Online Scams, Fraud, and Digital Safety: What to Do Right Now
Got a suspicious email, text, or call? Here's how to spot a scam, what not to do, and exactly what steps to take in the next 30 minutes.
Short answer
Most scams work by manufacturing urgency so you act before you think — stop, do not click or pay anything, and contact the real organisation directly using a phone number you find yourself. Red flags include unexpected contact, requests for gift cards or wire transfers, and pressure to keep the situation secret. If you have already shared information or sent money, call your bank immediately and report it to the FTC at reportfraud.ftc.gov. The faster you move, the better your odds of limiting the damage.
Why scams work on smart people
Scammers are not counting on you being gullible. They are counting on your nervous system. When a message tells you your bank account is frozen or the IRS is sending someone to your door in two hours, your brain shifts into threat mode. Rational thinking slows down. Compliance speeds up. That is exactly the mechanism these schemes are engineered to exploit, and it trips up people with law degrees just as easily as anyone else.
One real example: the $2,400 grandparent scam, step by step
A woman in her seventies — call her Carol — receives a distressed call. 'Grandma, it's me. I'm in trouble.' Carol says her grandson's name out loud to confirm — 'Tyler?' — and the caller says yes. The scammer now has a name.
A second person gets on the line claiming to be a public defender. He says Tyler was in a minor accident and bail must be posted before morning: $2,400, cash only. Please do not tell Tyler's parents — it will embarrass him terribly.
Carol buys six $400 Google Play gift cards at CVS and reads the numbers over the phone. The money is gone within minutes. Gift card funds convert to cryptocurrency almost instantly. Tyler calls her the next day, entirely unaware.
Notice the architecture: emotional trigger, fake authority figure, artificial deadline, gift cards as payment, and a secrecy instruction. That combination appears in the vast majority of fraud cases reported to the FTC, which logged $10 billion in total consumer losses in 2023.
Five red flags that appear in almost every scam
- Unexpected contact. Your bank, the IRS, and Amazon do not cold-call you about emergencies. If the contact surprised you, be skeptical.
- Urgency with a hard deadline. 'You must act in two hours' is a script, not a real constraint. Legitimate organisations give you time to verify.
- Unusual payment method. Gift cards, wire transfers, cryptocurrency, and Zelle to a stranger are one-way doors. No real government agency will ask for these.
- A request for secrecy. 'Don't tell your family' is a bright red flag. Scammers know a second opinion kills the scheme.
- They contacted you first and already know something personal. Finding your grandson's name online takes thirty seconds. Familiarity is not proof of legitimacy.
Three mistakes people make after spotting something suspicious
Calling the number in the suspicious message to check if it is real — that number goes straight back to the scammer. Always find contact information through the organisation's official website, typed into your browser yourself.
Clicking the link just to see what it says. A phishing link can install tracking software or serve a fake login page before you realise what happened. Screenshot it if you need a record, then delete it without clicking.
Waiting a few days to decide how worried to be. Banks have fraud reversal windows. Credit bureaus have freeze processes. These work best when you use them fast.
What to do in the next 30 minutes
- Stop all contact. Do not reply, call back, or click anything.
- Look up the real organisation independently and call the number on their official site.
- If you shared a password, change it now on every account where you reuse it, and turn on two-factor authentication.
- Tell someone you trust. Isolation is part of the scammer's strategy.
- Save or screenshot the original message before deleting it — you may need it for a report.
If you gave a gift card number
Call the card issuer immediately using the number on the packaging and ask them to flag the card as fraud. Some issuers can freeze a remaining balance if you act within minutes. Keep the card numbers and your receipt before you call.
If money or data has already been shared
Call your bank first. Use the word 'fraud' and ask them to reverse any transfer and flag your account. If your Social Security number was exposed, go to IdentityTheft.gov — the FTC built that site to walk you through a personalised recovery plan. Then place a credit freeze at all three bureaus: Equifax, Experian, and TransUnion. It is free, it blocks new credit from being opened in your name, and it does not affect your existing accounts or score.
Where to report, and why it matters
- FTC fraud reports: reportfraud.ftc.gov
- Identity theft: IdentityTheft.gov
- Internet-based fraud: IC3.gov (FBI Internet Crime Complaint Center)
- Elder fraud: call 1-833-FRAUD-11
The scammer's best tool is your silence. Reporting, even when recovery seems unlikely, is how the next victim gets protected.
FTC reports are used to build court cases and identify patterns across states. The grandparent scam got specific DOJ attention partly because enough reports came in to show its scale. And if this happened to someone you love — lead with kindness before anything else. The shame people feel after being defrauded is one of the biggest barriers to reporting. Make it safe for them to talk, then help them make the calls.
Questions people also ask
Can I get my money back after a scam?
It depends on how the money moved. Wire transfers and gift cards are the hardest to recover — often impossible once funds clear. Credit card payments offer the best protection through dispute rights. If you paid by bank transfer, call immediately and ask about a recall request; success depends on speed and whether the receiving bank cooperates.
Is it safe to answer unknown calls at all?
You can answer, but do not offer any information — let the caller speak first. If they claim to represent an organisation, hang up and call that organisation back using a number from their official website. Caller ID spoofing makes the number on your screen meaningless.
What if I clicked a suspicious link but did not enter any information?
Some links can trigger a download just by loading. Run a malware scan using reputable software (Malwarebytes has a free version), change passwords for critical accounts as a precaution, and monitor your accounts for unusual activity over the next few weeks.
Should I use a fraud alert or a credit freeze?
A freeze is stronger. A fraud alert asks lenders to verify your identity before approving credit but does not block applications outright, while a freeze actively prevents new credit from being opened. If your Social Security number was exposed, go straight to a freeze at all three bureaus — it is free and you can lift it any time.
The Full Guide
Stop Scammers Cold Before They Steal From You
.jpeg)
- A printable scam-response checklist covering every payment type — wire transfer, Zelle, gift cards, and cryptocurrency — that you can keep on your fridge or share with an older relative
- Worked-through scenarios for six common scam types including IRS impersonation, fake bank fraud alerts, and tech support pop-ups, with the exact words to say when you call the real organisation back
- A side-by-side visual comparing real versus fake emails and texts from major institutions, with the specific details that give fakes away every time