How to protect yourself from online scams: the complete guide

You can stop most online scams with five habits: slow down when someone rushes you, never share a code or a password, contact the organization yourself on a number you already know, never move money to keep it “safe”, and pay in ways that can be reversed. Consumer agencies, police and regulators in several countries give the same advice, and each rule below links to the official page that states it.

Anyone can be fooled. Scammers copy real logos, fake the number on your screen and write messages that sound like your bank or your child. The aim is not to spot every trick, but to have a few rules that still work when a message looks real. If something has already happened, start from what to do in the first 30 minutes.

What are the five rules that stop most scams?

Stop when you are rushed. Pressure to act now is one of the four signs of a scam in the US Federal Trade Commission’s guide How to avoid a scam: scammers want you to decide before you can think, and may keep you on the phone so you cannot check their story. The UK Financial Conduct Authority (FCA) says on its scams page that a genuine bank or business won’t mind if you take time to think. Hang up or close the message, then talk to someone you trust, as the FTC suggests.
Never share a code, a PIN or a password. The one-time codes your bank and your apps send you prove that it is you. “Never share a verification code. Ever,” the FTC writes in an alert about fake bank fraud calls, because whoever has the code can use it to pretend to be you. The FTC adds that honest organizations will not ask for bank account or card numbers in a call, email or text you did not expect. Italy’s Polizia Postale says in its phishing advice that banks and card companies never ask you to confirm personal data by email.
Contact them yourself, on a number you already know. When a call, text or email says it comes from your bank, a courier or a public office, do not use the link or the number it gives you. The FTC says to use the number on your statement, “never the number the caller gave you”, and to reach a company through a website or phone number you already trust. For a card, the FTC says to use the number on the back or in your banking app. The Polizia Postale gives the same advice for websites: type your bank’s address yourself, even when the email looks genuine. The name and number on your screen prove nothing, because caller ID can be faked.
Never move money to keep it “safe”. A caller who says your account is under attack and tells you to transfer your savings to a “secure” account is a scammer. The FTC’s alert is titled Never move your money to “protect it.” That’s a scam. Another FTC alert describes the variants: cashing out savings to put in a box, or buying cryptocurrency or gold bars. In every version, “instead of protecting your money, you’re about to lose all your savings.” In the UK, a Devon & Cornwall Police alert lists asking you to move money to a “safe account” among the things your bank will never do.
Pay in ways that can be reversed. The FTC says never to pay anyone who insists on cryptocurrency, a wire transfer, a payment app or a gift card. For online shopping, the UK National Cyber Security Centre (NCSC) advises paying by credit card if you have one, notes that debit cards offer less protection but may allow a refund claim through “chargeback”, and says never to pay by direct bank transfer. Cryptocurrency payments have fewer legal protections than cards, the FTC adds, so getting the money back can be hard.

Did it already happen?

If you have already paid, read out a code or let someone into your device, act first and read later.

You paid or gave bank details: follow what to do in the first 30 minutes, starting with a call to your bank on the number on your card.
You want to report it: Where do I report a scam? gives the official channels country by country.
You received a strange text and are not sure: how to spot a scam text shows the common fake bank, parcel, toll and fine messages.

How do scams reach you?

The same tricks arrive on every channel. Only the disguise changes.

Text messages

Fake texts about a delivery problem, a suspicious charge on your bank account or an unpaid toll ask you to tap a link or call a number, as the FTC’s alert Is that unexpected text a scam? describes. Its advice: do not reply, never click links in unexpected messages, and do not assume a text from a company you know is genuine. In the UK, most phone providers let you forward a scam text to 7726 for free, the NCSC says; in the US, the FTC also points to 7726 (SPAM) and to the report button in your messaging app. Our guide to scam texts goes through the common families one by one.

Phone calls

A caller says they work for your bank’s fraud team, the police or a tech company. The FTC describes callers “supposedly spotting fraud or criminal activity” on your account, who then ask you to move money or read out a code. Hang up and call the number on your card or statement. In the UK, the government’s Stop! Think Fraud campaign says to contact your bank on a number shown on its website or the back of your card, “or call 159”. The Devon & Cornwall Police add two warnings: 159 will never call you, and a scammer can keep a landline open after you hang up. Use a different phone to call your bank; with only one phone, hang up, wait at least 30 to 60 seconds and call a friend or relative first.

