Skip to main content

Choose your country

Scam Indicators

Scams can be identified and analyzed through a range of warning signs known as indicators. They reveal how scams work, how criminals manipulate and impersonate others, and how they identify and approach potential victims.

Last updated:

Indicators By Category

Scam Mechanics

These indicators describe the mechanics of the defrauding part of the scam. They are not all necessarily crimes on their own, but rather these schemes are the mechanisms by which the deception becomes a scam. How does the scam work?

Rules of thumb: (1) These techniques are typically invisible to the victim, since the victim will only be shown the ruse (lie) part of the scam. (2) Schemes or techniques can be used by multiple different types of scams. In other words, an overpayment scheme can be used as part of an employment scam, an online marketplace scam, a prize/sweepstakes scam, etc.

  • Advance Fee Scheme: In an advance fee scheme, the scammer asks for a small upfront fee in advance of providing a larger payout later. In reality, the larger payout never arrives.

  • Bait-and-switch: A bait-and-switch is a scheme that makes a promise of one item but delivers a different, lesser-valued item.

  • Data Loss Or Theft: Any scheme that results in victim losing data/scammer stealing data. Data in this context can mean login credentials, credit card details, or other personal or corporate information.

  • Extortion: Extortion refers to any scheme that uses a threat of additional damage to extract payment from the victim.

  • Fraudulent Platform: Any scheme that relies on custom built software that assists the crime. Includes fraudulent trading platforms, fraudulent clickworking platforms, fake shops, and the like.

  • Holding Fee: A scheme in which the victim is asked to pay a holding fee to reserve a product or to hold their spot. The fee is often unwarranted, never reimbursed, or does not lead to any advantage for the victim.

  • Insider Threat: Any scheme that requires insider access or information in order to work.

  • Leveling: Any scam or fraud that requires the victim to pay cryptocurrency into a system and then "level up" to higher paying rewards by paying more money into the system.

  • Money Laundering: Any scheme in which the victim is asked to move money from one account to another for the scammer as part of the scam. Can include physical money moving or 'muling'.

  • Only Pay Shipping: A scheme in which the victim is asked to pay shipping for otherwise "free" products. The products are either not worth the inflated shipping cost, or they never arrive and the whole scheme was to get the victim to pay shipping costs for a non-existent product.

  • Overpayment Scheme: In an overpayment scheme, victims are falsely told they have been given a large amount of money as part of the scam and are asked to refund a smaller amount back to the scammer.

  • Parcel Muling: Any scheme in which the victim is asked to physically move parcels, products or goods for the scammer as part of the scam.

  • Ponzi Scheme: A ponzi scheme is a type of investment fraud in which the scammer (or "Ponzi") pays "dividends" to initial investors using the funds of subsequent investors.

  • Pump-and-dump Scheme: A pump and dump scheme is a type of investment fraud in which promoters falsely hype up a new or obscure stock so that new investors will rush to buy it, thus inflating the price (the 'pump'), at which point the scammer sells their portion of the stock at these high prices (the 'dump'), leaving the other investors with a worthless stock.

  • Pyramid Scheme: A pyramid scheme describes a scam or fraud in which participants only make money by recruiting new participants into the program.

Psychological Manipulations

By definition, scams rely on deception. What social engineering tricks can the scammer use to ensure that the victim is deceived?

  • Accident: The scammer contacts the victim under the guise of an accident (such as a wrong number), so as to lower suspicion.

  • Authority: The scammer employs an abuse of a position of authority to convince the victim to go along with the scam.

  • Boost Of Trust: The scammer employs an initial boost of trust technique to increase trust with the victim.

  • Celebrity: The scammer claims a celebrity endorsement in order to increase trust or interest from the victim.

  • Codes Or Jargon: The scammer uses official-looking codes or technical jargon as part of the scam to increase appearance of legitimacy or to confuse the victim.

  • Complexity: The scammer has a complicated story to explain the scam, or leverages scientific/economic complexity in order to confuse the victim.

  • Easy Money: The scammer promises easy money or makes appeals designed to leverage victim's greed or ambition.

  • Family: The scammer uses the victim's family members in the scheme, or implies the victim's family members are involved.

  • Flattery: The scammer uses flattery to stoke the victim's ambition or self-esteem, in order to increase the likelihood that the victim will go along with the scam.

  • Gradual Commitment: The scammer asks the victim to make a small commitment at first, but these escalate over time.

  • Guilt/Pity/Sympathy: The scammer tries to make victim feel guilt or pity toward scammer or others in order to escalate the scam.

  • Nice Guy: The scammer takes advantage of the victim's generosity, diligence, or attempt to be "a nice guy".

  • Not A Scam: The scammer goes to great lengths to convince the victim the scheme is not a scam.

  • Peer Involvement / Social Proof: The scammer uses the victim's peers to encourage the victim to engage in the scam, claiming that "others are doing it".

  • Reciprocity: The scammer does a favor for the victim in order to make the victim feel like they owe the scammer a favor in return.

  • Romance: The scammer promises love or friendship to victim.

  • Scarcity: The scammer claims there is only a limited number of opportunities for reaping the benefits from the scam.

  • Secret Or Hidden Knowledge: The scammer appeals to the victim's curiosity by promising special knowledge, or the scammer implies that the scheme is based on hidden knowledge or tricks that only the scammer knows.

  • Shame: The scammer tries to make the victim feel some shame or embarrassment in order to get them to go along with the scam.

  • Sunk Cost Fallacy: The scammer concocts a scenario where the victim will lose everything they've earned so far if they don't keep going with the scam.

  • Threats: The scammer employs threats to increase fear in the victim so that they will go along with the scam. Threats can include financial loss, legal action, arrest, account closure, extortion, blackmail.

  • Timing: The scammer arranges the timing of the scam to coincide with events or a particular season in the victim's context or locale, in order to build legitimacy or to lend credence to the ruse.

  • Trust Building & Legitimacy: The scammer works to build legitimacy or trust over time.

  • Urgency: The scammer employs urgency to increase the likelihood that the victim will take action.

Impersonation Techniques

Another group of social engineering techniques is impersonation, or making the victim think they are talking to someone they are not.

Targeting Contexts

Some scams are sent directly to the victim, and some are sent through passive advertising. In our scam kill chain, this is referred to as the "Reconnaissance" phase. What are the different targeting techniques that scammers use?

  • Advertising: The scammer uses advertising to passively reach the victim.

  • Targeted Individual: The scammer approaches the individual victim through online conversation or other targeted method.

  • Spray And Pray / Scattered: The scammer approaches many victims at once such as through bulk email or SMS.

  • Semi-targeted Regionally: The scammer approaches people in a certain region, for example by area code (toll scam) using semi-targeted email or SMS.

  • Semi-targeted Collection: The bait (initial reachout) is sent out to people in a collection harvested online, for example from some data breach or corporate directory.