Common online scams: types, real-life examples, and how to avoid them

Informatec Digital » Resources » Common online scams: types, real-life examples, and how to avoid them

Today we live glued to our phones and computers, and while that has many advantages, it also means being exposed to increasingly frequent and sophisticated online scams . Fake emails, suspicious SMS messages, websites that mimic well-known stores, and supposed IT technicians trying to help you over the phone are all part of our daily digital lives.

To avoid falling into these traps, it's essential to understand how they work, what warning signs they give, and what security measures we can take to shop, browse, and interact online responsibly. Throughout this article, you'll see the most common types of fraud, real-life examples of how cybercriminals operate, and practical tips for recognizing them early.

Online scams that impersonate large companies and organizations

One of the most common scams involves using the names of well-known companies or government agencies, such as courier companies, airlines, mobile phone manufacturers, or the Tax Agency itself, to send you messages that appear official but are actually intended to steal your data.

It's common to receive an email supposedly from the postal service, a shipping company, or an online store, stating that you have a package awaiting delivery and that you need to pay a small amount (for example, 3 euros) or confirm your information via a link. Clicking on it opens a fake website where you're asked for personal information or downloads a virus onto your device.

In other cases, the message appears to come from the Tax Agency, claiming that after a review of your tax return, you are entitled to a refund and should request it through a link . This link takes you to a website that mimics the official one, where they enter your banking or tax credentials and steal them.

Emails impersonating online service providers (such as emails mimicking Yahoo or other email services) are also common, warning you that your account will be closed if you don't update your information within 24 or 48 hours . The trick is always the same: they force you to act urgently so you click on the link without thinking too much.

There are even fraudulent security and antivirus programs that masquerade as legitimate tools to protect your computer, but in reality, they generate fake alerts pressuring you to pay to "clean" the system or provide bank details . All they achieve is infecting your device or disabling services you don't need.

Social media is also fertile ground for impersonation . From friend requests from unknown profiles to companion apps, suspicious video calls, or links shared in groups, these can become entry points for malware or for stealing login credentials to your accounts.

In many cases, criminals even impersonate a real employee of a company, using their name and position in a convincing email to gain your trust and get you to click on a malicious link or open an infected file.

Another classic scam involves fake websites that perfectly mimic legitimate online stores, including logos, design, legal text, and even links that redirect to the real site. These sites display highly sought-after products at ridiculously low prices to trick you into entering your credit card information, which ultimately ends up in the hands of cybercriminals. Learn how to spot fake offers on online stores to avoid these scams.

In the past, fake alerts from official agencies were also very popular, such as the infamous "police virus" that locked the computer screen displaying a supposed fine for illegal content and demanding payment to unlock it. Although that specific case has lost its effectiveness, the idea persists in other types of ransomware.

Finally, there are also emails announcing that you're the lucky winner of a lottery you didn't even enter, or offering you a well-paid job abroad with hardly any requirements. The goal is usually to get you to provide your personal information or make upfront payments for supposed administrative fees.

On websites that offer downloads of games, movies, or software, misleading banners and fake discount coupons often appear, disguised as download buttons or irresistible deals, ultimately subscribing you to extremely expensive "premium" services using your phone number without your knowledge until the bill arrives.

Phishing, smishing and vishing: the kings of digital deception

Among the most widespread scams, three techniques stand out that are based on tricking you into voluntarily handing over information : phishing, smishing, and vishing.

Phishing involves sending mass emails that impersonate banks, e-commerce platforms, streaming services, or public institutions, using an alarmist or urgent tone to encourage you to click on a link that leads to a fake website where you are asked for passwords or bank details . Visually, they often appear very credible, but the web address and small design details give them away.

Smishing is the same idea, but it's done via SMS or messages on apps like WhatsApp. These short texts indicate, for example, that your account has been blocked, that there's a suspicious charge, or that you need to pay a small fee , and they often include a shortened link or a phone number. If you call or visit the website, you'll fall into the trap.

Vishing is carried out via telephone calls. The scammer impersonates an employee of a bank, telephone company, technical support service, or even a government agency and, with a very convincing pitch, tries to get you to provide confidential information or install remote access programs on your computer . They often justify the call with supposed security problems, unusual account activity, or technical issues.

To protect yourself against these scams, it's crucial to understand that your bank, government agency, or large company will never ask for your full passwords, signature codes, or sensitive information via email, SMS, or unsolicited phone call . If in doubt, hang up or close the message and contact the official channel directly. It's also important to follow best practices for creating strong passwords and protecting your login credentials.

