Scam-alert by Crystal Intelligence

Scam Explorer

Click a scam type to learn more. Drag the circles to explore how different scams are connected.

Account Takeover

description

A scam wherein the attacker uses phishing, malware, or social engineering to gain control of a victim’s financial account (bank, credit card, online wallet). The victim might be tricked into giving their login, or the scammer uses stolen personal data (from breaches) to reset credentials. Once in, the fraudster drains funds or makes fraudulent transactions.

alternative scam terms

Account Takeover; ATO; Account Hijacking; Credential Stuffing; Session Hijack

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Infostealers; reverse proxies; session hijacking; OTP bypass kits.

modus operandi

Steal credentials or intercept OTPs to seize accounts and transfer funds/assets.

red flags

Login anomalies; password reset bursts; new device locations; OTP prompts.

victim impact

Identity theft; unauthorized transfers; service lockout.

Crowdfunding

description

The scammer sets up a fraudulent fundraising campaign on crowdfunding platforms (GoFundMe, etc.), often with a heart-tugging story (medical emergency, hardship, etc.). People donate online, but the story is false and the scammer simply takes the money.

alternative scam terms

Crowdfunding Scam; Fake GoFundMe; Fundraiser Fraud; Donation Con

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Stock images; sockpuppet boosters; rapid withdrawals.

modus operandi

Create fake fundraisers with fabricated stories; cash out quickly or misuse funds.

red flags

New profiles; unverifiable claims; organizer blocks comments.

victim impact

Financial loss; time costs; trust erosion.

Cryptojacking Malware

description

Malware that hijacks a victim’s device resources to mine cryptocurrency without consent.

alternative scam terms

Cryptojacking; Illegal crypto mining

infrastructure

Mining pools; loaders; C2

tools tactics

XMRig; mining pools; fileless persistence

modus operandi

Exploit/cred stuffing → drop miner → persist → cash out mined coins

red flags

CPU spikes; unexpected cloud bills; new outbound pools

victim impact

Performance degradation; high bills

Disaster Relief

description

A type of charity fraud where scammers pose as charities or relief funds in the wake of natural disasters or crises. They urge people to donate for emergency relief, but funnel the money to themselves​.

alternative scam terms

Disaster Relief Scam; Emergency Aid Fraud; Crisis Donation Scam

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Fake volunteers; cloned relief brands.

modus operandi

Exploit disasters to raise funds that never reach victims or to sell fake aid.

red flags

Urgency; lack of transparency; requests for unusual payment rails.

victim impact

Financial loss; time costs; trust erosion.

Double-Extortion Ransomware

description

An evolution of ransomware where attackers exfiltrate sensitive data before encryption, threatening to leak it if ransom is unpaid.

alternative scam terms

Double-extortion ransomware; Pay-or-leak

infrastructure

Leak sites; TOR; stealer tooling; encryptors

tools tactics

rclone/exfil tools; C2 beacons; data leak blogs

modus operandi

Initial access → data exfiltration → encryption → leak site posting threat → negotiation

red flags

Data staging exfil; TOR leak portal references; communications via Tox/Telegram

victim impact

Financial + reputational harm; regulatory penalties

Executive/CEO Imposter Call

description

Similar to CEO email fraud but executed via phone call or text. The scammer, pretending to be a high-ranking company official (CEO/CFO), contacts an employee (often in finance) urgently instructing them to transfer funds for a supposed confidential or time-sensitive matter. The pressure and authority in the request make employees comply without verification.

alternative scam terms

CEO Imposter Call; Executive Impersonation Scam; Fake Boss Call

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Spoofed numbers; AI voice clones.

modus operandi

Attacker impersonates senior exec to pressure urgent payment or data.

red flags

Secrecy; urgency; unusual payment routes.

victim impact

Financial loss; time costs; trust erosion.

Fake App Malware

description

Trojanized or malicious apps impersonating legitimate ones to steal data or deliver malware.

alternative scam terms

Fake app; Trojanized app

infrastructure

Malicious apps; update servers; C2

tools tactics

Code signing abuse; dynamic payloads; overlays

modus operandi

User installs spoofed app → permission abuse → data theft/fraud

red flags

Low-reputation developer; excessive permissions; off-store downloads

victim impact

Account compromise; financial loss

Fake Charity

description

Fraudsters solicit donations for an organization or cause that is fabricated or whose name closely mimics a real charity. Donors are convinced their money will aid a cause (disaster relief, illness, veterans, children, etc.), but the scammer keeps the funds.

alternative scam terms

Fake Charity Scam; Donation Fraud; Phony Nonprofit Scam

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Cloned sites; spoofed hotlines; QR donations.

modus operandi

Clone or invent charities to solicit donations, often post-disaster.

red flags

New domain; no registration; crypto/gift card requests.

victim impact

Financial loss; time costs; trust erosion.

Fake Check Prize

description

A victim receives a realistic-looking check (often via mail) supposedly as partial winnings of a prize or lottery. The scammer instructs the victim to deposit it and quickly wire back a portion for taxes or fees. The check later bounces, and the victim loses the money sent.

alternative scam terms

Fake Check Prize Scam; Prize Check Fraud; Winning Notification Scam

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

High-quality check stock; remote deposit; altered MICR.

modus operandi

Send counterfeit check; victim refunds part before check bounces, bearing loss.

red flags

Overpayment; urgency to wire back; refusal to wait clearing.

victim impact

Financial loss; time costs; trust erosion.