A message from an unknown number says it is your son or daughter with a new phone, or a friend in trouble, and asks for money today. The FTC’s page on fake emergencies warns that some scammers use AI to clone a relative’s voice from a short audio clip. It advises calling the person on a number you know is right, or calling another relative or friend, even if you were told to keep it secret.

Investment offers arrive this way too. The FCA notes that scammers contact people by email, text, post and social media as well as by phone. Italy’s market regulator Consob warns about cloned websites, fake profiles of politicians and famous people, and images, voices or videos made with AI.

Email

Phishing emails look like they come from a bank, a card company or an online service and link to a copy of the real site. The Polizia Postale explains that the link only appears to lead to the bank’s website, and warns about attachments disguised as invoices, fines or parcel notices. In the UK, you can forward a suspicious email to [email protected], as the NCSC’s reporting page explains.

Websites and ads

Fake shops copy the look of real brands, and cloned sites copy real investment firms. The FCA warns that some firms pretend to be authorized firms, so it says to use only the contact details on its Firm Checker. Consob tells Italian savers to check that the operator is authorized before investing. Before paying a shop you do not know, run the checks in How do I know if an online shop is real?.

Buying and selling between people

On marketplaces and classified sites, scams run both ways. The FTC describes a classic one aimed at sellers: a buyer “accidentally” pays by check for too much, then asks you to refund the difference. Its advice: do not accept a check for more than the selling price. Buyers face the same risk as in a fake shop, so rule 5 applies: pay in a way that can be reversed.

Pop-ups on your screen

A window says your computer or phone is infected and gives a number to call. “Real security pop-up warnings and messages will never ask you to call a phone number,” the FTC says in its guide to tech support scams, and legitimate tech companies will not contact you by phone, email or text to tell you there is a problem. Close the page and do not call.

QR codes in the street

Scammers have covered the QR codes on parking meters with their own, the FTC reports. Do not scan a QR code in an email or text you were not expecting, and when you find one in an unexpected place, look at the web address before you open it.

Which scams are going around this month?

The bait changes with the news and the season; the rules on this page do not. The Security & scams section will publish a monthly roundup, starting in November, of the scams reported by official sources, such as police, cyber agencies and regulators in Italy, the UK, the US and elsewhere, each with the date of the alert and what to do. This guide is checked again every month alongside it.

The FTC groups the warning signs into four; the FCA and other regulators add a few more. One sign is enough to stop and check. Our examples contain no real links or numbers.

Someone pretends to be an organization or a person you trust. Scammers often pose as a government agency, a utility, a tech company or a charity, and caller ID can be faked (FTC); some pose as a relative in trouble (FTC). Example: “YourBank Security: a payment of €749.00 to a new device was authorized. If this was not you, call our fraud team at once on the number below.”
There is a problem, or a prize. You owe money, an account has a problem, a relative is in trouble, or you have won something and must pay a fee to collect it (FTC). Example: “Your parcel could not be delivered because the address is incomplete. Update it within 24 hours: parcel-redelivery[.]example.”
You must act now. The scammer wants a decision before you can think, and may threaten arrest, a lawsuit or the loss of a license (FTC). Example: “This is your final notice. Your account will be closed at 6 pm today unless you confirm your details.”
You must pay in a particular way. Cryptocurrency, a wire transfer, a payment app or gift cards, or depositing a check and sending money back (FTC). Example: “To release your refund, buy two €100 gift cards and send me photos of the codes on the back.”
They ask for a code, a PIN or a password. No genuine caller needs your verification code (FTC). Example: “To cancel the fraudulent payment I need you to read me the six-digit code we have sent to your phone.”
They ask you to keep it secret. The FCA lists being told you have been specially chosen and that the offer must stay secret. Example: “Mom, please don’t tell Dad yet, I’ll explain later. Can you pay this invoice for me today?”
The reward is tempting, and the offer runs out. The FCA says fraudsters often promise high returns and may offer a bonus if you invest quickly. Example: “Our AI trading platform doubled my savings in a month. Join by Friday and get a 20% welcome bonus.”

How do I protect my accounts, devices and family?