Online shopping fraud through search engines

Many purchases begin on Google: we search for a product, compare prices, and choose a store from the results. The problem is that, among legitimate links, fraudulent ads and websites can slip in, ranking high to lure victims.

In these cases, criminals create professional-looking websites with names very similar to those of well-known stores to lure customers with prices far below market value, ridiculously low shipping costs, or supposed flash sales . Once you place an order, several things can happen: you may not receive anything, you may receive a counterfeit or extremely poor-quality product, or your payment information may be used for subsequent charges.

To reduce risks, it's important not to blindly trust everything that appears in the top search results and to pay close attention to whether it's a sponsored ad or an organic result . Not all ads are fraudulent, but attackers frequently use them.

Another key point is to carefully check the browser's address bar to confirm that the URL matches the official store's URL and hasn't undergone any subtle changes (extra or missing letters, unusual domains, or strange endings). It also helps to look for reviews from other users on social media and forums, as many times people have already reported the website.

If an offer seems too good to be true, it's worth pausing for a moment and considering whether it makes sense. Cybercriminals prey on people's sense of urgency, especially during campaigns like Black Friday, Cyber ​​Monday, Christmas, or sales periods, when scams disguised as exclusive promotions proliferate . Consult specific guides to protect yourself on Black Friday and avoid being swayed by the pressure.

Risks in e-commerce platforms

Online marketplaces like Mercado Libre, Amazon, Temu, AliExpress, and eBay have made remote shopping easier, but they've also become a breeding ground for fraud attempts. One of the most common scams involves phishing emails that impersonate these platforms , warning of account issues, security problems, or exclusive prizes.

These messages include links that take you to fake copies of the platform where you're asked for your username, password, and sometimes payment information . If you enter this information, attackers can access your real account, change addresses, make purchases in your name, or even change the associated email address. If you suspect your account has been compromised, follow the steps to recover a hacked account and strengthen your email security.

Another widespread scam involves a supposed seller who suggests continuing communication outside the platform (for example, via WhatsApp or email) to "save on commissions" or better manage shipping . They take advantage of this to offer expensive products at ridiculously low prices, convince you to make a direct payment, and then never send anything.

There are also cases targeting sellers where the buyer, after receiving the product, claims it is defective and demands a refund . The platform refunds the money, but the supposed buyer either doesn't return the item or sends a different, worthless item. This type of fraud exploits consumer protection policies.

In addition, some scammers rely on phone calls, impersonating the platform's customer service, with the excuse of a blocked order or a suspicious access attempt, seeking to get you to confirm codes, card details, or credentials.

Independent online stores and committed websites

Beyond the major marketplaces, many people shop at online stores run by small businesses, entrepreneurs, or brands selling from their own websites. While most are entirely legitimate, there is a risk that even honest businesses may have had their websites hacked without their knowledge.

Attackers often exploit vulnerabilities in the content management system, plugins, or insecure configurations to install malicious code known as "web skimmers." This type of malware captures the data you enter into payment forms, including card number, expiration date, and CVV code , and sends it to cybercriminals.

Therefore, before buying from a lesser-known store, it's wise to take a moment to do some research. It's advisable to look up information about the company, check its social media profiles, read external reviews, and verify who is behind the project . A website that doesn't offer clear contact information, an address, or a company name should be viewed with suspicion.

Another common trick used by scammers is to create domains that closely resemble those of legitimate brands, changing a single letter or using different extensions (for example, .shop instead of .com). It's crucial to verify that the address is exactly as expected and not a suspicious variation.

When you reach the payment process, it's essential to verify that the page uses a secure HTTPS connection (the padlock icon in the browser's address bar). While this isn't a guarantee of complete trustworthiness, it serves as an initial filter to eliminate websites that don't even encrypt the information.

Another good practice is to use virtual or prepaid cards for occasional purchases , so that if your data is leaked, the financial impact is limited. Many banks allow you to create temporary cards with a restricted balance specifically for these types of online purchases.

Scams on social media and Facebook Marketplace

Social media has become a marketplace for selling practically everything, which has also led to a surge in scams. One very common technique is the creation of fake profiles that mimic official accounts of banks, brands, or even well-known people , using the same logo, photos, and a similar bio.

Cybercriminals use web scraping tools to monitor comments on real accounts and then contact users who have asked for help or raised concerns via private message. In this way, they present themselves as customer service representatives and request personal or banking information to "resolve" the issue.

