How to Avoid Getting Scammed: Checks to Run Before You Click or Pay

Avoiding a scam does not depend on guessing what the person who messaged you intended. Before you click, install anything, or send money, look for information that does not come from that conversation: the real address of the service, a contact you found yourself, and the details shown on the confirmation screen before a payment goes out.

The seven habits below lower the risk. They do not remove it. Plenty of fraud has no spelling mistakes, no absurd price, and no missing detail, and some of it arrives with your name, your address, and a recent purchase already filled in. When a situation cannot be checked, leaving it for later is a perfectly good decision.

1. Give yourself time before you decide

When someone demands a payment, a click, or an answer immediately, that is the moment to step out of the conversation and go find a second source. You do not owe the caller a debate. You can end the call, close the message, and come back to the subject once you have checked somewhere else.

A real problem can be urgent too. The difference is that a real one is still waiting for you when you open the app yourself, and nobody legitimate is harmed by you taking ten minutes. Manufactured pressure is one of the few things almost every scam has in common, which is why the FTC lists it first in its guidance on recognizing and avoiding phishing scams.

2. Find the official channel on your own

Leave the message and use a route that was already yours: the app you installed earlier, the address you know how to type, the number printed on the back of your card or on your statement. Do not call a number that arrived in the same contact that brought you the problem.

The Cybersecurity and Infrastructure Security Agency gives the same instruction in its guidance on recognizing and reporting phishing: do not act on the contact details inside a suspicious message, and reach the organization through a channel you already trust. The FCC says the same about scam texts in its guidance on smishing, the name for scam text messages.

If the other channel does not answer

Silence on the other end does not make the request real. If a family member does not pick up, wait, or reach someone else who would know. If official support is closed for the day, that is not a reason to go back to the number or the link in the message because someone said the deadline is tonight.

A real bill can have a due date, a late fee, or another condition worth taking seriously. Look that up on the statement, the contract, the app, or the official site once it is available. Until you know where the charge came from and who receives the money, leave it unpaid.

Your correct details do not prove who is speaking

Your full name, your address, your employer, a recent purchase: all of it can be used to make a message sound like it came from somewhere real. Data breaches, public records, and marketing lists put those details in circulation constantly, and the FTC explains in its guide to identity theft how widely personal information travels once it is out.

You cannot work out where a detail came from in the middle of a conversation, and trying is a detour. Go back to the official channel instead and see whether the situation described actually exists there.

The same goes for a photo, a name, and a familiar way of writing. If a new number asks for money, call the old number, or speak to someone else close by, before sending anything.

3. Read the whole web address before you enter anything

A site can copy colors, photos, and wording exactly. So read the address in the browser bar rather than the look of the page. Swapped letters, extra words, and unexpected endings are all reasons to check somewhere other than that link.

Read an address from the right side inward, starting at the last part before the first single slash. That piece is the actual site. A long address with a familiar company name buried in the middle is not the same as that company.

HTTPS protects the connection, not your interests. It says the traffic is encrypted, not that the store or the person behind it is honest, and a fake site can have it just as easily as a real one. Browsers have moved away from showing a padlock for exactly that reason: too many people read it as a seal of approval. Our guide to how to spot a fake website goes through separating the domain from the rest of a URL, and how to check if a link is safe covers what to do before you open one.

Shortened links and buttons hide their destination until you open them. When a message is about a bank, a delivery, a benefit, or a bill, abandoning the link and opening the service yourself is simply faster than trying to decode it.

4. Check who is receiving the money before you approve it

Every payment screen shows you something about the destination: a name, a business name, an account and routing number, a handle. Read it before you confirm. If it does not match the person or the company in the story you were told, do not send the payment.

Match the payment method to the risk as well. A credit card payment sits behind a dispute process, and the FTC compares that with debit in its guidance on card protections. A wire, a payment app transfer to a person, a gift card, or cryptocurrency does not have that layer, which is why those are the methods scammers ask for. The CFPB makes the same point in its material on money transfers.

Even when the name looks right, the request still needs confirming. An account can belong to someone recruited into the scheme, and a story can borrow a real person you know. Reach whoever asked for the money on a number you already had, or contact the company through its own channel.

For a check or an invoice, compare the payee with who should actually be paid. Do not accept an explanation that the money has to go to a partner company or a finance department account without confirming that relationship with the company directly. Changed payment instructions inside an existing email thread are a known pattern, covered in wire transfer scams.

5. Be careful with a small charge you did not expect

A delivery fee, a release fee, a registration fee, a small unpaid toll. The amount is low on purpose. A few dollars makes checking feel like overkill, and the page collecting it usually asks for the full card number, or leads to a much larger payment later.

If you did not expect that charge, look it up in the app or on the site of the store, the agency, or the carrier, typed in by you. The FCC covers the delivery version in its guidance on package delivery scams.

