Spot scams. Keep your money and accounts safe.

Looks real.
Sounds real.
Is it?

A text from your “bank.” A call that sounds like your child. Scammers pretend to be someone you trust to steal from you.

Stop. Call a number you know.
Check before you act.

Start with these 3 steps ↓

No tech skills needed. Learn what to do, step by step.

01

Stop.Don’t tap a link, send money, or share a code.

02

Call a number you know.For your bank, use the number on your bank card.

03

Ask if it’s real.“Did you send this? Do I need to do anything?”

What is phishing?

Phishing (say “fishing”) is a scam. Someone pretends to be a person or company you trust. They try to get your money, private details, or a way into your accounts.

A link is text, a picture, or a button that opens a web page when you tap or click it.

You can say: “I’ll call back at a number I already have.” Then hang up. Don’t use a number or link the caller gives you. If you need help, ask a person you trust.

01 / QR code scams

That square code
could lead to a scam.

A QR code is a square pattern you scan with your phone’s camera. It can open a web page, such as a menu or payment page.

A scammer can put their own code over a real one. Or they may send a code in a text or email. It can lead to a fake page that steals what you type.

  1. Look for a sticker covering another code.
  2. Don’t scan codes in messages you did not expect.
  3. To pay, use the company’s app you already have. Or ask staff how to pay safely.

Also called “quishing.” Source: FTC [1]

How a QR scam can work
1. ScanYou scan a code.
2. OpenIt opens a fake page.
3. TypeThe scammer gets your details.

This drawing is not a working QR code.

Already scanned one? That alone does not mean someone has your account. Close the page if you are unsure. Don’t type in details, install an app, or tap “Allow.” See what to do next.

See the trick / Made-up example

Warning sign

A new sticker.
A different payment page.

A scammer may cover a real code with their own. The new code can send your payment details to them.

What to doUse the parking company’s app you already have. Or ask an attendant how to pay. Don’t use the covered code if you are unsure.

A sticker is a reason to check. It is not proof of a scam. Patterns shown here do not scan. Source [1]

A fake page can look real

Not sure about a link?
You don’t have to use it.

Scammers copy logos and web pages. Even a web address with a company’s name in it can be fake.

Use a safer way: Close the message. Open the company’s app from your phone’s home screen. Or call the number on your bank card or a bill you already have.

A padlock symbol or “https” in a web address does not mean the business is honest. It means the connection is protected.

Sources: FTC [3], FBI [7].

Made-up web addresses — not real links
https://bank.example.scam.example/login

Here, scam.example is the site’s main name. Putting “bank” at the start does not make it your bank.

https://bank.example/login

This is a different address.

Hard to tell them apart? That’s the point of the trick. You can call the bank instead of trying to judge the link.

02 / Scams made with AI

A voice or face
can be fake, too.

AI is short for artificial intelligence. These computer tools can make words, pictures, voices, and videos. Scammers use them to make lies look and sound real.

A well-written message

AI can write clear messages with no spelling mistakes. Good writing does not prove a message is safe.

A voice you know

A scammer can copy a loved one’s voice. They may say, “I’m in trouble. Send money now.”

A face you know

A fake video can look like a real person. Even a video call may not prove who someone is.

You do not have to spot the fake. Hang up. Call your loved one at the number saved in your phone. If they don’t answer, try someone else who knows them. You can also agree on a private family word ahead of time as an extra check.

Source: FBI: AI scams [2].

See the trick / Made-up example

A familiar voice
“It’s me. I’m in trouble.
Please send money now.
Don’t tell anyone.”

A voice can be copied.
A name on your screen can be fake.

What matters is the request

Money. Fear. Secrecy.

You may not hear anything wrong with the voice. You can still stop and check.

  1. Hang up.You can say: “I’ll call you right back.”
  2. Call the saved number.Use the number you already have for your loved one.
  3. Ask about the call.“Did you just call me? Are you safe?”

Source: FBI [2]

See the trick / Made-up example

A small fee can hide a big scam.

3 things to notice
  1. A surprise problemYou may be waiting for a package, but this text still needs checking.
  2. A short deadline“Today” pushes you to act before you think.
  3. A request for paymentA small fee can be bait to get your card details.
What to doClose the text. Check the order in the store’s app or website you used to buy it. Don’t reply to the text.

Source: FTC [3]

03 / Common scams

Different messages.
The same goal: trick you.

Here are common examples. Scammers can mix these tricks. You do not need to remember their names.

Email

Fake emails

An email asks you to sign in or open a file. It may look like it came from someone you know.

What to doCall the sender at a number you already have before opening a file you did not expect.

Also called: Phishing; targeted emails are called spear phishing. Source [7]

Text messages

Fake texts

A text says you owe a toll, missed a package, or have a bank problem. It asks you to tap a link.

What to doDon’t reply or use the link. Open the company’s app yourself to check.

Also called: Smishing. Source [3]

Calls and voice messages

Fake calls

The caller says they work for your bank or the government. The name and number on your phone can be fake.