Sponsored ads on social media are also used to promote unrealistic offers, fake giveaways, or supposedly trendy products at ridiculously low prices . Often, they redirect users to fraudulent websites that collect financial information or subscribe you to paid services without your explicit consent.

When buying through social media, it's crucial to verify the account: check the number of followers, comment engagement, profile age, and posting frequency . A reputable seller typically has a track record and regular activity, not a newly created profile with hardly any posts.

It's always wise to be wary of suspiciously low prices and to seek feedback from other users. In case of fraud, it's important to save screenshots, messages, and proof of payment so you can report it to both the social network itself and the authorities.

On Facebook Marketplace, where the sense of connection makes people feel more at ease, listings for nonexistent or defective products abound. It's common for photos to show an item in perfect condition, but upon arrival, it's broken, very different from the description, or nothing at all . Whenever possible, it's advisable to see and try the product before paying.

The tactic of outrageously low prices is also common: if a product costs significantly less than elsewhere, it's probably not a bargain, but a scam. Comparing prices on other platforms helps detect suspicious discrepancies and avoid falling for a trap designed to steal your money.

Finally, beware of fake sweepstakes and phishing messages that use the Facebook Marketplace brand as bait. These usually arrive as emails or notifications promising gifts or bonuses in exchange for clicking and filling out forms with personal information , which is then used for other scams.

Fake job offers and labor fraud

Job scams exploit people's need or desire for career advancement by offering opaque, highly paid jobs with minimal requirements . They often arrive via email, professional social networks, or messaging apps.

A typical example is that of so-called "mystery shopper" or financial intermediary positions, where the scammer sends a check or money order for a higher amount than agreed upon and asks you to send the difference back to another account . By the time the bank discovers the check was fake, you've already sent real money to the scammer.

There's also a proliferation of fictitious companies that demand upfront payments for courses, materials, or administrative procedures in order to access the supposed job. As soon as they receive the money, they stop responding and disappear without a trace.

To protect yourself, be wary of unsolicited offers that arrive suddenly and don't match your professional profile, and never deposit suspicious checks or return cash discrepancies without your bank verifying the payment's authenticity. Requesting that the bank hold the funds until the check is verified is a basic precautionary measure.

Fake lotteries and scams targeting beneficiaries

Another classic scam that never goes out of style is the email announcing that you've won a foreign lottery or a million-dollar prize in a raffle you've never even heard of . They usually ask you to pay a small fee or for prize management, and while you're at it, to send personal information to release the money.

The warning signs are clear: the sender is usually an individual, not an official entity; the message is sent to multiple recipients; and the writing often contains grammatical errors or strange expressions . A quick internet search usually confirms that it's a recurring scam.

Closely related to these practices are so-called "beneficiary scams," in which someone claims to be a businessperson, an heir, or even a member of royalty who needs to move a large sum of money out of the country and offers you a commission in exchange for your help . The story is embellished with details that make it seem plausible, but it always ends with multiple small payments justified as legal expenses or commissions.

If you come across messages like these, the wisest thing to do is remember that nobody gives away large fortunes via email and that any promise of easy money without effort is almost certainly a scam.

Online dating scams and sextortion

Dating platforms and social networks are also common ground for so-called "catfishers": people who create fake profiles using stolen photos and other people's identities with the aim of deceiving other users.

At first, it all seems like a romantic story or an intense friendship: the other person shows strong emotions in a short time, gives you constant attention, and, as soon as possible, tries to move the conversation to private channels outside the dating platform.

After gaining your trust, the requests begin: money for a sick relative, for a plane ticket, to save a struggling business, or to pay for an emergency medical bill. In other cases, they pressure you into sharing intimate photos or videos, which they then use for blackmail , threatening to send them to contacts or publish them if payments aren't made.

To reduce risk, it is essential to configure social networks with the highest possible privacy settings, not accept requests from strangers without verifying who is behind them, and avoid sharing personal or banking information with people you only know online.

If you ever decide to meet someone in person you've only met online, make sure it's in a public place, let someone you trust know where you'll be, and avoid situations that could compromise your safety. And, of course, don't engage in sexting if you're not prepared to relinquish complete control over those images.

Fake loans, rentals and vehicle sales

Scammers also exploit the need for financing by offering quick loans with ridiculously low interest rates and overly favorable terms . They typically advertise on social media, forums, or blog comments, and manage everything through emails from free services.

