatsApp. They are abroad — a soldier, an engineer on a rig, a doctor with a charity — which explains why they cannot meet or video call. Weeks or months of daily contact build a real bond.

Then the crisis: a medical bill, a customs charge on a gift they sent you, a fare home to be with you, a business deal that needs bridging. Each request is followed by another; some victims are also asked to receive and forward money (which makes them a money mule).

• They cannot video call, and cannot meet, for reasons that keep changing.
• Declarations of love within days; requests for money within weeks.
• Their photos appear elsewhere under another name (a reverse image search shows this).
• Friends and family are warned off.

It starts with a 'wrong number' text or a friendly match that never asks for money. Over weeks the friend mentions, in passing, how well their crypto trading is going, and eventually offers to show you. You open an account on their platform (a fake one — see the trading platform entry), the numbers rise, and you put in more: savings, a remortgage, a loan.

The name comes from the operators' own slang: the victim is 'fattened' before the 'slaughter'. Many of the operators are themselves trafficked workers in compounds in South-East Asia.

• A stranger who becomes a confidant and happens to be good at crypto.
• Any investment recommended by someone you have never met.
• A platform that is not on the FCA register and that charges a fee to withdraw.

Two kinds. The targeted one: an attractive stranger on social media or a dating app moves quickly to a video call or an exchange of images; the moment they have something, the demands begin, with a screenshot of your friends list. Young men and teenage boys are heavily targeted.

The mass one: an email says 'I know your password is [a real old password from a breach]', claims to have recorded you through your webcam, and demands Bitcoin. There is no recording.

• A new contact who steers quickly to sexual content and a camera.
• An email 'proving' access with a password that is old.

An advert on Facebook, Instagram or TikTok, or a search result, for a brand at 70% off, a sold-out console, a puppy, a heat pump grant. The site is professional and has reviews. You pay by card or, increasingly, by bank transfer 'because our card machine is down'. Nothing arrives, or a £3 item arrives so the tracking shows delivered.

• Prices far below every other seller.
• A site only weeks old (check a domain lookup), no address, no phone, a contact form only.
• Payment by bank transfer, crypto or gift card only.
• Reviews that are all five stars and all the same week.

As a seller: a buyer wants your item at once and will 'send a courier'. A text or email from the 'courier' asks you to pay an insurance or booking fee, or to enter your bank details on a form to receive payment. Or a fake 'payment sent' email arrives, holding the money until you 'upgrade your account'. Or they overpay by cheque or forged transfer and ask for the difference back.

As a buyer: a seller asks you to pay by bank transfer or PayPal 'friends and family' (no protection) and vanishes; or asks to move off the platform to avoid fees.

• Anyone asking you to leave the platform's messaging or payment.
• A courier that charges the seller a fee by text.
• 'Friends and family' or bank transfer to someone you do not know.
• A payment that is 'pending until you do X'.

When an event sells out, tickets appear: in Facebook fan groups, on Twitter/X and Instagram, and on professional-looking resale sites. The seller sends a screenshot of real tickets, takes a bank transfer, and either disappears or sends a PDF that has already been used.

• Tickets for a sold-out event from a stranger.
• Payment by transfer only; refusal to use the official resale platform.
• A seller's account that was posting about something else last month (it has been hacked).

A flat at below-market rent, with photos lifted from a real listing. The 'landlord' is abroad and cannot show it; a holding deposit will take it off the market, and the keys will be posted. In student cities the same flat is let to a dozen people. The holiday version is a villa listed on a copied site, or an owner who asks to be paid outside the booking platform for a discount.

• Cannot view the property; will not meet.
• Rent well below the area's going rate (compare it on this site).
• Money requested before any viewing or contract.
• Off-platform payment for a holiday.

A sticker with a QR code is placed over the real one on a parking meter, a sign, a bike-hire dock or a table. The code opens a copy of the parking app's site and takes your card — sometimes signing you up to a recurring 'subscription'. QR codes in emails carry the phishing link past filters that check written links.

• A code on a sticker, over another code, or on a sign that would not normally carry one.
• A payment page that is not the parking operator's app or domain.
• A QR code inside an email from a 'bank' or 'delivery company'.

An advert offers a free trial or a sample for the cost of postage. The small print — sometimes on another page — commits you to £80 a month unless cancelled within 14 days, and the cancellation line does not answer.

