The Signs of a Scam: Red Flags That Show Up Again and Again
Scams take many forms: a delivery text, a job offer, a bank alert, a message from someone you just met. But underneath the costume, most of them run on the same small set of moves. This guide is for anyone who wants a single mental checklist they can apply to any message, call, or website. Learn the seven red flags that appear in nearly every scam, and you will catch the majority of them before they cost you anything.
How we check this: Reflects how the FTC, FBI IC3, and CISA describe the recurring tactics behind fraud across channels. · Last reviewed: 2026-08
Why one checklist beats memorizing a thousand scams
New scam stories appear in the news every week, and it is impossible to keep a running list of every fake company, every spoofed phone number, and every phishing page. The good news is that you do not have to. Fraud is a business, and like any business it reuses the tactics that work. Almost every scam has to do three things: get your attention, make you act fast, and get you to hand over money, credentials, or a code.
That means you can stop trying to recognize specific scams and start recognizing the shape of a scam instead. When two or more of the red flags below show up in the same message, treat it as a scam until proven otherwise, not the reverse. Being wrong about a legitimate message costs you a few minutes. Being wrong about a scam can cost you your savings or your accounts.
The seven universal red flags
1. Urgency and deadlines. "Act within 24 hours or your account will be closed." "Only 2 spots left." "Pay now to avoid arrest." Manufactured time pressure is the single most common ingredient in fraud because a rushed brain skips the checks a calm brain would make. Real institutions give you time and never threaten instant, irreversible consequences over text.
2. Unexpected contact. You did not apply for that job, order that package, enter that lottery, or ask your bank to text you. When a message arrives out of the blue and asks you to do something, that alone is a reason to slow down. Scammers reach thousands of people at once and count on a few being caught off guard.
3. A request to verify, log in, or pay. The goal of almost every scam is one of three things: your login credentials, a one-time verification code, or a payment. Any unexpected message that steers you toward all three, "confirm your details," "enter the code we sent," "pay this fee", deserves suspicion.
4. A lookalike or wrong domain. The link says "USPS" or your bank's name, but the actual web address is a jumble, a slightly-off spelling, or a random domain. Scammers register addresses that look right at a glance. Checking where a link actually goes is one of the highest-value habits you can build.
5. Pressure plus secrecy. "Don't tell anyone." "This is confidential." "Handle it yourself." Real organizations are happy for you to call a spouse, a colleague, or the company's official line. Secrecy is a scammer's way of cutting you off from the people who would talk you out of it.
6. Too good to be true. Guaranteed returns, a job that pays hundreds a day for tapping buttons, a prize you never entered to win, a rental far below market rate. If the deal is dramatically better than reality allows, that gap is the warning sign.
7. An off-platform pivot. You match on a dating app or a job board and are quickly pushed to WhatsApp, Telegram, or personal email. Moving the conversation somewhere unmoderated is a deliberate step that removes the platform's safety tools and any record.
The three things scammers are really after
Underneath the story, every scam wants one of three things. The first is your credentials, your username and password, usually captured on a fake login page that looks like the real site. The second is a verification code, the six-digit number your bank or email provider texts you; handing it over lets a stranger walk straight into your account even with a strong password. The third is money, moved by a method that is hard to reverse: gift cards, wire transfers, crypto, or instant apps like Zelle.
Knowing this gives you a shortcut. Whenever a message asks for any of the three, stop and verify through a channel you chose, not a link or number they gave you. Open your banking app directly. Call the number on the back of your card. Type the company's website in yourself. The moment you use your own path instead of theirs, most scams fall apart.
Why smart people get scammed
It is tempting to believe scams only catch the careless or the naive. They do not. Fraud works by targeting emotion, not intelligence, fear of losing an account, excitement over a windfall, the sting of a supposed problem, the warmth of a new connection. Under a spike of emotion, everyone's judgment narrows, and the part of the brain that would normally pause and question goes quiet. Scammers engineer that spike on purpose; it is the whole point of the urgent tone and the alarming subject line.
They also exploit context. A fake package text feels plausible precisely because you are expecting a package. A fake invoice lands during a busy workday when you are processing dozens of real ones. A romance scam unfolds over weeks so that by the time money is mentioned, trust is already built. Recognizing that scams are designed to bypass your judgment, rather than test your smarts, is what lets you install a hard rule instead of relying on being clever in the moment: when emotion spikes, slow down and verify.
This is also why a second set of eyes helps so much. The people who avoid the worst losses are usually the ones who paused to ask someone, a family member, a colleague, a bank's official line, before acting. Secrecy is a scammer's enemy, which is exactly why so many scams insist on it.
Where these red flags show up, by channel
The same tactics wear different clothes depending on how they reach you. In email, they arrive as phishing, a fake alert, invoice, or security warning designed to make you click. In text messages, they show up as smishing, the fake toll bill, the parcel "held" for a small fee, the bank "fraud alert" that is itself the fraud. In job offers, they appear as recruiters with lookalike domains, task scams, and crypto "opportunities." On the phone, they become impersonators of the IRS, Social Security, or your bank, a tactic known broadly as vishing.
Rather than repeat the details here, use the focused hubs below. Each one drills into a single channel with real examples and step-by-step checks, but all of them trace back to the same seven signals you just learned. Master the signals once and every channel becomes easier to read.
A 30-second gut check for any message
When something lands in front of you, run this quick pass. Did I expect this? Is it pushing me to move fast? Is it asking for a login, a code, or a payment? Does the link or sender address actually match the company it claims to be? Is it telling me to keep it quiet or move to another app? If you answer yes to two or more, stop and verify independently before doing anything else.
You do not need to prove a message is a scam to walk away from it. The safe default is to do nothing until you have confirmed through a channel you trust. If you want a second opinion in the moment, you can paste a suspicious message, link, or sender into Hunch and it will flag the signal categories it sees, urgency, a lookalike domain, a credential or payment ask, so you can decide with a clearer head.
FAQ
What is the number one sign of a scam?
Manufactured urgency. Almost every scam pushes you to act immediately so you skip the checks you would normally make. A real organization will give you time to verify.
How can I tell a scam from a real message quickly?
Run a fast gut check: did I expect this, is it rushing me, and is it asking for a login, a code, or a payment? Two or more yeses means stop and verify through a channel you chose yourself.
Are scam messages always full of spelling mistakes?
Not anymore. AI now writes clean, professional-looking messages, so poor grammar is no longer a reliable tell. Judge the message by its tactics, urgency, unexpected contact, and payment or credential requests, not its polish.
What should I do if I think a message is a scam?
Do nothing it asks you to do. Don't click, reply, or pay. Verify independently by contacting the company through a number or website you look up yourself, and delete or report the message.