What Is an Online Scam and How Can You Identify One?

An online scam is an illegal attempt to make someone send money, reveal sensitive information, install software or take another action that benefits a fraudster. It may arrive through a call, SMS, WhatsApp message, email, social-media account, website, app, QR code or online advertisement.

To identify an online scam, look beyond how professional the message appears. Pause when a request is unexpected, urgent, secretive or difficult to verify. Check the sender and claim through an official source you find independently, and never approve a payment or share an OTP, password, PIN or other confidential detail simply because someone asks.

Scam warning signs: a quick check

A message, call or offer deserves extra scrutiny if it includes one or more of these signs:

1. You did not expect the contact or request.
2. You are pressured to act immediately or keep the conversation secret.
3. Someone asks for an OTP, password, PIN, CVV, recovery phrase or remote access to your device.
4. You must pay a fee, deposit, tax or “refundable” amount before receiving money, a prize, a job, a loan or an investment withdrawal.
5. The offer promises unusually high, guaranteed or risk-free returns.
6. The sender’s number, email, social-media handle, website or payment name does not match the organisation being claimed.
7. You are shown only screenshots, badges, testimonials or documents instead of information you can verify independently.
8. The person tries to move you away from an official app or support channel.
9. You are told to scan a QR code, enter a UPI PIN, install an app or share your screen for an unclear reason.
10. The explanation changes when you ask questions, or new payments are demanded before your money can be released.

One warning sign does not prove fraud by itself. But the more signs you notice, the more important it is to stop and verify before doing anything.

What is an online scam?

An online scam is not defined by one app, technology or type of victim. It is defined by deception. A fraudster creates a false identity, false situation or false promise and then uses it to influence what you do.

The immediate goal may be to obtain money. It may also be to collect information that can later be misused, take control of an account, persuade you to install harmful software, or build enough trust to demand money at a later stage.

How do online scams work?

Most online scams follow a similar pattern even when the story, channel or payment method changes.

They create urgency

“Your account will be blocked.” “Pay within ten minutes.” “This is your final warning.” A deadline can make you feel that checking will cost you the opportunity or make the situation worse.

They borrow authority

A scammer may claim to represent a bank, government department, police unit, courier company, employer, investment platform or familiar brand. Official-sounding language, uniforms, logos and documents can be copied.

They offer a reward

Unexpected prizes, refunds, commissions, loans, jobs, giveaways and investment returns can lower a person’s caution. The offer may begin with a small genuine-looking payment before larger deposits are requested.

They use fear or embarrassment

Threats involving arrest, account suspension, unpaid bills, leaked information or harm to a family member are designed to prevent calm thinking. The person may tell you not to contact anyone else.

They build trust gradually

Not every scam begins with a demand for money. Some start with friendly conversation, a small online task, a relationship, a support request or apparently useful advice. The request becomes risky only after trust has been built.

Falling for a well-designed scam is not a sign of low intelligence. The practical defence is to create a repeatable pause-and-verify habit that works even when the message feels urgent or personal.

How to identify an online scam: 10 common warning signs

1. The contact is unexpected

Treat an unsolicited message or call carefully, especially when it asks you to click, pay, download, share information or continue on another platform. Even if the sender mentions real personal details, do not assume the identity is genuine. Some information may be public, leaked or gathered from earlier conversations.

Ask: Did I initiate this interaction? Was I expecting this request? Can I confirm it through an account or contact method I already trust?

2. You are pushed to act before you can think

Urgency is one of the strongest scam signals. A legitimate issue may sometimes be time-sensitive, but a genuine organisation should still allow you to verify the request through its official website, app or published support number.

Pause if someone objects when you say you want to check. Resistance to independent verification is itself a warning sign.

3. You are told to keep the matter secret

Scammers may say that an investigation is confidential, a reward will be cancelled if disclosed, or a task cannot be discussed with friends, family, a bank or police. Secrecy isolates you from people who might notice inconsistencies.

Before making a high-pressure decision, speak to someone you trust. A second person does not need specialist knowledge to spot a request that does not make sense.