Fake Cheque/Mystery Shopper

description

A job-seeker is “hired” as a mystery shopper or payment processor. The scammer sends a counterfeit check (purportedly for the shopping assignments) and instructs the victim to deposit it, then wire a portion back or to another party (for example, to “test” money transfer services). The check bounces later and the victim loses the money they sent out.

alternative scam terms

Mystery Shopper Scam; Fake Cheque Scam; Overpayment Fraud

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Mobile deposit; forged checks; cashier’s check spoofs.

modus operandi

Send counterfeit checks for shopping tasks; victim returns excess; check bounces.

red flags

Overpayment; urgency; request for wire/crypto refund.

victim impact

Financial loss; time costs; trust erosion.

Fake Debt Threat

description

Scammers contact victims (by phone or mail) claiming the victim owes a debt (unpaid taxes, court fines, loan, or utility bills) that must be paid immediately, often impersonating a debt collector or official. They threaten legal action, arrest, or lawsuits if not paid. The supposed debt is entirely fake or already paid.

alternative scam terms

Phantom Debt Extortion; Phantom Debt Scam; Fake Debt Collection; Debt Extortion Fraud

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Fake case numbers; law firm names; spoofed documents.

modus operandi

Bogus collectors threaten legal action/arrest to force payment of non-existent debts.

red flags

Immediate payment demand; refusal to provide validation notice; caller ID spoof.

victim impact

Acute psychological distress; coercion under threat; reputational risk.

Bait-and-Switch

description

A seller advertises a product or service at a very low price or with attractive terms to lure customers, but then pressures the victim into a different, more expensive or inferior product. In some cases, the initially advertised item is “not available” and a substitute is pushed.

alternative scam terms

Bait-and-Switch; Switcheroo; Product Swap Scam; Substitution Fraud

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Listing cloning; deceptive product images; fake reviews.

modus operandi

Advertise quality; ship inferior or partial goods; obstruct returns.

red flags

Unbranded packaging; unclear return policy; sudden model swaps.

victim impact

Financial loss; time costs; trust erosion.

Fake Invoice

description

A subtype of BEC where scammers send an organization a fraudulent invoice or bill, typically impersonating a known supplier or service provider. The invoice looks legitimate but directs payment to the scammer’s account. If accounts payable doesn’t catch it, the company pays money for goods/services never actually received.

alternative scam terms

Fake Invoice Scam; Invoice Fraud; Billing Scam

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

PDF tampering; vendor impersonation; portal access.

modus operandi

Submit fraudulent invoices or change supplier bank details to divert payment.

red flags

Bank detail changes; mismatched domains; unusual invoice timing.

victim impact

Corporate losses; operational disruption; legal exposure.

Fake Job/Recruitment

description

Fraudsters pose as recruiters or employers offering attractive jobs. They often require upfront fees for training, equipment, visa processing, or placement. Once the fee is paid, the “job” vanishes or the victim is continually strung along with no pay. In other cases, the goal is to harvest personal info (identity theft) by having applicants fill out fake job forms.

alternative scam terms

Job Scam; Employment Fraud; Recruitment Con; Work-From-Home Scam

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Fake HR domains; offer letters; overpayment checks.

modus operandi

Post bogus roles and collect fees/PII; send equipment checks and claw back funds.

red flags

Fees to get hired; messaging-only interviews; urgent acceptance deadlines.

victim impact

Financial loss; time costs; trust erosion.

Fake Tech Support Malware

description

Malware that creates alarming popups or fake infection warnings, tricking victims into calling fake “support lines.”

alternative scam terms

Tech support scamware; Scareware

infrastructure

Pop-under networks; call centers; remote access apps

tools tactics

Browser lockers; fake AV; remote admin tools

modus operandi

Pop-up/redirect claims infection → prompts call → installs remote tool → charges fee/steals data

red flags

Alarming pop-ups; phone numbers in alerts; demand for remote access

victim impact

Financial loss; device compromise

Family/Friend Impersonation

description

The fraudster impersonates a relative or friend in urgent distress (“Grandparent Scam”), e.g. claiming to be a grandchild who had an accident or legal trouble and needs money immediately. Relies on emotional pressure and often secrecy (“don’t tell others”).

alternative scam terms

Grandparent Scam; Family Imposter Scam; Friend Impersonation Fraud

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

SIM swaps; AI voice cloning (emerging).

modus operandi

Imposter claims to be relative/friend needing urgent funds (WhatsApp/‘grandparent’).

red flags

New number; urgent payment; secrecy demand.

victim impact

Financial loss; time costs; trust erosion.

