The Most Common Online Scams: Five Situations and What to Do

The online scams people run into most are the fake bank alert, the fake family emergency from a new number, the fake delivery fee, the unsolicited tech support call, and the prize or deal that needs a payment first. The stories change constantly. The requests underneath barely change at all: send money, share a code or password, install something, or open a link.

By Prudents·12 min read

September 22, 2026, 11:31 AM·Updated September 24, 2026, 5:23 PM

Five identical envelopes in a row, one of them orange

In most scams, the story exists to move you toward one action: pay, hand over something secret, install a program, or open a page the scammer controls. Recognizing the request is more useful than memorizing dozens of names for the same thing.

The FBI Internet Crime Complaint Center collects these reports every year. In its 2025 Internet Crime Report, phishing and spoofing, meaning fake messages and fake caller identities, was the most frequently reported crime type, with 191,561 complaints. The five situations below are frequent examples, not a ranking and not a complete list.

Hands arranging objects that stand for five common digital fraud situations — Illustrative scene: different scams tend to repeat the same requests for money, a code, a password, an install, or a click.

How to read these five situations

Read each one for the request, not for the plot. The Federal Trade Commission describes the same core pattern across very different scams: someone contacts you out of nowhere, says there is a problem or a prize, creates pressure to act immediately, and names a specific way to pay or a specific thing to hand over. Its guidance on avoiding impostor scams covers the shape in detail.

The other half of the habit is where you check. Any claim that arrives in a message can be checked somewhere the message does not control: the app you already installed, the number printed on your card, the account you can log into yourself.

The quoted lines in this article are invented. They show the kind of wording that gets used, without copying a real company message, a real brand, a real screen, or a real phone number.

Here is the same idea in one pass, with what each situation asks for and where the answer actually lives.

Fake bank: asks for a link, a code, a password, or an app install. Check inside your banking app, or call the number on the back of your card.
Family member with a new number: asks for an urgent transfer. Check by calling the number you already had saved, or another relative.
Pending delivery: asks for a small fee or updated details. Check in the retailer or carrier account where the order actually lives.
Unsolicited support: asks for remote access, an install, or a code. Check through a support channel you opened yourself.
Prize or deal: asks for a payment up front or personal details. Check on the company site you typed in yourself, away from the ad.

1. The fake bank: an urgent problem with your account

The message or call reports a suspicious charge, a locked account, a required update, or a security failure. The sender name can look right, and the person may already know a few of your details. Neither of those things tells you the contact came from your bank.

The signal is in the route you are offered out of the problem. The contact tries to keep you inside the conversation: open this link, install this app, read me the code we just sent, confirm your password. An invented example: “We detected a pending charge. Sign in now to cancel it.”

A real bank contacting you about fraud does not need your password or your one-time code, and it does not need you to move money anywhere. The FTC is direct about the version where someone claims your account is at risk and tells you to transfer your balance to a new one: that instruction is the scam, and its guidance on government and bank impersonation says no legitimate agency or institution works that way.

What to do without using the contact you received

End the conversation. Open the app you already use, or type the address you know, or call the number printed on your card. Do not call the number in the message and do not use the button it sent. A password and a verification code stay with you.

If the doubt started with a text message, our guide to fake bank text messages covers what to check and what to do if you already opened the link. For the settings that catch this early, see safe online banking.

2. The fake family emergency: a new number and a request for money

Someone gets in touch using a familiar name, says they changed numbers or are calling from someone else’s phone, and starts a conversation that sounds like family. Then comes the request for money, usually with a reason you cannot call the old number back.

The closeness is the tool. The point is to get the money sent before you speak to the real person. An invented example: “My phone broke and this is my temporary number. Can you cover a payment for me today?”

The FTC covers this under fake emergencies: a relative in an accident, in jail, stranded abroad, in trouble and embarrassed. The version aimed at grandparents is common enough to have its own name, and we cover it in grandparent scams.

How to confirm who you are talking to

Call the number you already had saved. If nobody answers, try another route you know: a landline, a workplace, another family member. Do not rely on details supplied inside the new conversation, because every one of them is part of the story being told.

A recorded voice does not settle it either. The FTC has warned that scammers use AI to make family emergency schemes more convincing, including cloned voices built from short clips. The defense does not change: call back on the number you already had. To set this up with your family before it happens, see how to protect your parents from scams.

3. The fake delivery fee: a small charge to release a package

The message says a package is held, an address needs correcting, or a small fee is outstanding. It lands hardest when you actually are waiting on something, but the coincidence proves nothing about who sent it.

The action requested is deliberately small and quick: open an address, confirm your card details, pay a couple of dollars. An invented example: “Your delivery is on hold. Update your address and pay the release fee today.” The low amount is what makes checking feel unnecessary, and the page collecting it usually wants the full card number.

The Postal Inspection Service has its own warning about package tracking text scams, and the FCC covers the same pattern in its guidance on package delivery scams. Carriers do not ask for card details by text to release a parcel.

Where to look up a real delivery

Open the app or account where you actually placed the order, or type the carrier address yourself, and look up the tracking number from there. Do not use the link, the code, or the phone number that arrived with the unexpected charge. Our full guide is package delivery scams.

If the page imitates a store or a carrier, how to spot a fake website covers reading the address and the other signals worth checking.

4. Fake tech support: help that arrives without being asked

Someone calls, emails, or throws a full-screen warning onto your browser saying they found a virus, a breach, or a charge on your account. It is styled as customer service, but the goal is access: to your device, to your accounts, or to the codes that protect your login.