Your accounts

Start with your email. The NCSC’s top tips explain that criminals can use your email to get into many of your other accounts, so it needs a strong password used nowhere else. Where a service offers a passkey, a way to sign in without typing a password, use it: in April 2026 the NCSC said that passkeys should now be consumers’ first choice of login. Where they are not offered, it advises a password manager and two-step verification, which asks for a second proof such as a code on your phone. For a password you have to remember, the NCSC suggests combining three random words. And whatever protects the account, rule 2 still applies: the codes it sends you are for you alone.

Your phone and computer

Install software and app updates when they arrive: the NCSC says they contain vital security fixes. Install apps only from sources you trust; the FCA warns that scammers may take control of a device through software they persuade you to install. Keep a copy of your photos and important documents on an external drive or a cloud service, as the NCSC suggests.

Your family

Agree with the people closest to you that a request for money by message is always checked by calling back on the number you already have, as the FTC advises for fake emergencies. With older relatives, go through the five rules together and offer to be the person they call before paying anyone they do not know: the FTC lists talking to someone you trust as one of the ways to avoid a scam. Nobody should feel ashamed to ask.

What should I do if it already happened?

Act on the money first, then on the accounts, then keep the evidence and report. The full sequence, with the steps for each payment method, is in what to do in the first 30 minutes. In short:

If you only received it

Do not reply, do not tap the link and do not call any number in the message. Report it: in the UK forward texts to 7726 and emails to [email protected] (NCSC); in the US forward texts to 7726 and report at ReportFraud.ftc.gov (FTC); in Italy the Polizia Postale’s online reporting form accepts reports of phishing. Then delete it.

If you clicked a link or gave a code or a password

You typed card or bank details, or read out a code: call your bank now on the number on your card or in its app. Italy’s central bank, the Banca d’Italia, says on its page for victims of scams and fraud that telling your bank at once lets it take countermeasures.
You gave a password: if you can still log in, create a new strong password for that account and turn on two-step verification, as the FTC advises. Do your email first: the NCSC explains that criminals can use your email to get into your other accounts.
You let someone control your computer or phone: update your security software, run a scan and delete anything it flags, then change your passwords and turn on two-step verification (FTC).
You gave an identity number: in the US, the FTC sends you to IdentityTheft.gov for a recovery plan. For other countries, see the boxes below.

If you paid

Call the bank, card issuer or service you paid through and ask them to stop or reverse the payment. The FTC gives the first step for each method:

Credit or debit card: contact the card issuer on the number on the back of the card or in your app and ask for a refund.
Bank transfer, including instant transfer: report it to your bank right away and ask them to reverse it.
Payment app (such as PayPal): report the payment to the app right away and ask for it to be reversed.
Wire transfer service: tell the company a scammer tricked you and ask for a refund.
Prepaid card: call the card issuer on the number on the card or in its app and ask them to block it. The Banca d’Italia says to tell your financial institution at once.
Gift card: contact the card issuer on the number on the card, explain that a scammer has the number and PIN, and keep the card and the receipt.
Cryptocurrency: contact the exchange or the crypto ATM operator, say the transaction was fraudulent and ask them to reverse it. Recovery is often hard.

Whether you get the money back depends on how you paid and on your country’s rules, and the bank decides first. The boxes below give the official routes.

Beware of anyone who offers to get your money back

After a scam, you may be contacted again by someone who promises to recover the money for a fee. “Did someone contact you and ask for an upfront fee? That’s a scammer,” the FTC writes on its page about refund and recovery scams, and government agencies never ask for money to help you get a refund. The FBI’s Internet Crime Complaint Center (IC3) says it will never contact you directly for information or money, and does not work with law firms or crypto services to recover lost funds.

Where do I report a scam, and can I get my money back?

If money is involved, call your bank first, then report to the police or the national reporting service. No page can tell you whether your bank will refund you: the bank decides first, then an ombudsman or a court if you disagree. Reporting is worth doing even when the money is gone: the FTC says reports help it build cases against scammers and spot trends.

If you are in Italy

Bank: tell your bank or payment provider at once, then send a written complaint (reclamo). The Banca d’Italia says the bank must reply within 15 working days for payment services.
If the bank says no: you can send a report (esposto) to the Banca d’Italia or turn to the Arbitro Bancario Finanziario (ABF), an out-of-court system for disputes with banks. A complaint to your bank must come first.
Police: report the crime to the Polizia Postale or at a Polizia di Stato office. The online form Segnala online is for reporting suspicious activity and does not replace a formal complaint (denuncia). An online pre-complaint for fraud and misuse of payment cards, confirmed in person within 48 hours, is being tested only at some offices in Lazio; you sign in with SPID or CIE.
Investments: check on Consob’s Occhio alle truffe! page that the operator is authorized before paying anything.