Financial Statement Fraud

description

A fraud against businesses or investors wherein company insiders or scammers provide falsified financial information to mislead stakeholders. This includes fake investment prospectuses, forged financial statements, or accounting fraud to raise funds or avoid debts. Unlike other scams, this often involves an entity misrepresenting itself to investors or regulators rather than an external con artist.

alternative scam terms

Financial Statement Fraud; Accounting Fraud; Balance Sheet Manipulation

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Round-tripping; channel stuffing; cookie-jar reserves.

modus operandi

Manipulate accounts to misstate revenue/assets and mislead markets.

red flags

Odd revenue recognition; rapid auditor changes; unexplained margins.

victim impact

Corporate losses; operational disruption; legal exposure.

Foreclosure Relief

description

Targeting homeowners in financial distress, scammers promise to “save” a home from foreclosure or reduce mortgage payments for a fee. They may impersonate mortgage relief programs or attorneys. Victims pay upfront but receive no real assistance, often worsening their situation.

alternative scam terms

Foreclosure Relief Scam; Mortgage Rescue Scam; Home Loan Modification Fraud

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Fake legal filings; escrow abuse; quitclaim deed fraud.

modus operandi

Offer foreclosure rescue for upfront fees; instruct to stop paying lender; deliver no relief.

red flags

Pay first; secrecy from lender; guarantees of outcome.

victim impact

Financial loss; time costs; trust erosion.

Friendship/Trust

description

A non-romantic variant where scammers befriend victims (often elderly or lonely individuals) to gain trust over time, then fabricate a crisis or need for financial help. Similar to a romance scam without the romantic angle.

alternative scam terms

Friendship Scam; Trust Scam; Confidence Trick; Companion Fraud

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Scripted grooming; fake screenshots of profits; shared wallets.

modus operandi

Long-term rapport built as ‘friend’ before requesting loans/investments; often pivots into pig-butchering or shopping scams.

red flags

New online friend with frequent flattery; small initial loan repaid to build trust; move to bigger asks.

victim impact

High emotional harm; long-term grooming; financial depletion; isolation.

Government Grant

description

Scammers pretend to represent a government or foundation offering “free grants” or loans. Victims are told they qualify for a grant (for education, business, etc.) but must pay a processing fee or provide bank info upfront. No actual grant is given​.

alternative scam terms

Government Grant Scam; Free Money Scam; Federal Grant Fraud

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Cloned agency profiles; fake approval screenshots.

modus operandi

Imposters offer ‘government funds’ if victim pays processing or provides PII.

red flags

Requests for fees/gift cards; urgency; social media pages with few posts.

victim impact

Financial loss; time costs; trust erosion.

Government/Authority Impersonation

description

The scammer poses as a government official or agency (tax authority, police, immigration, court, etc.) and threatens or tricks the victim into paying money or revealing info under false pretenses.

alternative scam terms

Government Impersonation; Authority Imposter Scam; Police/IRS Scam

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Caller ID spoofing; look-alike domains; phishing kits.

modus operandi

Actors pose as tax, police, court or immigration to coerce payment or data.

red flags

Threats of arrest/deportation; payment via crypto/gift cards; spoofed domains/IDs.

victim impact

Financial loss; time costs; trust erosion.

Hitman/Assassin

description

The victim receives an email or message from someone claiming to be a hitman hired to harm them. The scammer demands money to call off the hit. They often include personal details (from social media or data breaches) to sound credible and invoke fear.

alternative scam terms

Hitman Scam; Assassin Scam; Death Threat Scam; Extortion by Hitman

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Bulk emailers; burner wallets; TOR email accounts.

modus operandi

Threat emails claim a hit has been ordered; payment demanded to cancel.

red flags

Crypto-only; surveillance claims; poor grammar.

victim impact

Acute psychological distress; coercion under threat; reputational risk.

Bank/Financial Institution Impersonation

description

Scammer poses as a bank or credit card company representative and claims there’s fraud or issues with the victim’s account. They phish for login credentials or convince the victim to transfer funds to a “safe” account which is controlled by the scammer.

alternative scam terms

Bank Impersonation; Financial Institution Scam; Fake Banker Call; Imposter Bank Fraud

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Smishing kits; voice spoofing; real-time phishing proxies.

modus operandi

Spoofed bank texts/calls request OTPs or push urgent transfers (APP).

red flags

OTP requests; pressure to ‘move money to safe account’; spoofed caller IDs.

victim impact

Financial loss; time costs; trust erosion.

Impersonation of Charities

description

Scammers masquerade as well-known charities or non-profits, contacting individuals for donations. They might use phone calls, emails, or door-to-door visits with false ID. Victims believe they are donating to a legitimate charity.

alternative scam terms

Charity Impersonation; Fake Nonprofit; Disaster Aid Imposter Scam

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Logo theft; spoofed caller IDs; cloned emails.

modus operandi

Use real charity’s name/logo to solicit to attacker-controlled accounts.

red flags

Look-alike domains; wrong payment rails; no tax receipt.

victim impact

Financial loss; time costs; trust erosion.

