Every scam is built on the same three moves
Whether it arrives as an email, an SMS, a WhatsApp message or a phone call, nearly every scam does three things:
- It pretends to be someone you trust: your bank, a courier, a tax office, a relative or a tech company.
- It creates urgency or fear: an account is "locked", a parcel will be "returned", a fine is "overdue", a family member is "in trouble".
- It asks you to act outside your normal routine: click a link, read out a code, install an app or send money.
If a message does all three, treat it as a scam until you have proved otherwise through a channel you already trust. That single habit stops most fraud.
Red flags in emails
- The sender's address does not match the organisation. Look at the actual address, not the display name. "PayPal Support" sending from a random Gmail account, or a domain with an extra word or a misspelling, is a giveaway.
- Generic greetings like "Dear customer" from a company that knows your name.
- Links whose real destination differs from the text. On a computer, hover over the link to see the address. On a phone, press and hold to preview it without opening.
- Unexpected attachments, especially invoices, delivery notes or "voicemail" files you were not expecting.
- Requests to log in "to verify" or "to avoid suspension". Legitimate services rarely ask you to confirm your password through an email link.
Spelling mistakes used to be the easy tell. AI writing tools have made many scam emails fluent, so do not rely on bad grammar to warn you.
Red flags in texts and WhatsApp messages
The most common scam texts follow a few scripts:
| Script | What it says | What it wants |
|---|---|---|
| Fake delivery | "Your parcel could not be delivered. Pay a small fee to reschedule." | Card details |
| Bank or wallet alert | "Your account is blocked. Verify here." | Login details and one-time codes |
| Prize or lottery | "You have won a reward. Claim within 24 hours." | A fee, or personal data |
| Fake fine or bill | "Unpaid toll, challan or tax. Pay now to avoid penalties." | Payment through a fake site |
| "Hi Mum" or a friend in trouble | "I lost my phone, this is my new number. Can you send money?" | A transfer |
| Job offer | "Earn from home by liking videos." | An upfront payment, or money-laundering help |
A real organisation will not mind you ignoring the link and checking through its official app or website instead.
Red flags in phone calls
- The caller asks for a one-time code, PIN or password. Hang up. This is never legitimate.
- They want you to install a "support" or "screen sharing" app, such as a remote-access tool, to fix a problem.
- They demand payment in gift cards, crypto or wire transfers.
- They tell you not to hang up or not to tell anyone. Pressure to stay on the line is designed to stop you thinking.
- The number looks right. Caller ID can be faked, so a familiar number proves nothing.
The safe response is the same every time: end the call and phone the organisation back on a number you find yourself, from its website or the back of your card.
How to check a link without opening it
- Preview it. Long-press on a phone, or hover on a computer, to see the full address.
- Read the domain from right to left. In
secure-login.yourbank.com.verify-account.net, the real domain isverify-account.net, not your bank. - When in doubt, do not use the link at all. Type the company's address yourself or open its official app.
What to do if you think you fell for it
Act quickly. The first hour matters most.
- If you entered a password, change it on the real site, and on any other account that uses the same password. Then sign out all other sessions.
- If you shared card or bank details, or a one-time code, call your bank on the number printed on your card and ask them to block the card or the transaction.
- If you sent money, contact your bank or wallet provider immediately. The sooner they know, the better the chance of stopping or recovering it.
- If you installed an app because someone told you to, uninstall it and follow our guide on what to do if your phone is hacked.
- Report it to your email provider, your mobile network or the relevant national reporting service, so others are protected.
Habits that prevent most scams
- Turn on two-step verification with an authenticator app or passkeys on your email and banking.
- Use a password manager. It will not offer to fill in your password on a fake site, which makes it a useful early warning.
- Agree a family code word for emergencies, so a "new number" message can be verified quickly.
- Keep your phone and apps updated.
Readers in Pakistan can also see our guide to staying safe with digital payments, which covers wallet and banking scams specific to the local market.