Trusted identity
Trusted brand, government, police, delivery firm, family, romantic interest, Microsoft / Apple / Amazon.
The costume changes. The script does not.
A bank "investigator," a grandchild in trouble, a recruiter, a lover overseas, a pop-up that says your PC is infected. Different faces, one sequence.
The four-move pattern
Manufactured urgency
Arrest, account freeze, prize expiry, medical emergency, "the deal closes tonight," stay on the line.
Cut off outside checks
"Don't tell your bank." "This is confidential." Don't hang up and call back on a number you already have.
Hard to reverse
Gift cards, crypto, wire, cash drop, remote-access "refund." Real tax offices and police do not collect this way.
AI has changed the pretend and pressure moves
The four-move pattern above hasn't changed. What's changed is how convincing "pretend" now sounds and looks: a cloned voice, a live deepfake face on a video call, a flawless personalised email. A few seconds of public audio or video is now enough to fake someone convincingly.
A familiar voice, asking for money or a code
Used for fake grandchild emergencies, a "boss" asking for an urgent transfer, and virtual-kidnapping calls. No one has actually been taken; the call is designed to stop you thinking.
A real-looking face on the call
Live deepfake video has fooled experienced professionals on real conference calls. Seeing a face is no longer proof of who it is.
The rule: never authenticate someone using the same channel they contacted you through. Hang up and contact that person or company back on a number you already had saved, not one they just gave you.
Common types and the extra desk that matters
Always file the general national report first. These are the extra doors worth knowing for specific plots. For the fuller list, see scam types A to Z.
Fake login, QR, "verify now"
Type the real address yourself rather than tapping a link. Forward UK and NZ spam texts to 7726; in Australia, report the site on Scamwatch. Report the domain to your national CERT.
Bank, tax office, police, family
Caller ID is cheap to fake. Hang up. Call the number on the card or a government site you typed yourself. For family emergencies, call the relative on a number already saved in your phone.
Love, then a trading app
Fast intimacy, then a crisis or a "shared" investment dashboard. People you haven't met in person shouldn't receive transfers. Report the app and wallet addresses to IC3 as well as your national portal.
Guaranteed returns
Check the firm against your financial regulator: SEC/CFTC (US), FCA (UK), ASIC (AU), CSA (CA), FMA (NZ), MAS (SG), FSCA (ZA), SEBI (IN), SEC (PH). Unsolicited DMs offering returns are a red flag on their own.
Pop-up or cold call
Real Microsoft, Apple and ISPs do not call you and take remote control. Don't buy gift cards to pay for a "fix." Disconnect, then scan with software you installed yourself.
Pay to get paid, or move off-platform
Jobs that ask you to buy equipment or cash a cheque. Marketplaces that push payment off the platform. Keep disputes inside the platform's own protection first.
"You won": now pay a fee
You never prepay tax to collect a real prize. For invoice scams on software you didn't buy, call the company on a number you already know is genuine.
The second sting
After a loss, someone offers to get it back. Often the same network, or a buyer of victim lists. Official agencies never charge a victim to file a report. See the full recovery-scams warning.
A useful habit: if a message asks you to act now and pay in a way you can't reverse, pause and call a person you trust. Scammers hate a second voice in the room.