Info-Stealer Malware

description

Malware that harvests browser data, cookies, autofill information, and cryptocurrency wallet credentials.

alternative scam terms

Info-stealer; Credential stealer

infrastructure

Malware panels; Telegram bots; C2

tools tactics

RedLine; Raccoon; Vidar; Lumma

modus operandi

Infection → browser/crypto data theft → exfil → resale of logs

red flags

Unexpected logins; MFA prompts; drained crypto wallets

victim impact

Credential loss; drained accounts

Inheritance

description

The victim is contacted by someone posing as a lawyer or official, claiming the victim is heir to a large inheritance from a distant relative or unknown benefactor. The scammer requires upfront legal fees or taxes to transfer the inheritance. After fees are paid, the inheritance never materializes.

alternative scam terms

Inheritance Scam; Next of Kin Scam; Will Fraud; Estate Con

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Forged notary stamps; legal letterhead; mule accounts.

modus operandi

‘Lawyer’ or ‘executor’ claims large bequest; requests fees or PII to release funds.

red flags

Upfront legal/admin fees; secrecy; overseas estate.

victim impact

Financial loss; time costs; trust erosion.

Keylogger

description

Malware that records keystrokes, capturing sensitive information such as usernames, passwords, and credit card numbers.

alternative scam terms

Keylogger; Keystroke logger

infrastructure

C2 servers; log collectors

tools tactics

Hooking APIs; persistence via registry/services

modus operandi

Install silently → capture keystrokes/screens → exfiltrate logs

red flags

High CPU spikes; unknown processes; suspicious autoruns

victim impact

Credential compromise; privacy invasion

Kidnap (Virtual Kidnapping)

description

The fraudster calls or messages a victim claiming that a loved one has been kidnapped and demanding ransom. Often, someone in the background screams or cries to impersonate the supposed victim. In reality, no kidnapping occurred; it’s a hoax to extort money quickly under duress.

alternative scam terms

Virtual Kidnapping; Kidnap Scam; Family Ransom Scam

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Caller-ID spoof; prerecorded audio; location spoofing.

modus operandi

Caller claims your relative is kidnapped and demands immediate ransom.

red flags

Screams in background; demands secrecy; payment via crypto/gift cards.

victim impact

Acute psychological distress; coercion under threat; reputational risk.

Locker Ransomware

description

Malware that prevents access to a device or operating system by locking the screen without encrypting files.

alternative scam terms

Screen-locker; Police ransomware

infrastructure

Overlay kits; pay portals

tools tactics

Overlay windows; persistence keys; safe-mode blocking

modus operandi

Malware blocks UI with full-screen overlay demanding payment

red flags

Full-screen lock; demands prepaid card/crypto; spoofed ‘police’ branding

victim impact

Device unusable; business interruption

Lottery/Sweepstakes

description

Victims are informed (by phone, email, or letter) that they’ve won a lottery or prize (often one they never entered). The scammer claims a fee, tax, or insurance must be paid in advance to release the winnings. Once the fee is paid, no “prize” is ever delivered.

alternative scam terms

Lottery Scam; Sweepstakes Fraud; Prize Scam; Win Notification Scam

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Fake certificates; caller ID spoofing; courier fee narratives.

modus operandi

Victim told they won a prize; must pay fees/taxes first; prize never delivered.

red flags

Fees to release winnings; unsolicited contact; no prior entry.

victim impact

Financial loss; time costs; trust erosion.

Malvertising

description

Malicious online advertisements used to redirect victims to exploit kits, fake updates, or malware payloads.

alternative scam terms

Malvertising; Malicious ads

infrastructure

Ad networks; redirectors; loaders

tools tactics

Cloaking; exploit kits; fake update installers

modus operandi

Buy/compromise ad slots → deliver redirect/exploit → dropper installs malware

red flags

Unexpected downloads from ads; fake update prompts

victim impact

Infection risk; fraud exposure

Matrimonial

description

The scammer pretends interest in marriage (often via matrimonial services or cultural channels), then exploits the engagement. They may request money for wedding expenses, visas, or dowries and disappear before any real marriage.

alternative scam terms

Matrimonial Scam; Marriage Fraud; Wedding Con

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Fabricated documents; fake visas; stolen photos; romance playbooks.

modus operandi

Groom through marriage portals or social media; request funds for visas, dowry, or emergencies; disappear post-payment or conduct long-term extraction.

red flags

Fast engagement; reluctance to meet family; payments framed as cultural or immigration necessities.

victim impact

High emotional harm; long-term grooming; financial depletion; isolation.

Banking Trojan

description

Malware designed to steal banking credentials, intercept transactions, or manipulate online sessions to transfer funds.

alternative scam terms

Banking Trojan; Web-inject malware

infrastructure

Botnets; web‑inject servers; proxy panels

tools tactics

Man‑in‑the‑browser; ATS; web‑injects; VNC backconnect

modus operandi

Infection → credential theft → web‑inject to alter sessions → mule accounts

red flags

Unexpected MFA prompts; odd overlays; transfers user didn’t initiate

victim impact

Unauthorized debits; account lockouts

Nigerian Letter (419)

description

Unsolicited emails or letters from a person claiming to need help transferring a large sum of money (e.g. a government official, businessperson, or royal figure who cannot use their own name). The victim is promised a hefty share for assisting, but must send advance fees for legal or transfer costs. Multiple fee requests follow; in reality, there is no pot of money.

alternative scam terms

Nigerian Letter Scam; 419 Scam; Advance Fee Fraud; Prince Scam

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Form letters; seals; mule recruitment.

modus operandi

Advance-fee tale offering large transfer; victim pays ‘legal/customs’ fees repeatedly.

red flags

Secrecy requests; improbable inheritances; foreign officials involved.

victim impact

Financial loss; time costs; trust erosion.

