Scam guide
How the common scams work, the tells to look for and what to do instead. Each guide has a real-looking example you can try.
Read the address
Work out who really owns a web address or email sender, and spot the tricks that fake it.
@ userinfo trick
Everything before @ in a URL is a username, not the destination, so a trusted-looking name can precede the real host.
Combosquat domain
Real brand name plus extra words (support, secure, login, billing) on a domain the brand does not own.
Display-name spoof
Free-mail or unrelated address wearing a trusted display name.
Fake page on a real host
Scam pages hosted on real Google/Microsoft/cloud platforms (sites.google.com, forms, storage buckets); the domain is real but the page is not the brand's.
Lookalike top-level domain
Same name as the real brand with a different ending (.co, .cm, .zip, .mov instead of .com). Content uses .test as the stand-in so no real domain is referenced.
Punycode / IDN homograph
Internationalized domain using lookalike characters; the underlying xn-- form differs from the brand.
Reply-To mismatch
From address looks right but replies go to a different domain.
Shortened links
Shorteners hide the destination.
Subdomain trick
Brand name placed in the left-hand labels of a host owned by someone else (login.brand.tld.other.tld).
Typosquat domain
Sender or site domain is the real brand with a swapped, dropped or lookalike character (rn for m, 1 for l).
Phishing emails
Credential-harvest lures, risky attachments, MFA prompts and consent traps.
Adversary-in-the-middle phishing
Proxy pages that relay your real sign-in and steal the session; MFA alone does not save you.
Credential-harvest email
Email sends you to a fake Microsoft 365, Google or bank sign-in page.
HTML and archive attachments
Attachments that open a fake login page locally or install malware.
Malicious OAuth consent
A fake app asks for permission to read your mail and files, bypassing the password.
MFA push bombing and code theft
Attackers trigger repeated approval prompts or ask you to read out a code.
Fake websites and brand impersonation
Lookalike login pages, fake pages on real hosts, sponsored-ad traps and fake shops.
Browser-in-the-browser
A fake pop-up window drawn inside the page, with a fake address bar.
Fake shops from social ads
Newly-registered shops with prices far below market and no real contact details.
Lookalike login page
Cloned sign-in page on a domain the provider does not own.
SEO poisoning
Fake support or download pages ranked in organic results.
Sponsored-ad malvertising
Ads at the top of search results that display the real brand but lead to a lookalike.
Money movement and invoice fraud
Vendor bank changes, gift-card requests, payroll diversion and the call-back-on-file rule.
Executive gift-card request
Impersonated boss asks you to buy gift cards.
Overpayment and refund scam
You are 'accidentally' overpaid and asked to send back the difference.
Pay-by-wire-today pressure
Pressure to send a wire or crypto payment today.
Payroll diversion
Fake employee asks HR to change direct-deposit details.
Vendor bank-detail change
Email says the vendor's bank details changed; payments get redirected.
Subscription and billing traps
Free-trial enrollment, pre-checked boxes, fake renewals and business-directory solicitations.
Business Profile 'removal' calls
Callers claim your Google Business Profile will be removed or needs verification.
Cancel mazes and confirmshaming
Cancelling is harder than signing up.
Domain-renewal and SEO solicitations
Notices that your domain is expiring from a company that is not your registrar.
Drip pricing and pre-checked boxes
Add-ons pre-selected and a total that grows at checkout.
Fake directory and listing renewals
Invoice-style letters or emails for a directory listing you never ordered.
Fake renewal invoice (callback scam)
Email says you were charged for a renewal and gives a number to call.
Free-trial and small-charge enrollment
A $1 or shipping-only charge that requires a full card and enrolls you in a recurring plan.
Labor-law poster and ADA mailers
Official-looking mailers selling posters that are free from the government.
Office-supply and toner calls
Callers claim your usual vendor sent them to confirm an order.
Trademark solicitations
Look-alike USPTO letters selling unnecessary services.
Safe card and payment use
Credit versus debit, wallets and virtual cards, checkout judgment and payment-method red flags.
Card skimmers
Bulky or loose readers at pumps and ATMs.
Card-testing charges
Several tiny unknown charges mean a card number is being tested.
Credit versus debit online
Credit cards offer stronger fraud protection; debit pulls cash immediately.
Payment-method red flags
Wire, crypto, gift cards, Zelle/Venmo/Cash App or cash courier.
Wallets and virtual cards
Tokenized wallets and virtual numbers limit exposure.
Can your team spot them?
Eight quick examples, no sign-up, about three minutes.
Take the free quiz