How to Stay Safe from Online Scams

Photo by Ketut Subiyanto from Pexels

Online scams can arrive by email, text, phone call, social media, a fake website, or an invoice that appears to come from a supplier. The safest response is the same: pause, verify the request through a separate trusted channel, and do not send money or credentials under pressure.

Scammers can copy real logos, names, and writing styles. A polished message can still be fraudulent, and a padlock or https:// only means the connection is encrypted; it does not prove that the site is genuine.

Warning signs to take seriously

Be cautious when a message or caller:

• Demands immediate payment, secrecy, or a quick decision.
• Asks you to sign in through a link, disclose a password or one-time code, or install remote-access software.
• Requests payment by gift card, cryptocurrency, wire transfer, or another method that is difficult to reverse.
• Changes a supplier’s bank details or payment instructions unexpectedly.
• Claims to be your bank, a government agency, a delivery company, a colleague, or a client but uses an unusual contact method.

These are reasons to verify, not a complete test for fraud. An email address or caller ID can be misleading, and real organizations may contact you about legitimate issues.

Verify before you click, pay, or reply

1. Stop the conversation. Do not click a link, open an unexpected attachment, reply, share a verification code, or use a phone number supplied in the suspicious message.
2. Find the organization independently. Type its known web address yourself, use a saved bookmark, or call the number on a card, statement, contract, or previous trusted correspondence. Ask whether the request is real.
3. Confirm payment changes out of band. For a new invoice or changed bank details, contact the supplier using a number you already have on file—not the number in the change request. For a small business, document this as a standard payment check; get a second person’s approval when available.
4. Report the message. Use the email, messaging, or social platform’s built-in reporting option. The CISA phishing guidance explains common warning signs and safe reporting.

Do not rely on hovering over a link as your only check: it can be hard to inspect accurately, especially on a phone. Going to the service directly is safer.

Make your accounts harder to take over

• Use a password manager or an online secure password generator to create a unique password for each account, especially email, banking, and business accounts. A reused password can put several accounts at risk if one service is compromised. See CISA’s password guidance.
• Turn on multi-factor authentication (MFA) wherever it is available, starting with your email and financial accounts. Never approve a sign-in prompt or share a code you did not request. CISA explains how MFA helps.
• Keep your browser, operating system, and apps up to date. Use the official app store or the vendor’s site when installing software; do not install tools at the request of an unsolicited caller.
• Protect the email account used for password resets. Review its recovery methods and sign-in alerts so you can spot changes you did not make.

These steps reduce risk but cannot guarantee that you will never encounter a scam. Keep a separate, verified way to contact your bank, key clients, and suppliers.

If you think you have been scammed

Act quickly, even if you are not sure what happened:

1. If money was sent, contact your bank or payment provider immediately. Use the number on your card or official statement. Ask whether the payment can be stopped, recalled, or disputed. If you paid with a gift card, contact the card issuer and keep the card and receipt.
2. If you shared a password, change it from the service’s genuine website or app. Change it anywhere else you reused it, sign out other sessions if the service offers that option, and enable MFA. Contact the provider if you can no longer access the account.
3. If you shared identity or financial information, contact the affected institution. In the United States, IdentityTheft.gov provides a recovery plan for identity theft. Follow your bank’s guidance for affected cards or accounts.
4. Save evidence. Keep messages, email headers when available, website addresses, receipts, payment details, and dates. Do not delete records before your bank or a reporting service has had a chance to review them.
5. Report the incident. In the United States, report fraud to the Federal Trade Commission. You can also submit cyber-enabled crime to the FBI’s Internet Crime Complaint Center (IC3). If you are elsewhere, use your country’s official consumer-protection or cybercrime reporting service.

If you downloaded a file or installed software, stop using it and get help from a trusted technical support provider. Do not call a support number shown in a pop-up or supplied by the suspicious caller.

The same habits apply to personal accounts and small-business work: verify unusual requests independently, protect the accounts that control your money and email, and report problems promptly. You can also read our guides to keeping your personal details safe online and staying safer when using messaging apps such as Skype.