Online Shopping/Non-Delivery

description

Fraudsters post fake product listings (on e-commerce sites, classifieds, or social media) for goods that don’t exist or are never delivered. Victims pay for items and receive nothing (or something much inferior).

alternative scam terms

Online Shopping Scam; Non-Delivery Scam; E-commerce Fraud

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Templated shopfronts; brand cloning; paid ads.

modus operandi

Fake webshops or sellers take payment and never ship goods.

red flags

Too-good pricing; new domain; only bank transfer; no company details.

victim impact

Consumer loss; delivery failure; chargeback disputes.

Pet Scam

description

Fraudsters advertise pets (commonly puppies or other in-demand animals) for sale online. Victims pay for the pet (and often bogus shipping or insurance fees), but the pet is never delivered because it never existed.

alternative scam terms

Pet Scam; Puppy Scam; Animal Sale Fraud

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Fake courier emails; vaccination papers; pedigree forgeries.

modus operandi

Fake breeders take deposits for non-existent pets; add ‘shipping/insurance’ upsells.

red flags

Rare breeds cheap; shipping-only; stock images; refusal to video call with the animal.

victim impact

Consumer loss; delivery failure; chargeback disputes.

Phishing (Email Fraud)

description

Mass-distributed fake emails that appear to come from trusted organizations (banks, email providers, e-commerce sites, etc.) and trick recipients into clicking malicious links or divulging login credentials and personal data. The scammer then uses that data for identity theft or account takeover.

alternative scam terms

Phishing; Email Fraud; Credential Harvesting; Spear Phishing

infrastructure

Phishing kits; spoofed domains; VoIP; SMS gateways

tools tactics

Phishing kits; reverse proxies; DMARC spoofing; QR phishing.

modus operandi

Emails mimic trusted brands to harvest credentials or push malware.

red flags

Look-alike domains; urgent tone; mismatched links.

victim impact

Identity theft; unauthorized transfers; service lockout.

Pig Butchering (Romance + Investment)

description

A hybrid scam where the fraudster nurtures a romantic relationship and then persuades the victim to invest in a fake cryptocurrency or trading scheme. The scammer often directs the victim to phony investment apps or sites, fleecing them of large sums.

alternative scam terms

Pig Butchering; Crypto Romance Scam; Slaughter Scam; Investment Grooming

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

White-label fake exchanges; domain farms; on-chain layering; Tether rails.

modus operandi

Long-con grooming; move victim to off-platform chat; fake brokerage; show paper profits; demand ever-larger deposits; block withdrawals.

red flags

Unsolicited ‘wrong-number’ text; rapid move to WhatsApp; high-yield crypto trading; tax/fee to withdraw.

victim impact

High emotional harm; long-term grooming; financial depletion; isolation.

Ponzi Scheme

description

A fraudulent investment scheme where returns to existing investors are paid from new investors’ funds rather than legitimate profit. Collapses when new funding dries up.

alternative scam terms

Ponzi Scheme; Investment Pyramid; High-Yield Investment Fraud

infrastructure

Social media campaigns; fake dashboards; shell firms

tools tactics

Referral bonuses; fake dashboards; forged statements.

modus operandi

Promise outsized returns; pay old investors with new deposits; collapse when inflows slow.

red flags

Guaranteed returns; no audited financials; pressure to reinvest; opaque strategy.

victim impact

Large financial losses; retirement fund impact; repeated re-victimization risks.

Procurement Fraud (Supplier)

description

Scammers trick a company’s procurement or finance department by posing as a legitimate supplier or contractor. Payments intended for the real supplier are diverted to the impostor, sometimes involving collusion and substandard goods.

alternative scam terms

Procurement Fraud; Supplier Scam; Vendor Fraud

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Shell vendors; falsified quotes; rotated bids; split POs.

modus operandi

Deception or collusion in tenders, kickbacks, substitutions, or false invoicing.

red flags

Single-bid tenders; repetitive awards; vendor conflicts of interest.

victim impact

Corporate losses; operational disruption; legal exposure.

Pump-and-Dump

description

A manipulative securities fraud where scammers spread false or exaggerated information to inflate (“pump”) a stock or crypto price, then sell (“dump”) their holdings at the high price before the price.

alternative scam terms

Pump-and-Dump; Stock Promotion Scam; Market Manipulation Fraud

infrastructure

Social media campaigns; fake dashboards; shell firms

tools tactics

Signal groups; paid shills; wash trading; airdrops.

modus operandi

Coordinate hype; inflate price/volume; insiders dump; victims left with illiquid asset.

red flags

Thin-liquidity tokens/stocks; sudden Telegram/Discord hype; anonymous devs.

victim impact

Large financial losses; retirement fund impact; repeated re-victimization risks.