• A 'free' product that needs a card.
• Terms you have to hunt for.
• A fake article on a site dressed as the BBC or a newspaper.

A WhatsApp or text from a 'recruiter' offers flexible work: liking videos, reviewing hotels, optimising apps, for £100 to £300 a day. The first tasks pay a few pounds, into your account, to prove it. Then tasks come in 'sets' that need a deposit to unlock, with commission promised on top; the deposits grow and the withdrawal never comes.

Older versions charge a fee for training, a DBS check or equipment; another asks for your passport, National Insurance number and bank details on a fake application, then uses them.

• A job offer you did not apply for, from a messaging app.
• Any job that asks you to pay in.
• Interviews only by chat; a company with no traceable address.

Someone offers cash to use your account — a friend of a friend, a post on Snapchat or Instagram, a 'job' as a payment agent. Money arrives, you keep a cut and send the rest on, or hand over your card and PIN. The money is the proceeds of the other scams on this page.

Students and under-25s are the main targets; some are recruited through romance or job scams without realising what they are doing.

• Anyone wanting to pay money into your account for you to move on.
• A job with no work except receiving payments.

A letter, email, text or social-media message says you have won a lottery, a car or a cash prize — often in a draw you never entered. To claim it you must pay a processing fee, tax or courier charge, or provide bank details and identity documents. The fees continue for as long as you pay them.

• You cannot win a draw you did not enter.
• A prize with a fee attached — real prizes cost nothing to claim.
• A 'giveaway' from a page that is not the brand's verified one.

You apply for a loan online, or are called after a search, and are approved at once regardless of credit history. Before the money can be released a fee is due — by transfer, or in vouchers. Then a second fee. The lender may quote a real firm's FCA number.

• A fee before the loan is paid out, especially by voucher or transfer.
• Guaranteed approval.
• Contact details that do not match the FCA register.

An email or letter from a lawyer, banker or official: a distant relative has died, or a fortune needs a foreign partner to move it, and your share is millions. Each step needs a fee — legal, anti-terrorism certificate, courier, bribe — and each fee reveals the next.

• Unexpected riches from a stranger.
• Secrecy, and a fee before any money moves to you.

A 'grant finder' or 'benefit adviser' on social media offers to get you a government grant or a low-interest loan for a fee. In the Universal Credit version they apply on your behalf, take an advance payment against your claim, keep most of it as their fee — and you must repay the whole advance from future benefits.

• A fee to apply for a grant or benefit — government applications are free.
• Someone else making a claim in your name.

A knock: they are working nearby and have noticed loose tiles, a blocked gutter, a dangerous chimney, or have 'left-over tarmac' for your drive. A small job at a good price becomes a large one once they are up the ladder; they may create damage to find. Payment is cash, or a lift to the bank, or transfer to a personal account. Elderly owners are called on repeatedly.

• Unsolicited, 'working in the area', no written quote, no address.
• A problem only they can see, and a cash price.
• Pressure to decide now.

A caller with a lanyard says they are from the water company, the gas board, the council or the police, and needs to check your taps, meter or garden. While one talks, another searches. A variation asks you to help with a 'lost ball' or 'sick child' next door.

• No appointment. Genuine utility visits are booked, and callers wait outside while you phone the company on the number on your bill.
• Two callers, or one who keeps you at the back of the house.

A caller, a leaflet or an advert offers free or grant-funded insulation, solar panels or a heat pump 'under a government scheme', and a survey. The survey finds a problem; the free scheme turns out to need a deposit; the work (spray-foam loft insulation is the classic) can make a house unmortgageable.

• A grant that requires payment.
• A scheme you must sign up to today.
• Spray foam. Lenders and surveyors have refused mortgages over it.

After a disaster or a widely reported death, appeals appear within hours: a crowdfunding page, a social-media post, an email, a collector at the door. Some copy a real charity's branding; some invent one. Clothing collection bags in a charity's name are sometimes sold on for profit.

• No registered charity number (check it on the register of the Charity Commission, OSCR in Scotland, or the Charity Commission for Northern Ireland), or one that belongs to a different charity.
• Pressure and emotion with no detail.
• A page set up the same day as the event by someone with no connection to it.

