Scams

An advance fee scam tricks the victim into paying an upfront fee in exchange for the promise of a much larger future payout that never arrives, classically framed as an inheritance, lottery win, or foreign official needing help moving funds. It is also known as a 419 scam, after the section of the Nigerian criminal code that covers the offense.

An AI voice cloning scam uses a few seconds of recorded speech — pulled from social media, voicemail, or a short phone call — to generate a synthetic copy of someone's voice, then impersonates them in a fake emergency call demanding money. The most common variant is the grandparent scam, where the cloned voice of a child or grandchild claims to be in jail, in the hospital, or stranded abroad.

Business email compromise is a targeted fraud in which attackers impersonate an executive, employee, or vendor over email to redirect wire transfers, payroll, or invoice payments to accounts they control. It relies on social engineering and spoofed or compromised email accounts rather than malware.

Catfishing is the practice of creating a fake online persona to deceive another person into a romantic or emotional relationship, often as a prelude to financial fraud, blackmail, or manipulation. Detection typically combines image reverse-search, behavioral signals, and conversation analysis.

A crypto scam is any fraud that exploits cryptocurrency rails to steal funds, including fake exchanges, celebrity giveaway scams, wallet drainers, and fraudulent token launches. The irreversibility of on-chain transactions makes recovery extremely difficult once assets have moved.

A deepfake scam uses AI-generated synthetic video or audio to impersonate a real person for fraud, including fake CEO video calls authorizing wire transfers, fabricated celebrity endorsements of investment schemes, and synthetic non-consensual intimate imagery used for sextortion. As generation tools get cheaper and faster, deepfakes are becoming a default layer in business email compromise and romance scams.

An employment scam is a fraud that uses fake job listings, recruiter outreach, or work-from-home offers to extract money or personal information from applicants. Common variants include upfront fees for equipment or training, fraudulent check-cashing tasks, and identity theft disguised as onboarding paperwork.

Fraud detection is the process of identifying and preventing deceptive activity on a platform — including scams, fake accounts, payment fraud, and account takeovers — typically by combining behavioral signals, device fingerprinting, and machine learning models.

A government impersonation scam is a fraud in which criminals pose as officials from tax, social security, law enforcement, or immigration agencies to pressure victims into sending money or sharing personal information. It is among the fastest-growing categories of reported fraud in recent years.

An imposter scam is a fraud in which the attacker pretends to be someone the victim trusts — a government agency, a family member, a business, or a tech support agent — in order to extract money or personal information. Imposter scams are consistently the top category of fraud reported to the US Federal Trade Commission, with billions of dollars in reported losses each year.

An investment scam is a fraud that lures victims into fake trading platforms, nonexistent funds, or manipulated crypto schemes with promises of unusually high or guaranteed returns. It consistently ranks among the highest-loss fraud categories, often facilitated through social media and messaging apps.

Phishing is a social engineering attack in which the attacker impersonates a trusted entity — a bank, an employer, a well-known brand — in an email, text message, or website in order to trick the victim into handing over credentials, payment information, or access to a device. Variants include spear phishing, smishing (SMS), and vishing (voice).

A pig butchering scam is a long-con fraud in which a scammer builds a romantic or friendly relationship with a victim over weeks or months, then lures them into a fake cryptocurrency investment platform and drains their savings. The name comes from the Chinese "sha zhu pan" — fattening the pig before the slaughter.

A romance scam is a fraud in which the attacker feigns a romantic relationship with the victim to win their trust and then solicit money, gift cards, or cryptocurrency. Romance scams are frequently the entry point for pig butchering investment fraud and financial sextortion, and are among the most costly categories of consumer fraud tracked by the FBI and FTC.

A rug pull is a cryptocurrency exit scam in which the developers of a token or project abruptly abandon it and drain the liquidity pool, leaving holders with worthless assets. It typically follows aggressive marketing and artificial price pumping designed to attract retail buyers.

Sextortion is a form of online blackmail in which an attacker threatens to share sexual images or videos of a victim unless they pay money or provide more content. The FBI has warned of a sharp rise in financial sextortion targeting teenage boys, with tens of thousands of reports filed to the National Center for Missing & Exploited Children each year.

A SIM swap is an attack in which a fraudster social-engineers a mobile carrier into transferring a victim's phone number to a SIM they control, allowing them to intercept SMS-based two-factor authentication codes and take over bank, email, and crypto accounts. It is one of the primary reasons security practitioners discourage SMS 2FA for high-value accounts.

Smishing is phishing delivered over SMS, where attackers send text messages impersonating a bank, delivery service, toll authority, or government agency to trick the recipient into clicking a malicious link or handing over credentials. The compressed format of text messages makes it harder for victims to spot the usual red flags of a phishing attempt.

A tech support scam is a fraud in which criminals impersonate well-known software or hardware companies — most often Microsoft or Apple — to convince victims that their device is infected, then charge for fake repairs or install remote access tools. Older adults are disproportionately targeted.

Vishing is voice phishing, where an attacker calls the victim and impersonates a bank, tax authority, or tech-support agent to extract credentials, payment details, or remote access to a device. Modern vishing increasingly uses AI voice cloning to impersonate specific individuals the victim knows and trusts.