Pyramid Scheme

description

An illicit investment fraud in which participants pay to join and earn money mainly by recruiting new members. New members’ fees pay the earlier. Eventually collapses when recruiting fails.

alternative scam terms

Pyramid Scheme; Chain Referral Scam; Endless Chain Scheme

infrastructure

Social media campaigns; fake dashboards; shell firms

tools tactics

MLM overlays; autoship schemes; paywalls.

modus operandi

Recruitment-driven pay; rewards from new join fees/products rather than sales to real customers.

red flags

Emphasis on recruitment; inventory loading; income claims; complex compensation plans.

victim impact

Large financial losses; retirement fund impact; repeated re-victimization risks.

Ransomware

description

Malicious software that encrypts files, systems, or networks and demands payment (usually in cryptocurrency) for decryption keys.

alternative scam terms

Ransomware; Crypto-locker; File-locker

infrastructure

C2 servers; encryptors; data leak sites; anonymized comms; crypto wallets

tools tactics

Cobalt Strike; PsExec; Mimikatz; domain enumeration; lateral movement; data exfiltration

modus operandi

Initial access (phish/RDP/exploit) → payload executes → encrypts files/shares → ransom note with crypto wallet

red flags

Encrypted extensions; ransom note files; mass file renames; unreachable backups

victim impact

Operational shutdown; data loss; regulatory exposure; ransom payments

Boiler Room

description

High-pressure selling of worthless or non-existent investments (stocks, bonds, etc.) by fraudsters often operating from call centers (“boiler rooms”). Victims are cold-called and persuaded to invest in fake opportunities.

alternative scam terms

Boiler Room Scam; Cold Call Investment Scam; High-Pressure Sales Fraud

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Spoofed caller IDs; scripted call trees; fake prospectuses.

modus operandi

High‑pressure cold calls pushing worthless or non‑existent investments.

red flags

Unsolicited calls; urgency; pressure to transfer now; off‑market opportunities.

victim impact

Large financial losses; retirement fund impact; repeated re-victimization risks.

Real Estate Sale

description

Fraud involving the sale of property the scammer doesn’t own. For example, a fraudster may “sell” someone’s house by forging title documents, or offer land/property that either doesn’t exist or isn’t actually for sale. Buyers pay money or down payments and later discover the sale was illegitimate.

alternative scam terms

Real Estate Scam; Property Sale Fraud; Housing Scam

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Deepfake IDs; notarization fraud; email compromise.

modus operandi

Impersonate owner or falsify title to sell property; divert escrow funds.

red flags

Remote-only seller; last-minute bank detail change; title irregularities.

victim impact

Financial loss; time costs; trust erosion.

Recovery Scam

description

A secondary scam where criminals contact prior scam victims while posing as law enforcement, lawyers, or “asset recovery” agents, offering to help recover lost money for an advance fee. They take the fee and do nothing.

alternative scam terms

Recovery Scam; Asset Recovery Fraud; Refund Scam; Funds Retrieval Con

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Cloned regulator logos; fake legal letters.

modus operandi

Approach prior victims offering fund recovery for upfront fees or access.

red flags

Pay before recovery; pressure; no contract; fake testimonials.

victim impact

Financial loss; time costs; trust erosion.

Remote Access Trojan (RAT)

description

Malware that provides attackers with full remote control of the victim’s device, enabling spying, data theft, and further malware deployment.

alternative scam terms

RAT; Remote admin malware; Backdoor

infrastructure

C2 servers; remote desktop tools

tools tactics

DarkComet; NetWire; Agent Tesla; njRAT

modus operandi

Covert install → C2 beacon → remote control, data access, lateral movement

red flags

Mouse moves on its own; unknown connections; AV disabled

victim impact

Full device compromise; data theft

Rental Listing

description

Scammers post false advertisements for apartments, homes, or vacation rentals (often copying real listings). They lure prospective tenants with attractive prices and stories, then ask for upfront payments (security deposit, first month’s rent) to secure the rental. After payment, the supposed landlord disappears – there was no actual rental available.

alternative scam terms

Rental Scam; Fake Apartment Listing; Housing Lease Fraud

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Stolen listing photos; forged IDs; fake tenancy agreements.

modus operandi

Advertise property not owned/available; collect deposits without viewings.

red flags

No physical viewing; below-market rent; urgency for deposit.

victim impact

Consumer loss; delivery failure; chargeback disputes.

Reshipping/Package Mule

description

A fake job where individuals are “hired” to receive packages (often fraudulently purchased goods or contraband) and forward them to another address, sometimes overseas. The scammers claim you’ll be paid for each package processed. In reality, victims may be unwittingly trafficking stolen goods or money; the promised pay never materializes.

alternative scam terms

Reshipping Scam; Package Mule Scam; Parcel Forwarding Fraud

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Drop addresses; label spoofing; reship portals.

modus operandi

Recruit mules to receive and forward goods bought with stolen cards/ATO.

red flags

"Logistics agent" WFH offers; keep a cut; use personal address.

victim impact

Financial loss; time costs; trust erosion.