The fake delivery fee is one of the most repeated stories there is, alongside the fake bank alert and the relative with a new number. All three are in the most common online scams, and the delivery version has its own guide in package delivery scams.

6. If someone asks for a code, a password, or an install, end the contact

Do not read out a password, a one-time code, a recovery key, or a security answer during a call or a chat that someone else started. Do not install an app, an extension, or a program because a caller says it is needed to fix something.

Fake support asks for screen sharing or remote access in order to help. Once that software is running, the other person can operate the device and see whatever is on it. Open the service through a channel you found yourself and check whether any real request exists.

A one-time code is worth as much as a password, because it is what completes a login or an account change. If a code arrives when you were not trying to sign in, someone may be attempting to get into the account, which does not mean they succeeded. Do not pass it on, and go review that account’s security settings. Our guide to two-factor authentication covers which methods hold up best.

If the code was for your phone number rather than an account, a different problem may be starting. Sudden loss of service can be a sign of a port-out, covered in SIM swap scams.

7. Protect the account before anyone contacts you

Some protections work before any message arrives, and most of them are one-time settings.

• Two-step sign-in on email, banking, social accounts, and messaging apps. With it, a stolen password alone is not enough to get in. CISA has a short guide to turning on multi-factor authentication, and an app or a security key is stronger than a code by text.
• A different password for every service. When one password opens several accounts, one breach opens all of them. CISA covers this in using strong passwords, and a password manager makes it practical.
• Transaction alerts turned on in your banking and card apps, so an unfamiliar payment reaches you the same day instead of at the end of the month.
• Limits set to match your real spending, where your bank or payment app allows it. Many let you cap transfers or require an extra confirmation above an amount you choose. Check what your own app offers rather than assuming.
• A credit freeze at each of the three nationwide credit bureaus, which blocks most new accounts from being opened in your name until you lift it. It is free, and the FTC explains it in credit freezes and fraud alerts. Step by step: how to freeze your credit.

Why no checklist catches everything

Not every scam uses urgency, bad grammar, a link, or an impossible price. There is no number of warning signs that proves a message is fake. Some legitimate contacts feel strange, and a well-built fraud can feel completely ordinary.

So treat each signal as a reason to go find an independent confirmation, not as a verdict. A price far below normal, a request for secrecy, a payment to a third party, difficulty finding the company anywhere outside its own ad: each raises the value of checking, and each has to be read alongside the rest of the situation.

Knowing the most common online scams helps you recognize a shape faster. The protection still comes from stepping outside the story you were handed and looking for information somewhere else.

If you already clicked, shared details, or paid

What to do depends on what happened. Close the page and end the contact. Save the message, the number, the site address, and any receipts. Do not delete everything before you have recorded what your bank, the platform, or the police will ask for. The FTC organizes the next steps by payment method in what to do if you were scammed.

1. In the first hour, call your bank or card issuer if money or card details were involved. Use the number on your card, say plainly that this was fraud, ask whether the payment can still be stopped, and ask for a new card number. The CFPB explains why reporting speed matters for an unauthorized transaction on a bank account.
2. If you gave out a password, change it from a device you trust, and change it anywhere you reused it.
3. If you installed something or allowed access to the device, disconnect it from the internet and get it checked before signing into accounts from it again.
4. If you lost access to an account, use only the service’s own recovery process, and warn the contacts who might receive requests in your name.
5. If you shared identifying details, such as a Social Security number, start the recovery plan at identitytheft.gov, which builds a checklist for your situation.

Then file the reports: reportfraud.ftc.gov for the FTC and ic3.gov for the FBI Internet Crime Complaint Center. File a police report as well, since banks and insurers often ask for one. None of this guarantees the money comes back. For instant transfers, payment apps, and wires specifically, see what to do after an instant payment scam.

If anyone threatens you or you are in immediate danger, call 911. If the problem is with a company rather than a criminal, your state consumer protection office and your state attorney general take complaints, and the CFPB takes complaints about banks and lenders at consumerfinance.gov/complaint.

Avoiding scams FAQ

Sources we checked

The guidance in this article comes from these pages:

• Federal Trade Commission: how to recognize and avoid phishing scams
• Federal Trade Commission: what to do if you were scammed
• Federal Trade Commission: lost or stolen credit, ATM, and debit cards
• Federal Trade Commission: credit freezes and fraud alerts
• Federal Trade Commission: what to know about identity theft
• Cybersecurity and Infrastructure Security Agency: recognize and report phishing
• Cybersecurity and Infrastructure Security Agency: turn on multi-factor authentication
• Cybersecurity and Infrastructure Security Agency: use strong passwords
• Federal Communications Commission: avoid the temptation of smishing scams
• Federal Communications Commission: package delivery scams
• Consumer Financial Protection Bureau: unauthorized transactions on a bank account
• Consumer Financial Protection Bureau: money transfers