Online Scam Awareness: How to Spot Phishing, Romance Fraud, Phone Scams, QR Code Scams and Business Fraud
Online scams are getting harder to spot. That does not make you foolish.
Scammers do not rely on bad spelling and obvious emails anymore. They use pressure, trust, fear, fake websites, convincing voices, stolen details and sometimes AI. This page helps you spot the patterns before money, data or confidence is lost.
The story changes. The pattern is usually the same.
Most scams create a strong feeling first. Love. Fear. Urgency. Excitement. Shame. Once you are in that emotional state, the scammer pushes you to act before you check.
Romance and friendship fraud
They build trust first. The request comes later.
A stranger contacts you through a dating app, Facebook, WhatsApp, Instagram or even a “wrong number” message. They are kind, attentive and interested in your life. Over days or weeks, it starts to feel real.
Then something happens. A medical emergency. A travel problem. A customs fee. A broken phone. A cryptocurrency “opportunity”. The reason changes, but the pattern does not.
Be especially careful with celebrity claims. Real celebrities such as Brad Pitt or Keanu Reeves do not privately message strangers to start relationships, ask for money, or offer secret investment opportunities.
Warning signs
- Contact arrives out of nowhere
- Strong emotional bond forms quickly
- They avoid meeting in person
- Video calls are delayed or impossible
- A crisis needs money
- They ask you not to tell others
- They pressure you to act quickly
- The requests keep coming back
CEO and business fraud
An urgent message from the boss. Except it is not.
A message arrives by email, text or WhatsApp. It appears to be from your manager, director, CEO, finance lead or a trusted supplier. The request is urgent. It may involve a payment, gift cards, payroll information, invoices or bank details.
Scammers research organisations before they strike. LinkedIn, websites and social media give them names, job titles, supplier relationships and writing styles.
No genuine senior instruction should ask someone to bypass payment controls, keep a transaction secret or avoid checking with a colleague.
Warning signs
- Message comes from a new number
- Sender asks for secrecy
- There is sudden time pressure
- Normal approval is bypassed
- Bank details have changed
- Gift cards are requested
- Checking is discouraged
- The channel feels unusual
Voice and phone scams
The voice may sound calm, local and professional.
A call claims to be from your bank, HMRC, Microsoft, Amazon, the police, a delivery company or a fraud department. They may know your name, address or part of your account information.
The old warning signs are less reliable now. Scam calls are not always robotic or obviously suspicious. Caller ID can be spoofed. Voices can be cloned. Scripts are better.
If you did not start the call, treat it as untrusted. Hang up. Use an official number from your card, banking app, statement or the organisation’s website.
Warning signs
- You did not make the call
- Fear or urgency is created
- They ask for codes or passwords
- They want remote access
- They ask you to move money
- They tell you not to tell anyone
- Caller ID is used as “proof”
- They pressure you not to hang up
QR code scams
The sticker on top of the sticker is the one to worry about.
QR codes are now common on parking machines, restaurant menus, posters, letters, delivery notices and payment pages. Most are genuine. Some are not.
Scammers can place fake QR code stickers over real ones. The code may take you to a convincing payment page or login page designed to steal your card details, passwords or personal information.
You cannot tell where a QR code goes by looking at the square. Check the web address carefully before entering any details.
Warning signs
- A sticker is placed over another code
- Edges look lifted or fresh
- The web address looks wrong
- A shortened URL is used
- It asks for login details
- It asks you to install something
- The QR code arrives in an unexpected email
- You are rushed to scan it
A word about AI, deepfakes and fake proof
Seeing a face or hearing a voice is no longer enough on its own. AI can create realistic photographs of people who do not exist, clone voices from short clips, and make video calls look more convincing than many people expect.
That matters because scammers often use “proof” to lower your guard. A photo, a voice note, a short video or a familiar-looking profile can all be part of the setup.
The safest test is still a human one: slow down, check through a different route, and involve someone else before you send money, share codes or reveal sensitive information.
Ask for something unexpected
On a video call, ask them to do something spontaneous, such as hold up three fingers in front of their face or write your name on paper.
Use another channel
Call back using a known number. Do not use a number, link or contact detail supplied in the suspicious message.
Bring someone in
Scammers want isolation. A trusted second opinion can break the pressure and help you see the pattern.
The everyday scams that still catch people out
These are familiar, but they still work because they arrive at the right moment: when you are busy, tired, worried or expecting a delivery.
Phishing emails
Fake emails from banks, HMRC, Microsoft, Royal Mail, couriers or suppliers. The aim is usually to make you click a link and enter your details.
Smishing texts
“Your parcel could not be delivered.” “You have an unpaid toll charge.” “Your account will be blocked.” Do not use the link in the text.
Investment scams
High returns, low risk, crypto, forex, rare metals or fake celebrity endorsements. If someone you have not met pushes you to invest, stop.
Purchase scams
Goods advertised online that do not exist, often through marketplaces. Avoid bank transfer where there is no buyer protection.