Romance

description

A scammer creates a false identity to establish an online romantic relationship with the victim via dating sites or social media. Once emotional trust is built, they request money (for emergencies, travel, etc.) under false pretenses.

alternative scam terms

Romance Scam; Catfishing; Love Fraud; Sweetheart Scam; Dating Scam

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Scripted playbooks; fake exchange portals.

modus operandi

Groom on dating/social apps; fabricate crises; request money or crypto.

red flags

Rapid intimacy; refusal to meet; investment ‘opportunities’.

victim impact

High emotional harm; long-term grooming; financial depletion; isolation.

Sextortion

description

The scammer blackmails the victim by threatening to release sensitive or sexual images/video of them unless a ransom is paid. This may follow an online romance/enticement where the victim was tricked into sharing intimate content, or be a mass phishing email claiming the victim was recorded on their webcam.

alternative scam terms

Sextortion; Webcam Blackmail; Sexual Blackmail Scam

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Compromised accounts; deepfake nudes; webcam recording.

modus operandi

Coerce payments by threatening to release intimate images or fabricated evidence.

red flags

Immediate threats; payment in crypto/gift cards; spoofed evidence.

victim impact

Acute psychological distress; coercion under threat; reputational risk; extreme cases involve victim suicide.

SIM Swap

description

A targeted identity scam where fraudsters convince a mobile carrier to switch a victim’s phone number to a SIM card in the scammer’s possession (often by impersonating the victim to customer service). This gives the scammer control of the victim’s phone number, allowing them to intercept SMS codes or calls and break two-factor authentication, leading to takeover of bank or email accounts.

alternative scam terms

SIM Swap Scam; SIM Hijacking; Mobile Number Porting Fraud

infrastructure

Insider telecom access; SIM cloning; SS7 exploits

tools tactics

Social engineering carriers; SIM-swap kits; phished carrier portals.

modus operandi

Attackers port victim’s number to new SIM to intercept OTPs and reset accounts.

red flags

Sudden loss of service; unsolicited port-out messages.

victim impact

Identity theft; unauthorized transfers; service lockout.

Smishing

description

A form of phishing via SMS texts. The victim receives a text that looks like an alert from a bank or company with a link or phone number, urging urgent action (verify account, claim prize, etc.). The link leads to a fake site that steals credentials or the number connects to scammers.

alternative scam terms

Smishing; SMS Phishing; Text Message Scam

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Smishing-as-a-service; SMS sender spoofing.

modus operandi

Texts mimic delivery firms/banks; link to phishing or request OTPs.

red flags

Short links; parcel claims; OTP prompts.

victim impact

Financial loss; time costs; trust erosion.

SMS Trojan/Billing Fraud Malware

description

Mobile malware that secretly sends premium-rate SMS messages or subscribes users to costly services without consent.

alternative scam terms

SMS Trojan; Premium SMS fraud

infrastructure

Malicious APKs; C2; premium SMS aggregators

tools tactics

Joker; FluBot variants; dropper chains

modus operandi

Malicious app installs → hidden SMS/charges → ongoing billing until detected

red flags

Unexplained carrier charges; SMS permissions for odd apps

victim impact

Recurring charges; privacy loss

Botnet-for-Hire

description

Criminal services that rent out networks of infected devices to launch DDoS attacks, spam campaigns, or credential-stuffing operations.

alternative scam terms

Botnet rental; Stresser; Booter

infrastructure

C2 servers; stresser panels; proxies

tools tactics

Mirai variants; proxy bots; SMS bots

modus operandi

Build/buy botnet → advertise access → customers run attacks

red flags

Coordinated traffic floods; bot signatures; spam bursts

victim impact

Outages; revenue loss; SLA penalties

Spyware

description

Malware that covertly monitors user activity, capturing messages, calls, keystrokes, or GPS locations.

alternative scam terms

Spyware; Stalkerware

infrastructure

Surveillance panels; covert C2

tools tactics

Pegasus-like capabilities; SMS interception; screen capture

modus operandi

Covert install → exfiltrate messages, calls, GPS → persist

red flags

Battery drain; unknown admin apps; disabled security

victim impact

Severe privacy invasion; physical risk

Tech Support Impersonation

description

Fraudsters pretend to be tech support from a well-known tech company (Microsoft, Apple, etc.), claiming the victim’s computer has a virus or issue. They request remote access or fees to “fix” a non-existent problem.

alternative scam terms

Tech Support Scam; Microsoft Call Scam; Fake Helpdesk; Windows Scam; IT Support Fraud

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

AnyDesk; TeamViewer; fake AV; browser lockers.

modus operandi

Pop-ups or calls claim device infection; push remote access; demand payment.

red flags

Unsolicited ‘virus’ alerts; pressure to install remote tools; payment in gift cards/crypto.

victim impact

Financial loss; time costs; trust erosion.

Ticket Scam

description

Scammers sell fake or non-existent tickets to concerts, sports events, flights or vacations. Victims pay (often via P2P payments) but the tickets are fraudulent or never delivered. Variations include fake vacation rentals or travel packages.

alternative scam terms

Ticket Scam; Fake Concert Ticket; Event Fraud; Resale Ticket Fraud

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

QR tampering; fake escrow; cloned listings.

modus operandi

Advertise scarce event tickets; accept payment; deliver invalid/duplicated QR or nothing.

red flags

Pressure to act fast; requests to move off platform; too-good pricing.

victim impact

Consumer loss; delivery failure; chargeback disputes.

