Online scams: recognise the story behind the deceptive message

The narrative creates an opening

A message about a delayed package, a profitable investment or an overdue invoice is designed to fit a familiar situation. The attacker wants the recipient to react before independently checking the claim.

A single scam may combine a sponsored link, a copied website, a messaging account and a phone call. Looking only for spelling mistakes is no longer sufficient.

Some genuine details can support a fake identity

Information about an organisation or a family member can be publicly available or obtained from past compromises. Accurate details do not authenticate the sender.

Requests to disclose verification codes, move a conversation away from a marketplace or pay a newly supplied account should be checked using an independently established channel.

Practical checks

• Inspect the action the message demands
• Use an independently known contact method
• Avoid unsolicited attachments
• Report suspicious financial instructions promptly

Use more than one signal before drawing conclusions

A recently registered domain, an unfamiliar brand or an anonymous comment may raise questions but cannot alone establish fraud. Indicators must be interpreted alongside context.

Vigifraude emphasises documenting the request, checking its source and selecting an appropriate protective action rather than making unsupported accusations.

Related resources

Build a suitable control

Understanding the scam sequence helps improve the next decision even when an offender cannot be identified.

For a technical question, software project or training request, describe the need without sending credentials or unnecessary personal data.