Impersonation scams
Someone claims to be your bank, the police, HMRC, a utility company or a fraud team. Real organisations will not ask for your PIN or full password.
Job offer scams
Surprisingly well-paid flexible work can hide money mule activity, fake recruitment fees or parcel reshipping scams.
If you feel rushed, pressured or asked to keep something secret, that feeling is the warning. Stop. Check. Tell someone you trust.
What to do if something feels wrong
You do not need to prove it is a scam before you pause. Pausing is the protection.
1. Stop the conversation
Do not click, pay, reply, download, share codes or stay on the phone because someone is pressuring you.
2. Check another way
Use a known number, official website, banking app or trusted contact. Do not use the details supplied in the message.
3. Tell someone
Scammers rely on silence. Speak to your bank, a family member, colleague, manager or trusted adviser.
What to do if you think a scammer already has access
Do not panic, but do act quickly. The sooner you cut off access, change passwords and contact the right people, the better your chances of limiting the damage.
If you shared a password
Change that password straight away from a safe device. If you use the same password anywhere else, change it there too.
- Turn on multi-factor authentication if it is available.
- Check account recovery details, including email address and phone number.
- Sign out of all other sessions if the service gives you that option.
- Check for strange forwarding rules, especially in email accounts.
If you shared a PIN, banking code or one-time passcode
Treat this as urgent. These codes can allow someone to approve payments, reset passwords or gain access to your account.
- Contact your bank immediately using the number on your card, banking app or official website.
- Do not call a number supplied by the person who contacted you.
- Tell the bank exactly what was shared and when.
- Ask whether cards, payments or online banking access need to be blocked.
If you installed remote access software
Remote access tools can let someone control your computer or phone. Disconnect first, then get help.
- Disconnect the device from the internet by turning off Wi-Fi and unplugging the network cable.
- Do not continue using the device for banking, email or password changes.
- Use a different trusted device to change important passwords.
- Ask a trusted IT provider to check the device before reconnecting it.
If you entered card or bank details
Contact your bank or card provider immediately. They may be able to stop payments, freeze cards or monitor for fraud.
- Use your banking app, the number on your card or the official website.
- Check recent transactions and pending payments.
- Save screenshots, emails, texts and payment references.
- Report the fraud so you have a reference number.
If you clicked a link or opened an attachment
One click does not always mean your device is infected, but it is worth being cautious, especially if you downloaded or opened a file.
- Do not enter any more information on the page.
- Close the browser tab or app.
- Run a security scan if you have suitable protection installed.
- Ask for help if the device starts behaving strangely.
If this happened at work
Tell your manager or IT support as soon as possible. Quick reporting helps protect colleagues, customers and the organisation.
- Do not delete the message until IT has seen it.
- Tell them what you clicked, downloaded, paid or shared.
- Give the time it happened and any phone numbers, links or email addresses involved.
- Do not feel embarrassed. Fast reporting is the responsible thing to do.
Download and share these scam awareness leaflets
These one-page guides are designed to be easy to share with staff, family members, community groups or anyone who may benefit from a simple reminder of what to watch for.
MFA Fatigue Awareness
A plain-English guide explaining how attackers abuse repeated MFA prompts, why approval fatigue is dangerous, and why unexpected sign-in requests should never be approved.
Download PDF
Voice Scam Awareness
A simple guide to suspicious calls, spoofed numbers, AI voice scams and why it is safer to hang up and call back using a known number.
Download PDF
QR Code Scam Awareness
A plain-English leaflet explaining how fake QR codes can lead to payment scams, fake login pages and stolen personal details.
Download PDF
CEO Fraud Awareness
A useful briefing sheet for teams, finance staff and small businesses about urgent payment requests, fake boss messages and changed bank details.
Download PDF
Romance Fraud Awareness
A plain-English guide to romance scams, fake profiles, deepfake warning signs and why requests for money should always be treated as a serious red flag.
Download PDF
Phishing Email Awareness
A simple guide showing the common signs of a phishing email, including lookalike domains, urgency, fake verify buttons and unexpected attachments.
Download PDFHow to report a scam in the UK
Reporting helps protect other people. It can also give you a reference number that your bank, insurer or organisation may ask for.
Report Fraud
For England, Wales and Northern Ireland, report fraud and cyber crime to Report Fraud.
reportfraud.police.uk
Phone: 0300 123 2040
Scotland
If you live in Scotland, report fraud and cyber crime to Police Scotland.
Phone: 101
Your bank
If money has moved, contact your bank immediately. Use the number on your card, banking app or official website. Do not use a number given by the caller.
Report suspicious text messages
Forward suspicious text messages to 7726. This helps mobile networks investigate scam texts and block malicious senders.
Report phishing emails
Forward suspicious emails to report@phishing.gov.uk. This helps the National Cyber Security Centre investigate phishing campaigns and take malicious sites down.
Know someone who should read this?
Scam awareness works best as a conversation. Share this page with a family member, friend, colleague, neighbour or community group.