What to doHang up. For your bank, call the number on your card. Don’t share a sign-in code with a caller.

Also called: Vishing. Source [7]

Bills and work messages

Fake payment requests

A message says your boss or a business needs money sent to a new bank account. A real email account may have been stolen.

What to doBefore paying, call the person at a number you already have. Ask if the bank details really changed.

Also called: Business email compromise. Source [8]

Search results and social media

Fake sites and people

An ad can lead to a fake site. A social media account may belong to a scammer, even if it has a photo you know.

What to doDon’t trust an ad or photo alone. Use the business’s app or call a person you already know.

Also called: Fake ads, profiles, and stolen accounts. Source [9]

Computer warnings

Fake tech help

A warning on your screen says to call for help. A scammer may ask to control your computer from far away.

What to doDon’t call the number in the warning. Ask someone you trust to help you reach the real support team.

Also called: Tech support and callback scams. Source [10]

More tricks to watch for

Tap or click a heading to read more.

A page tells you to copy and run computer instructions

It may say “prove you’re human” or “fix this error.” Stop if it asks you to paste text into a computer command box, such as “Run” or “Terminal.” Those steps can install harmful software. Ask a trusted tech helper before doing anything else. This trick is called ClickFix. Source [5]

Your phone asks you to approve a sign-in

If you did not start signing in, choose “Deny” or “No.” Don’t approve it just to make the alerts stop. Don’t give a caller a sign-in code. Fake sign-in pages can steal both your password and code. Source [4]

Someone sends you a code to type into a sign-in page

Even a real sign-in page can be part of a trick. The code may let the scammer into your account. Only enter a setup code for a device you own and a setup you started. This is called device-code phishing. Source [4]

An app asks to read your email or files

“Allow” can give that app access to your private information. If you don’t know the app or why it needs access, don’t agree. Ask the real service’s support team or your work tech team for help. This is called consent phishing. Source [6]

04 / Try an example

What would you do?

A caller sounds just like someone in your family. They say they are in trouble and need money right now.

This is a made-up example. We don’t save or send your answer.

Tap or click your answer.

Choose an answer to see a tip.

05 / Simple steps that help

Make your accounts harder to steal.

Use a different password for each account

If one is stolen, it won’t unlock the rest. Turn on the extra sign-in check in your account’s security settings. This is often called “two-step verification” or “MFA.” Source [3]

Let your phone and computer update

Updates fix safety problems. Turn on automatic updates in your device’s settings. Keep a spare copy of important files, called a backup. Ask someone you trust if you need help. Source [3]

Ask about passkeys

A passkey lets you sign in using your device, often with your face, fingerprint, or screen-lock code. It helps stop fake sites from stealing your sign-in. Ask the service’s support team how to set one up.

It won’t stop every scam. Still check requests for money or access. Source [4]

06 / Already clicked or shared something?

Act now.
You don’t need to feel ashamed.

Stop talking to the scammer. Choose what happened below. Tap or click a heading to see the steps. More than one may fit.

Need help with these steps? Ask a person you trust, the real company’s support team, or your workplace tech team. Use a number from your card or a bill—not from the suspicious message.

I clicked a link or scanned a QR code
  1. Close the page. Don’t type anything or tap “Allow.”
  2. If a file was saved to your device, don’t open it.
  3. If you think harmful software ran, ask a trusted tech helper to check your device. At work, tell your tech team.

A click alone does not mean your account was stolen. Source [3]

I shared a password or code, or tapped “Allow”
  1. Use the real app or website to change your password. If you used it elsewhere, change it there too.
  2. Contact the service’s support team. Say, “I may have let a scammer into my account.”
  3. Ask them to help sign out other devices and remove unknown apps or sign-in methods. A new password alone may not remove all access.

If you think your device has harmful software, use a different device you trust. Source [11] [4] [6]

I sent money or gave out private details
  1. Call your bank or payment service now. Use the number on your card or in its real app.
  2. Say, “I think I was scammed. Can you stop or reverse the payment?” Getting money back is not always possible.
  3. Save the messages and receipts.
  4. If you shared details such as your Social Security number, visit IdentityTheft.gov for a recovery plan.

Source [11]

I let someone control my device or installed something
  1. Stop the call. Turn off Wi-Fi on that device. If it uses an internet cable, unplug the cable.
  2. Ask your work tech team or a trusted repair person to check it and remove harmful software.
  3. Use a different device you trust to change your passwords.

Source [10] [11]

Report a scam in the U.S.

  • ReportFraud.ftc.gov: tell the Federal Trade Commission what happened.
  • IC3.gov: report internet crime to the FBI.
  • For a scam text, use your phone’s “Report Junk” or “Report Spam” option, if shown. You can also forward it to 7726 if your phone service supports this.
  • For a work account or device, tell your workplace tech team.

Watch for a second scam. Someone may offer to get your money back for a fee. They may even pretend to work for the FBI. Don’t trust an offer just because you reported the first scam. Source [3] [12]