4. Someone asks for confidential credentials

Do not share passwords, OTPs, card PINs, CVVs, UPI PINs, recovery phrases, security codes or authentication approvals with another person. RBI guidance states that banks and payment-system operators do not ask customers for credentials such as passwords, PINs, OTPs or CVVs.

Also be cautious if someone asks you to share your screen, install a remote-access app or disable a security setting. These actions can expose information even when you do not read a credential aloud.

5. Money is required before you can receive money

A request for an advance charge is common across prize, refund, job, loan, parcel, investment and withdrawal scams. The payment may be described as a processing fee, security deposit, tax, verification amount or temporary transfer.

Do not rely on a promise that the amount will be refunded. Independently confirm the organisation, the reason for payment and the account receiving it.

6. The offer is unusually attractive or guaranteed

High returns with little or no risk, instant loans without meaningful checks, highly paid tasks requiring no experience, and prizes for competitions you did not enter should be questioned.

Ask what could make the offer legitimate, how the provider earns money, which regulator or authority applies, and whether those details can be checked outside the message. A screenshot or testimonial supplied by the same person is not independent proof.

7. The identity does not hold up across channels

Check whether the sender’s email domain, phone number, social-media handle, website and payment beneficiary are consistent with the claimed organisation. Fraudsters may use lookalike spellings, unofficial accounts or names that appear familiar at a glance.

Do not use only the contact details included in the suspicious message. Find the official website or app independently and start a new conversation through its published channel.

For a deeper URL-specific check, read DSN’s guide on how to identify a phishing link.

8. The “proof” cannot be independently confirmed

Screenshots of payments, account balances, returns, chats or approval letters can be edited or fabricated. A successful-payment screen shown by another person is not the same as money credited to your account.

Check the transaction inside your own bank or payment app. Verify a job on the employer’s official careers page, a loan through the lender’s official channel, and an investment provider against the relevant official or regulatory records.

9. You are asked to use an unusual process

Be careful when someone asks you to scan a QR code to receive money, enter a UPI PIN for a credit, transfer funds to multiple personal accounts, buy gift cards or crypto for an “official” payment, or install an unfamiliar app.

NPCI’s UPI Safety Shield says a UPI PIN is entered to deduct money, not to receive it, and a QR code should be scanned to make a payment, not to receive one. Read every payment screen before authorising it and check the beneficiary name and amount.

10. The story changes or payments keep increasing

In some scams, a small payment appears to work. Later, a larger amount is demanded to unlock earnings, fix an account, pay tax or complete a withdrawal. Each payment creates a new reason for another payment.

Stop when the conditions change. Do not send more money simply to recover an earlier amount. Contact your bank or payment provider and use official reporting channels instead.

Common types of online scams

The format may change, but the warning signs above appear across many scam types.

Impersonation scams

The scammer pretends to be a bank, company, government official, police officer, colleague, friend or family member. The request may involve money, credentials or an urgent favour. Brand-specific impersonation should always be checked through the brand’s official app or website. Readers can separately review the detailed guide here on fraudsters impersonation.

Phishing and suspicious-link scams

A message directs you to a lookalike site or harmful download. The goal may be to steal login details, payment information or control of a device.

UPI and fake-payment scams

The fraudster may send a collect request, misuse a QR code, show a fake receipt or claim that a refund requires a UPI PIN. Always rely on the transaction status in your own payment or bank app, not a screenshot sent by another person.

Job, task and loan scams

An attractive job, rating task or loan may be used to collect a registration fee, deposit, personal documents or repeated payments. Verify the employer or lender independently, and question any arrangement that requires you to pay in order to get paid.

Investment and trading scams

These schemes may promise guaranteed returns, show artificial profits or use groups filled with fake success stories. Difficulty withdrawing and demands for additional fees are major warning signs. Do not treat social proof as evidence of regulation, custody or genuine returns.

Threat and “digital arrest” scams

A caller may claim that your identity, SIM, parcel or account is connected to a crime and threaten immediate action unless you cooperate or transfer money. End the call, do not pay under pressure, and contact the relevant agency through an official number you find independently.