An email (phishing), text (smishing) or call (vishing) in the name of a service you use — bank, Apple, Microsoft, Netflix, PayPal, a courier — says something needs your attention: a suspended account, a failed payment, an unusual login. The link opens a pixel-perfect copy of the login page. Whatever you type goes to the scammer, who may log in to the real site while you are still on the fake one and ask you for the code that was just sent to your phone.

• Any link in a message that asks you to log in. Go to the site yourself instead.
• A sender address or URL that is nearly right.
• A demand for a security code — no genuine organisation asks for one over the phone or in a message.

They already have your card number or password (from a breach or a phishing page). They try to log in or pay, which sends a code to your phone. Seconds later you get a call — the 'fraud team', a marketplace 'buyer', an automated voice — asking you to read the code back to 'cancel the transaction' or 'verify you are the account holder'. Automated OTP bots do this at scale.

• Anyone asking for a code that was sent to you.
• A code arriving when you did not do anything.

Using details gathered from social media, breaches or phishing, the fraudster convinces your mobile provider (or bribes an insider) to move your number to a SIM they hold. Your phone loses signal; theirs starts receiving your calls and texts, including bank and email verification codes. Within an hour they reset passwords and empty accounts.

• Sudden loss of signal when others have it.
• A text from your provider about a SIM or port request you did not make.
• Password-reset emails you did not ask for.

A message from a friend: 'I'm entering a competition, can you vote / can I send a code to your phone?' Or a 'copyright violation' notice from Instagram. Either way you hand over a login code and lose the account. It is then used to post crypto 'success stories', sell fake tickets to your friends, and message your contacts with 'Hi, can you help me out?'.

• A friend asking for a code sent to your phone.
• A platform notice with a link — go to the app's own settings instead.

A link installs an app outside the official store — a 'security update', a 'parcel tracker', a free version of paid software, a game mod. On Android particularly, the app then overlays fake login screens on your real banking app, reads incoming codes, and can even hide the transaction alerts. On PCs, a download from a torrent or a fake update pop-up carries an information stealer that lifts saved passwords from your browser.

• An app that must be installed from a link rather than the store.
• An app asking for accessibility or SMS-reading permissions.
• Software that should cost money, free.

Almost every scam on this page ends the same way: you send money by bank transfer. Faster Payments settle in seconds, the receiving account (a mule's, or one opened with stolen identity) is emptied within minutes, and the money is split and moved abroad or into crypto. Scammers coach you through the bank's warning screens because those screens are the last real defence.

• Anyone telling you what to say to your bank.
• Being asked to split a payment into several smaller ones.
• A payee name that does not match — the bank's 'confirmation of payee' check says so, and the scammer explains it away.

Online: details stolen from a breached retailer or a phishing page are used for purchases that need no card present. In person: a skimmer on a cash machine or a tampered card reader copies the stripe and a camera catches the PIN; or the 'distraction' version — someone drops coins, shoulder-surfs your PIN, and the card is swapped or lifted as you leave.

• A cash machine with a loose or bulky card slot or keypad; use one inside a bank.
• Someone standing close at the machine, or a stranger who 'helps' when the machine keeps your card.
• Small test transactions (99p) on your statement.

Whatever the story — HMRC, a court fine, a boss who needs cards for clients, a romance partner's emergency — the payment method is the tell. You are sent to a supermarket to buy gift cards for hundreds or thousands of pounds and told to scratch off and read the codes. Shop staff are trained to ask; scammers coach you to lie to them.

• No government body, bank, utility, court or employer will ever ask you to pay a debt or a fee in gift cards.
• Being told what to say to shop staff.

A cheque or a transfer arrives for more than agreed — for an item you are selling, for a 'mystery shopper' assignment, for a room you are letting. You are asked to forward the difference, or the cheque, to a third party. The cheque bounces, or the transfer is reversed as fraudulent, after your payment has gone.

• Any overpayment with a request to send some back.
• A payment that must be forwarded to someone else.

Caller ID can be set to any number, and a text's sender name can be set to any word, so a scam text can land in the same thread as your bank's genuine messages and a call can show your bank's real number. Regulators and networks have been tightening this since 2023 but it is not gone.

• Not the number: the request. A genuine caller from your bank will never mind you hanging up and calling 159.