If you are in the UK

Bank: call the number on your card, or call 159, from a different phone if you can.
Police: in England, Wales and Northern Ireland, report to Report Fraud (formerly Action Fraud) at reportfraud.police.uk, the service the NCSC and the FCA now point to. In Scotland, call Police Scotland on 101.
Texts and emails: forward texts to 7726 and emails to [email protected] (NCSC).
Bank transfers: if you were tricked into sending a UK bank transfer by Faster Payments or CHAPS, the Payment Systems Regulator’s reimbursement protections cover claims up to £85,000. Claim within 13 months of the payment; the bank may deduct an excess of up to £100, and should refund you within 5 business days of your claim, or decide within 35 business days if it needs more information. “You won’t get your money back if you’re found to have been complicit in the fraud or grossly negligent,” the PSR says; it calls gross negligence a high bar, and the exception does not apply to vulnerable customers. Card payments and goods that never arrived follow other rules. Losses above the limit can go to the Financial Ombudsman Service.
Investments: check a firm on the FCA’s Firm Checker or call the FCA consumer helpline on 0800 111 6768.

If you are in the US

Bank or card issuer: call the number on the back of your card and ask to reverse the payment (FTC).
Report: to the FTC at ReportFraud.ftc.gov, and to the FBI’s IC3, the central point for reporting online fraud and cybercrime.
Texts: forward them to 7726 (SPAM).
Complaints: if the bank or card company does not resolve it, you can submit a complaint to the Consumer Financial Protection Bureau, which sends it to the company for a response.
Identity: if someone used your Social Security number, the FTC sends you to IdentityTheft.gov.

Elsewhere

Your bank is always the first call. Where do I report a scam? lists the official channels country by country, with the date each link was checked.

Where to go next

Common questions

How can I tell if a message is a scam?

Look for the signs most scams share: someone claims to be an organization or a person you trust, says there is a problem or a prize, pushes you to act now and asks for a code, a password or a payment in a particular way. One of these is enough to stop. Do not use the link or number in the message: open the official app or website yourself, or call the number on your card.

What are the most common online scams?

Official sources keep describing the same families: fake texts about deliveries, bank charges and unpaid tolls; calls from a fake bank fraud team or a government office; messages from a relative with a new number who needs money; fake shops; investment offers on social media; and pop-ups that tell you to call a support line. The bait changes, but the same rules work against all of them.

How do I protect myself from bank scams?

Your bank's one-time codes, PIN and passwords are for you alone: the FTC says never to share a verification code with anyone. If someone calls about fraud on your account, hang up and call the number on your card or statement. Never move money to a 'safe' account because a caller told you to: that is a scam.

How do I protect myself from phone scams?

Remember that the name and number on your screen can be faked. Do not give codes, card details or passwords to anyone who called you, and do not install apps they suggest. Hang up and call the organization back on a number you found yourself, from a different phone if you can; in the UK, you can call 159 to reach your bank.

Will my bank refund me if I get scammed?

It depends on how you paid and where you live, and the bank decides first. Card payments can often be disputed, and in the UK, if you were tricked into sending a bank transfer by Faster Payments or CHAPS, your bank must normally refund up to £85,000 if you claim within 13 months. In Italy you can complain to the bank and then go to the Arbitro Bancario Finanziario. Call the bank as soon as possible in every case.

How do I report a scam?

If money is involved, tell your bank first. Then report to the police or the national service: Report Fraud (formerly Action Fraud) in England, Wales and Northern Ireland, Police Scotland on 101, the FTC at ReportFraud.ftc.gov in the US, the Polizia Postale in Italy. The page Where do I report a scam? lists the official channels country by country.

How can I tell if a website is a scam?

No single check is proof. Look at the address in the browser, who runs the shop and how it lets you pay: the UK NCSC advises paying by credit card where you can and never paying a seller by direct bank transfer. The guide How do I know if an online shop is real? goes through a two-minute check before you pay.

Topics: scams, phishing, bank scams, fraud reporting