Relationship and social-engineering scams

Trust is built through friendship, romance, professional networking or a supposed emergency before money or sensitive information is requested. Be cautious when a person you have never met repeatedly avoids independent verification or creates financial crises.

AI-assisted and deepfake scams

Copied voices, altered video and synthetic images can imitate someone you know. If an urgent request arrives through voice or video, contact the person through another known channel and ask a question or use a family verification phrase that an impersonator would not know.

Examples of online scams you may encounter

These short examples of online scams show how the warning signs can appear in everyday situations.

• A fake account-verification message
• A task or job that requires repeated deposits
• A threatening “digital arrest” call
• A fake payment or refund request
• An investment group showing guaranteed profits

A fake account-verification message

You receive a message claiming that your bank, wallet or social-media account will be blocked unless you verify it immediately. The link opens a page that resembles the real service and asks for login details or an OTP. The safest response is to close the message and check the account through the official app or a website you access independently.

A task or job that requires repeated deposits

An online contact offers easy commissions for rating products, liking posts or completing simple tasks. A small amount may initially be credited to build trust, but larger deposits are later required to unlock earnings or withdrawals. A genuine job should not require escalating payments so that you can receive wages or commissions.

A threatening “digital arrest” call

A caller or video-call participant claims to be from a police, courier, customs or investigative agency and says that your identity or parcel is linked to a crime. You are told to stay on the call, keep the matter secret or transfer money for verification. End the interaction and contact the named authority through independently verified official details.

A fake payment or refund request

A buyer or support agent claims to have sent money and shares a screenshot, QR code or collect request. They may ask you to enter a UPI PIN to receive or reverse a payment. Check your own bank or payment app: never treat a screenshot supplied by the other person as confirmation that funds were credited.

An investment group showing guaranteed profits

A social-media or messaging group displays profit screenshots, testimonials and urgent trading opportunities. The platform may show artificial gains but block withdrawals unless another fee or tax is paid. Guaranteed returns, unverifiable operators and repeated release payments are strong reasons to stop and verify independently.

How to protect yourself from online scams

The most reliable protection from online scam is a repeatable routine that works across calls, messages, apps and websites. Use the following four-step scam check before you click, share information or pay.

Step 1: Stop

Do not click, reply, pay, download or share information immediately. If you are on a call, tell the caller you will verify and call back. You do not need their permission to pause.

Step 2: Inspect

Identify the exact claim and request. Who is contacting you? What do they want you to do? What happens if you refuse? Which details are independently visible, and which have been supplied only by the sender?

Step 3: Verify independently

Open the organisation’s official app or type its known website yourself. Use a published customer-care number, not the number in the message. Check the beneficiary inside your payment app. Search the National Cyber Crime Reporting Portal’s suspect repository when relevant. If the person claims to be someone you know, contact them through a number or account already saved by you.

Step 4: Decide

Proceed only when the identity, claim and requested action all make sense. If you cannot verify them, do not act. A missed offer is safer than an irreversible payment or compromised account.

Questions to ask before you trust an online request

• Was I expecting this message, call, payment request or offer?
• Is the person creating fear, excitement, urgency or secrecy?
• Am I being asked to share a credential or approve an action I do not understand?
• Does the sender’s identity match the organisation’s official details?
• Can I verify the claim without using the link or number they provided?
• Is a payment being requested before I can receive money or access a benefit?
• Am I relying only on a screenshot, badge, document or testimonial?
• What would I advise a friend to do if they received the same request?

If several answers make you uncomfortable, treat the interaction as suspected fraud until verified.

What to do if you may have interacted with a scam

• If you have not sent money or shared information
• If you shared a password or approved a login
• If you installed an app or shared your screen
• If money was transferred

If you have not sent money or shared information

Stop responding. Do not click further links or install anything. Save the message, number, URL or account details if you can do so safely. Block the sender after preserving evidence, and report the suspicious identifier through the appropriate platform or official channel.

If you shared a password or approved a login

Use a trusted device to change the affected password immediately. Sign out of other sessions, enable multi-factor authentication and check whether recovery details were changed. If the same password was used elsewhere, change those accounts too.

