Financial Fraud and Online Scams

Some attackers do not bother with malware at all. They simply ask for money, in a way that sounds so reasonable that you send it yourself. In this lesson you will explore three of the most widespread scams, fake invoices, fake technical support and romance scams, and learn the simple patterns that give them away.

In the last two lessons we studied phishing and malware. Fraud often combines both: a phishing message opens the conversation and then a human attacker takes over by phone, chat or email to finish the job. These attacks are less about technology than about persuasion, and that is why they can fool intelligent, careful people.

The common structure of a scam

Whatever the story, nearly every scam follows the same recipe. Once you can see the recipe, the stories become much less convincing.

1. A hook: an unexpected message, a call, an ad, a match on a dating app.
2. A plausible story: a problem to solve or an opportunity to grab.
3. Pressure: a deadline, a secret, or a threat.
4. A request for an unusual payment: a bank transfer to a new account, gift cards, a cryptocurrency transfer, or a payment through a link.
5. Isolation: "do not tell your bank", "do not talk to anyone about this".

The last point is particularly important. Scammers know that a second opinion kills their story, so they try to prevent it. If anyone asks you to keep a payment secret, that fact alone is enough reason to stop.

Scam 1: fake invoices and changes of bank details

An email arrives with an invoice attached, or a supplier announces that their bank account has changed and that future payments should go to a new one. The message looks real: it uses the right logo, refers to a real project and sometimes continues an actual email conversation that the attacker has managed to read after compromising a mailbox.

This type of fraud costs individuals and organizations a great deal because the payment is made willingly and quickly, and bank transfers are difficult to reverse. Typical clues include:

• An invoice for something you do not remember ordering.
• A sudden change of bank details, with a request to hurry.
• A sender address that is nearly right, such as one extra letter in the domain name.
• Pressure to avoid the usual approval process.

Defense: always confirm a change of bank details by phoning a number you already had on file, never the one in the message. Within a company, require a second person to approve any new account.

Scam 2: fake technical support

You are browsing and a full-screen alert appears, with sirens and a phone number: "Your computer is infected! Call support immediately." Or someone phones you pretending to be from your internet provider or a well-known software company. They offer to "fix" the problem remotely.

The goal is to get you to install a remote-control tool, hand over your passwords or pay for useless software. Once they can see your screen, they can open your online banking while you watch and claim they are "checking something".

Scam 3: romance and investment scams

Romance scams are built on patience. A person you meet online is warm, attentive and always available. After weeks or months of daily conversations, a problem appears: a medical bill, a blocked bank account, a plane ticket to come and meet you. The relationship is fictional, and the emotions that make victims send money are very real.

A close cousin is the investment scam, where a friendly contact introduces a "can't lose" opportunity, often involving cryptocurrency, shown on a convincing platform that displays fake profits to encourage larger deposits. The money only disappears when you try to withdraw it.

Warning signs include:

• They quickly move the conversation to a private messaging app.
• They always have a reason why they cannot appear on a video call.
• They declare strong feelings very early.
• Any request for money, even small, even "temporary".
• Promised returns that are far higher than anything reasonable and guaranteed.

If it is too good to be true, in love or in finance, then it almost certainly is. Be kind to yourself: these scams are professional operations, sometimes run by organized groups, and victims come from every background.

Other frauds you may meet

• Fake delivery fees and fake fines, usually via text message.
• "Your relative is in trouble" messages, such as "Mum, I lost my phone, this is my new number, can you send me money?".
• Fake classified-ad buyers who ask to pay through a link that actually collects your card details.
• Fake job offers that ask for personal documents or an advance payment.
• Voice or video imitation: recent tools can reproduce a voice from a short recording. A call from a "relative" asking for urgent money should always be verified, for example with a question only they could answer or by calling them back on their usual number.

A family safeword

A simple, effective defense is a family code word: an agreed word or question that a real family member can answer but a scammer cannot. Use it whenever someone asks for money or sensitive information in an emergency, even if the voice sounds right.

Your turn

Exercise. You receive this text message: "Mum, my phone broke so this is my new number. I need to pay a bill today and my banking app is blocked. Can you transfer a small amount for me? I will explain later." Write down (1) which elements of the scam structure you recognize and (2) what you would do.

See a solution

1. Hook: an unknown number claiming to be a family member. Story: broken phone and blocked banking app. Pressure: "today". Unusual payment: a transfer to an account you do not know. Isolation: "I will explain later", which discourages questions.
2. Do not reply to the new number with any information. Call your child on their usual number, or contact another relative. Ask a question only the real person can answer, such as the family code word. Never send money until you have confirmed the identity through a channel you already trust. You can report the message to the authorities and to the platform.

Add to your Security Notebook

Under "1. Threats", add a rule on money: "I never pay or change bank details because of a message, a call or a link. I always confirm by calling a number I already know." If you live with family, add your code word, but keep it in a safe place and not in a message.

In the next lesson we will step into the shoes of the attacker to understand who they are, what they want and which doors they try first.