Timeshare Resale

description

A scam targeting owners of timeshare properties. The scammer contacts an owner (or the owner responds to an ad) with an offer to help sell the timeshare for a great price. They claim to have eager buyers and ask for upfront fees (closing costs, taxes, etc.). Once fees are paid, the sale never happens and the “broker” vanishes with the money.

alternative scam terms

Timeshare Scam; Timeshare Resale Fraud; Vacation Property Con

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Fake escrow; buyer impersonation; spoofed emails.

modus operandi

Cold-call owners promising buyers; collect marketing fees; no sale occurs.

red flags

Guaranteed buyers; upfront fees; pressure to act.

victim impact

Financial loss; time costs; trust erosion.

Vishing (Voice Phishing)

description

Phishing via phone calls. Scammers call pretending to be from a legitimate institution (bank fraud department, tech support, government) and manipulate victims into revealing sensitive information (passwords, PINs) or into performing actions like transferring money. Unlike impersonation scams which seek money directly, vishing’s goal is often to obtain info for fraud.

alternative scam terms

Vishing; Voice Phishing; Phone Scam; Telephone Fraud

infrastructure

Phishing kits; spoofed domains; VoIP; SMS gateways

tools tactics

Caller ID spoofing; IVR bots; AI voice cloning (emerging).

modus operandi

Calls spoof banks/LEA; social engineer OTPs or push urgent transfers.

red flags

Caller ID spoof; secrecy; remote control requests.

victim impact

Identity theft; unauthorized transfers; service lockout.

Work-from-Home & Business Opportunity

description

Scams offering easy work-from-home jobs or “be your own boss” business deals. Examples: assembly or craft work (victims pay for materials/kits but can never earn back), multi-level marketing that is essentially a pyramid scheme, or “start your own business” kits sold with false income promises. In all cases, victims invest money for little or no return.

alternative scam terms

Work-from-Home Scam; Business Opportunity Fraud; Job-from-Home Con

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Course funnels; affiliate stacks; pay-to-play groups.

modus operandi

Sell ‘opportunities’ or kits that do not yield real income; continuous upsells.

red flags

Guaranteed income claims; pay for starter kit; vague client lists.

victim impact

Financial loss; time costs; trust erosion.

Cryptocurrency Scam

description

Fraudulent investment schemes involving cryptocurrency assets – for example, fake crypto trading platforms or scam tokens that vanish (“rug pull”) after taking investors’ money. Often promises of high returns via crypto markets.

alternative scam terms

Crypto Scam; Cryptocurrency Fraud; Bitcoin Scam; Altcoin Scam; Token Rug Pull

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Smart-contract drainers; fake exchanges; USDT off-ramping; QR deposits.

modus operandi

Fake investments; fake mining/staking; drainer links; rug pulls.

red flags

Guaranteed yield; wallet-connect prompts from DMs; cloned sites; no whitepaper audits.

victim impact

Financial loss; time costs; trust erosion.

Business Email Compromise (BEC)

description

A sophisticated scam where criminals infiltrate or spoof a business’s email to trick employees into sending money or data. Common tactics include impersonating a CEO or executive to request an urgent wire transfer (CEO Fraud), or pretending to be a vendor/supplier with an invoice that needs payment (Invoice Fraud). Funds are sent to accounts controlled by the scammers.

alternative scam terms

Business Email Compromise; BEC; CEO Fraud; Invoice Redirection Scam; Email Spoofing Fraud

infrastructure

Phishing kits; spoofed domains; VoIP; SMS gateways

tools tactics

Thread hijacking; MFA bypass; look-alike domains.

modus operandi

Compromise or spoof business email; alter payment instructions; divert funds.

red flags

Last-minute bank detail changes; urgent wire requests; domain look-alikes.

victim impact

Corporate losses; operational disruption; legal exposure.

Career Advancement/Education

description

Scammers offer fake degrees, certifications, or high-paying job placements upon course completion for a fee. Victims pay but receive substandard training, a fake diploma, or no job at all. Some operations are outright diploma mills selling degrees.

alternative scam terms

Career Advancement Scam; Diploma Mill; Fake Degree Scam; Education Fraud

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Diploma mills; fake accreditation seals; lead gen funnels.

modus operandi

Sell unaccredited diplomas, certifications, or sham training programs.

red flags

Guaranteed job placement; unrecognized accreditation; heavy upsells.

victim impact

Financial loss; time costs; trust erosion.

Counterfeit Goods

description

The victim buys what they believe are genuine brand-name products at a discount, but scammers send counterfeit or inferior goods. These items are fake and often violate intellectual property laws.

alternative scam terms

Counterfeit Goods Scam; Fake Luxury Scam; Replica Fraud; Knock-Off Scam

infrastructure

Fake websites; social media profiles; mule accounts

tools tactics

Template storefronts; influencer promos; dropshipping; mass parceling.

modus operandi

Operate sites or social accounts selling counterfeit branded items; goods are seized, low quality, or never shipped.

red flags

Prices too low; new domains; missing company details or returns; stock photos; wire or crypto payments.

victim impact

Consumer losses; delivery failures; chargeback disputes.