If you installed an app or shared your screen

Disconnect the device from the internet if suspicious activity is continuing. Remove remote access where you can do so safely, run the device’s security checks and contact the relevant bank or service from another trusted device. Do not follow cleanup instructions supplied by the suspected scammer.

If money was transferred

Contact your bank or payment provider immediately using its official support channel. For cyber financial fraud in India, call the national helpline 1930 as soon as possible and file a complaint at cybercrime.gov.in. Keep the transaction ID or UTR, date, amount, beneficiary details, messages, phone numbers, URLs and screenshots ready. Prompt reporting may help scam alert authorities and financial institutions act, but recovery cannot be guaranteed.

If there is immediate physical danger or another emergency, contact the appropriate emergency service or local police.

Everyday habits that reduce scam risk

• Use unique passwords and multi-factor authentication for important accounts.
• Keep apps, devices and operating systems updated.
• Access banks, payment services and investment platforms through saved official apps or bookmarks.
• Read the beneficiary name, amount and purpose before approving a payment.
• Never share OTPs, PINs, passwords, recovery phrases or authentication approvals.
• Review privacy settings and limit personal information that can be used for impersonation.
• Agree on a family verification phrase for urgent money requests.
• Discuss common scam patterns with parents, children and colleagues without blaming victims.
• Treat verification as a normal step, not as a sign of distrust.

The goal is not to become afraid of every message or digital service. It is to make a short check part of everyday online behaviour.

Frequently asked questions

What is a scam?

A scam is a deceptive scheme used to make a person send money, reveal information or take another action for the scammer’s benefit. An online scam uses digital channels such as calls, messages, email, social media, websites, apps or payment systems.

How can I tell if an online message is a scam?

Check whether the message is unexpected, urgent, secretive or asking for money, credentials, a download or remote access. Verify the sender and claim through an official source you locate independently. Do not use only the link or contact details supplied in the message.

Is a professional-looking website or profile proof that it is genuine?

No. Logos, websites, verified-looking badges, documents, testimonials and follower counts can be copied or manipulated. Confirm the domain, account and claim through the organisation’s official app, website or published support channel.

How do I identify a scammer?

One can identify a scammer by focusing on behaviour rather than trying to prove a person’s real identity. Warning signs include pressure, secrecy, inconsistent details, requests for credentials or advance payments, resistance to independent verification and repeated demands for more money.

Should I scan a QR code or enter a UPI PIN to receive money?

NPCI advises that a UPI PIN is used to deduct money, not to receive it, and that users scan a QR code to make a payment, not to receive money. Always read the payment screen and confirm the beneficiary and amount before approval.

What should I do if I send money to a scammer in India?

If you have sent money to a scammer in India, first contact your bank or payment provider immediately through its official channel. Call the national cybercrime helpline at 1930 and file the complaint at cybercrime.gov.in with the transaction and evidence details. Do not send another payment to someone promising recovery.

How can I recover money after an online scam?

There is no guaranteed recovery method. Act immediately: contact the bank or payment provider through its official channel, call 1930 for cyber financial fraud in India and submit the transaction details and evidence at cybercrime.gov.in. Secure any affected accounts and be wary of “recovery agents” asking for an advance fee.

What are the major crypto scams?

Common crypto-related scams include fake investment platforms, guaranteed-return schemes, impersonation, phishing, fraudulent token or giveaway promotions, wallet-recovery scams and requests for a seed phrase or private key. Verify the platform and sender independently, and never disclose wallet recovery credentials.

Can a scam call or message appear to come from a familiar person?

Yes. Names, profile photos, caller information, voices and video can be imitated or manipulated. Verify an urgent request through another contact method you already trust.

Are online scams always about immediate payment?

No. A scam may first seek personal information, account access, a software installation, trust or documents. That access can later be used for identity theft, account takeover, extortion or financial fraud.

Conclusion

The strongest scam defence is a repeatable habit: pause, inspect the request, verify it through an independent official source, and act only when the details make sense. Urgency, authority and professional design are not proof. When money or account access is involved, a few minutes of verification can prevent long-lasting harm.

If a cyber financial fraud has already occurred, contact your bank or payment provider, call 1930 and report it at cybercrime.gov.in without delay.