Overview
This is a very large category of scams in which the victim expects to be interacting with a legitimate service but instead ends up on a website, app, or phone number controlled by the scammer.
How It Works
The scammer creates a realistic facsimile of a legitimate resource (website, app, phone number, and so on) and convinces the user that they are interacting with this legitimate resource.
The types and variations of pretexts (ruses) used in phishing lures are numerous, and can include all types of fake communication designed to trick the victim.
Lures, or bait, may include phishing emails, spoofed login pages, typosquatting, scam punycode domains, customer service contact info data poisoning (fake customer service numbers posted in online locations where the victim can come across them), spoofed or hijacked influencer accounts, and the like.
The impersonated page or resource serves as a method of exfiltrating data or financial payments from the victim.
Cryptocurrency Address Poisoning scams also qualify as a spoofed interaction scam.
Related Articles
Big Tech, big cons: Scammers are hiding in the apps that make your life easy, RestOfWorld 2026-06-10
Citi sounds the alarm on 'address poisoning' scams flooding the Ethereum network, Coindesk 2026-01-22
Crypto user loses $50 million in 'address poisoning' scam, Coindesk 2025-12-20
Website Spoofing, State of Michigan
Google’s AI pointed him to a customer service number. It was a scam., Washington Post
Related Crime Schemes
A particular instance of this scam may embed one or more of these related schemes.
Data Loss or Theft: Any scheme that results in victim losing data/scammer stealing data. Data in this context can mean login credentials, credit card details, or other personal or corporate information.
Fraudulent Platform: Any scheme that relies on custom built software that assists the crime. Includes fraudulent trading platforms, fraudulent clickworking platforms, and the like.
Victim Targeting Context
The scammer may use one or more of the following techniques to reach the victim.
Spray and Pray / Scattered: The scammer approaches many victims at once such as through bulk email or SMS.
Semi-Targeted Regionally: The scammer approaches people in a certain region, for example by area code (toll scam) using semi-targeted email or SMS.
Semi-Targeted Collection: The bait (initial reachout) is sent out to people in a collection harvested online, for example from some data breach or corporate directory.
Advertising: The scammer uses advertising to passively reach the victim.
Social Engineering: Psychological Manipulations
The scammer may use one or more of these psychological techniques to accomplish the scam.
Authority: The scammer employs an abuse of a position of authority to convince the victim to go along with the scam.
Codes or Jargon: The scammer uses official-looking codes or technical jargon as part of the scam to increase appearance of legitimacy or to confuse the victim.
Not A Scam: The scammer goes to great lengths to convince the victim the scheme is not a scam.
Timing: The scammer times the scam to coincide with events or a particular season in the victim's context or locale, in order to build legitimacy.
Urgency: The scammer employs urgency to increase the likelihood that the victim will take action.
Social Engineering: Impersonation Techniques
The scammer may impersonate one or more of the following groups as part of the scam.
Banking / Finance: The scammer impersonates a banking official or financial institution.
Business or NonProfit: The scammer impersonates a business or nonprofit.
Government Official: The scammer impersonates a government official.
Political Candidate or Organization: The scammer impersonates a political candidate or organization.
Technical Support / Tech: The scammer impersonates a technical support worker or tech company.
Workplace Employer or Colleague: The scammer impersonates an employer or colleague.