The signs of fraud are quite clear: they offer large amounts of money with hardly any requirements, they always ask for an upfront amount for management expenses , and they usually require that payment be made through services that are difficult to trace, such as Western Union, MoneyGram, or transfers to foreign accounts.

Something similar happens with fake vacation or long-term rentals, and with the sale of used vehicles. The ads show spectacular apartments or cars at prices far below market value, and when you inquire, the supposed owner claims to be abroad and unable to travel . To secure the booking, they ask for an advance payment through platforms that supposedly act as intermediaries.

Many of these scams mention well-known websites like Airbnb or TripAdvisor, but only as a pretext to lend credibility; in reality, the transaction never actually goes through those platforms . A Google Images search of the listing photos or the property address usually reveals that images from unrelated sites have been used.

Before sending money, research reviews of the advertiser, check if other users have reported similar cases, and be wary of those who seem eager to close the deal and accept any conditions without question . For both rentals and vehicle purchases, it's advisable to view the item in person whenever possible.

Investment fraud, fake "likes" and invoices

In the financial sector, investment scams are growing rapidly, with supposed brokers or trusted advisors contacting people through social media or cold calls, promising extremely high returns on cryptocurrencies, stocks, or exclusive projects.

The process is usually similar: they ask for a relatively small initial deposit, which they then "prove" has generated profits with screenshots or manipulated dashboards. Once you trust them, they encourage you to contribute increasingly larger amounts . When you try to withdraw your money, excuses arise, new "necessary" payments are requested, and finally, they disappear with everything.

The so-called "like scam" preys on people's search for extra income. It begins with a contact via WhatsApp offering very simple tasks, such as liking content or following accounts, in exchange for small, immediate commissions . Then, you're invited to a Telegram channel where, little by little, you're pressured into investing money in supposed tasks or higher levels, until you lose everything you've invested.

Another growing scam is the "child in distress" scam, where someone impersonates your son or daughter via WhatsApp messages or other apps, claiming they've lost their phone, are having problems with the bank, or are in an urgent situation and need a quick cash advance . The goal is to exploit your fear and affection to get you to send large sums of money without verifying their story.

Finally, invoice fraud particularly affects businesses and the self-employed. Criminals impersonate regular suppliers and, through well-crafted emails, request that future payments be made to a "new" bank account they control . In other cases, they intercept a legitimate invoice sent to the client, change the account number, and resend it, so the money ends up in the fraudster's hands without either party realizing it at the time.

To minimize these risks, it is crucial to establish clear internal procedures: verify any bank account changes by phone with the usual contact , do not trust emails requesting urgent modifications, and always review invoice details before making a large transfer.

General tips to protect yourself from the most common online scams

There are a number of good practices that greatly reduce the chances of falling for a cybercriminal's trick and that should be applied consistently in your daily digital life to keep your accounts, money, and personal information safe.

First, never share your full passwords, signature codes, or confidential information via email, SMS, social media, or unsolicited calls. Your bank or any reputable institution will never ask for this information through these channels, and certainly not under pressure.

Avoid clicking on links in suspicious emails or messages, even if they appear official, and get into the habit of accessing your bank or other important services by typing the address directly into your browser or using the official apps . If a message seems suspicious, it's best to check the site yourself rather than follow the link it contains.

Keep your devices up to date, including both the operating system and applications, and use a reliable security solution that includes malware protection, filtering of dangerous websites, and specific features for secure payments . These tools add an extra layer of defense against fraudulent websites and malicious downloads.

Be wary of unbelievable bargains, miracle investments, free loans, and ads that sound too good to be true. Before paying or sharing any information, take a moment to look for reviews, ratings, and warnings from other users. Many scams leave a trail on forums and social media.

When a supplier informs you of a bank account change, verify the information through an alternative channel and, if something doesn't add up, hold the payment until you have confirmation . The same applies to urgent messages about family members in distress: try contacting the supposedly affected person through another means before sending money.

And if you've already fallen into a trap, act without delay: notify your bank to try to block or reverse the charges, change the passwords for the affected services, gather all possible evidence (emails, screenshots, receipts), and file a complaint with the appropriate authorities . In certain situations, it may be helpful to seek specialized legal advice to explore recovery options or determine liability.

The reality is that the internet will continue to be fertile ground for scammers, but the better we understand their tactics and the more security habits we incorporate into our digital routine, the harder it will be for them to make us victims and the more we can enjoy the advantages of the online world with peace of mind.