The words in scam warnings, explained.

When someone gains control of an online account that is not theirs — often by combining a stolen password with a code or approval tricked out of the owner.

A scam that promises money, a prize, a loan or a job but asks for a fee first. The promised money never arrives, and new fees tend to follow.

A phishing page that passes your sign-in through to the real service while recording it. Because the login really happens, it can capture session information and get past some one-time codes.

A UK term for scams in which the victim is tricked into authorising a payment to a criminal’s account. Since October 2024, UK rules have required most payment firms to reimburse many victims, within limits and conditions — ask your bank how they apply.

Fraud that uses a hacked or imitated business email account to redirect payments — for example by changing a supplier’s bank details or impersonating an executive.

Making a phone call display a false number or name, such as your bank’s real number. It means caller ID cannot prove who is calling.

Using a fake online identity to deceive someone, often to start a relationship that later turns into requests for money or images.

A card-payment dispute in which the card issuer may reverse a transaction. Eligibility and time limits vary, so contact your card issuer quickly.

A fake investment company that copies the name, address or registration details of a genuine authorised firm. Using only the contact details listed in the regulator’s register protects you.

Audio, video or images created or altered with AI to make someone appear to say or do something they did not.

Someone sends a cheque for more than you are owed and asks you to return the difference. The cheque later bounces, and you lose the money you sent.

Any scam that demands payment in gift cards. The card numbers can be spent almost immediately and are hard to trace, which is why no genuine agency or business will insist on being paid this way.

A web address that imitates a real one with a small change: a swapped letter, an added word or a different ending.

Malicious or scam adverts, including fake search ads that lead to copied websites or fake support numbers.

Sending repeated login-approval prompts in the hope that the account holder approves one by mistake, or just to make them stop.

Someone who receives and moves money for criminals, sometimes unknowingly after being recruited through a fake job or relationship. Moving money for others can have serious legal consequences.

Signing in with more than one kind of proof, such as a password plus a code, an app approval or a passkey. It greatly reduces risk, but codes can still be captured by fake sign-in pages, and text-message codes can be diverted by a SIM swap. Passkeys resist both where they are available.

A buyer or tenant ‘accidentally’ pays too much and asks for the difference back. The original payment is fake or later reversed.

A way to sign in without a password, using a cryptographic key stored on your device. Passkeys are designed to work only on the genuine site, which makes them resistant to phishing.

Messages that pretend to come from a trusted source to trick people into revealing information, opening links or files, or making payments.

Scams that build a friendship or romance over weeks before steering the victim into a fake investment platform. Many organisations now prefer the term ‘relationship investment scam’.

Phishing that uses a QR code to hide a malicious web address.

Targeting people who have already lost money with fake offers to get it back — for a fee.

The part of a web address that an organisation registers and controls, such as harbourbank.example in login.harbourbank.example/account. It tells you whose site you are on — although on services where anyone can publish pages, such as form builders or file-sharing sites, a genuine domain does not vouch for the content.

Legitimate tools that let someone see or control a device from elsewhere. Scammers ask victims to install them so they can watch banking sessions or move money.

A caller posing as a bank, police officer or official tells you to move money to a new ‘safe’ account to protect it. Banks do not ask customers to do this.

Threatening to share intimate images unless the victim pays or sends more. If it happens, stop contact, do not pay, keep the evidence and report it to the platform and police.

When a criminal persuades a mobile provider to move your number to a SIM card they control, so that your calls and security codes go to them.

Phishing by text message (SMS).

Manipulating people into giving access, information or money by exploiting trust, fear, urgency or helpfulness, rather than hacking technology directly.

Disguising an email, call, message or website so it appears to come from a trusted source.

Fake warnings or calls claiming a device has a problem, used to sell bogus fixes or to gain remote access.

A short code sent to confirm a sign-in, change or payment. It proves that you are present — so never share it with anyone who contacts you.

Scams carried out by phone call or voicemail.

A bank-to-bank or money-transfer-service payment that is usually fast and difficult to reverse once received.