The FTC describes the mechanics in tech support scams: the pop-up with a phone number, the request to install remote access software, the sudden discovery that you are owed a refund. Once remote access software is running, the other person can see the screen and act on it.

Why an install and a code both deserve a stop

Remote access software lets someone else operate your device. A verification code confirms a login or an account change, which is why it is worth as much as a password. If the support contact arrived without you asking for it, install nothing and read out nothing. End it, and open a support request yourself through the company app or the address you typed in.

The refund version is worth knowing on its own, because it ends with the caller saying they refunded too much and asking you to send the difference back. That is covered in refund scams.

5. The prize or the deal that needs a payment first

An ad or a message offers a product far below the normal price, a benefit, or a prize you did not enter for. To release it, you are asked for a payment, a registration, a password, or card details. There is usually a countdown, which exists to keep you from looking the company up somewhere else.

A claim should not be checked in the place that made it. An invented example: “You have won a prize. Just cover the shipping fee to receive it.” A profile can have comments, photos, and a professional look and still have been assembled last week to support this exact story.

The FTC puts the rule plainly for prizes: a real prize is free, and being asked to pay a fee or a tax to collect it means it is not one. Its guidance on payment methods scammers prefer and our own guide to lottery and prize scams both come back to the same detail: the fee is the whole point.

How to check an offer away from the ad

Search for the company yourself, open its site by typing the address, and see whether the promotion exists there. Before you finish a payment, look at who is actually receiving it. If the payee does not match the company or the purchase, stop until you understand why.

Before you pay, run the checks in how to check if a company is legitimate and online shopping scams.

What has changed recently

The five situations above keep running. What has changed is the polish on a few of them, and the payment methods being pushed. The request underneath is still money, details, or access.

Cloned voices

Short audio clips are enough to imitate how someone sounds, which is why a voice on the phone is no longer proof of who is calling. The FTC issued a consumer alert about AI in family emergency schemes for this reason. Treat a voice the way you would treat a name on a screen: a claim, not a confirmation.

Job offers and paid tasks

A recruiter reaches out with a role that pays well and asks for almost nothing, then requires a fee for equipment, training, or a background check, or asks for bank details early. A related version pays small amounts for simple online tasks, then requires a deposit to unlock a bigger payout. The FTC covers both in its guidance on job scams, and we go through the checks in job scams.

Being asked to move money for someone else

Some of these offers end with money arriving in your account and instructions to forward it on. The Department of Justice explains in its money mule initiative that moving criminal proceeds can carry consequences even for people who did not know what they were moving. If a job involves receiving and forwarding funds, stop there. See money mule scams.

If you already did what they asked

What to do depends on what was exposed, and the first step belongs to whichever account is most at risk. The FTC keeps a short version of this at what to do if you were scammed, organized by how you paid. Do not delete the conversation before you have saved the messages, the page address, the receipts, and the details used to reach you.

In the first hour, call your bank or card issuer if money or card details were involved. Use the number on your card or in your app, not one from the message. Say clearly that this was fraud, ask whether the payment can still be stopped, and ask for a new card number if the details were shared. Timing matters most here.
Change the password for any account you signed into, on the real site and from a device you trust, and change it anywhere you reused it.
Turn on two-step sign-in for that account, and check its list of active sessions and connected devices. Our guide to two-factor authentication covers which method to pick.
If you installed something or allowed remote access, disconnect the device from the internet, remove the software, and avoid signing into accounts from it until it has been checked. See how to know if your phone is hacked.
Report it. File at reportfraud.ftc.gov and, if you lost money, at the FBI Internet Crime Complaint Center at ic3.gov. If personal identifying details were shared, start the recovery plan at identitytheft.gov.

If the payment went out through an instant transfer, a payment app, or a wire, read what to do after an instant payment scam, which covers what banks can and cannot do. For the order of the reports and what each one is for, see how to report a scam.

A contact can look completely real

These are built to make sense in the moment. A familiar photo, a correct name, knowing your address or a recent purchase, or arriving on a day you were expecting a package: none of that shifts responsibility onto the person who believed it. The blame sits with the person who built the scam.

Common online scams FAQ

What are the most common online scams?

Fake bank alerts, fake family emergencies, fake delivery fees, unsolicited tech support, and prize or deal offers that require a payment first are among the situations reported most often. They are not a ranking, and they do not cover everything that exists. What they share is the request underneath: money, personal details, or access to an account or device.

Does an urgent message always mean a scam?

No. Urgency is a reason to slow down and check somewhere else, not proof on its own. Real problems can be urgent too. The difference is that a real one is still there when you open the app yourself or call the number on your card, and nobody legitimate will object to you taking a few minutes.

How can I tell if a link is fake before opening it?

Do not rely on how the address looks, because a close imitation is easy to build. Instead of opening the link you received, type the official address yourself or open the app you already installed. That way the check does not happen on a page the sender chose.

Someone knew my name and my address. Does that mean they are legitimate?

No. Personal details circulate through data breaches, public records, and marketing lists, so knowing them is easy and proves nothing about who is contacting you. Treat correct details as part of the story being told, and go back to a channel you found yourself before acting on anything.

What should I do if I already clicked or shared my details?

Close the page and install nothing. If you shared a password, a code, or payment details, contact the company through an official channel and change the password from a device you trust. Call your bank or card issuer right away if money or card numbers were involved, and keep the message and the page address for your report.

Can a bank get back money sent in a scam?

Sometimes, and it depends on how you paid. A credit card charge has a dispute process behind it. A payment you sent yourself through an instant transfer, a wire, a gift card, or cryptocurrency is much harder to reverse, and often cannot be. Report it to your bank immediately either way, because whatever chance exists depends on speed.