The previous lesson covered the shape every scam shares. This is the field guide: the costumes that shape wears most often, and the tell that gives each family away even when the story changes. Once the tell is familiar, a never-before-seen version of an old scam still feels off.
Phishing and smishing: the fake front door
Phishing (by email) and smishing (by text) try to get you to click a link or hand over a login by impersonating something you trust: a bank, a delivery service, a streaming account, your employer. The message creates a small jolt — a "failed delivery," a "suspicious login" — and the link leads to a page that looks real but exists only to harvest what you type.
The tell: a link asking you to log in or confirm details you did not request. A fake link is usually a near-miss like amaz0n-secure.com, but the deeper rule is simpler: reach your accounts yourself, by opening the app or typing the address, never through a message's link. Real notifications never depend on you clicking theirs.
The fake-check overpayment scam
This one preys on the instinct that a check in hand is money in hand. Someone "accidentally" overpays you — for an item you are selling, a job, a rental deposit — then asks you to refund the difference. Your bank may make the funds available before it discovers the forgery; when it does, it takes the money back, and the CFPB is blunt that you must repay the funds even if you have already withdrawn them. The "refund" you sent from your own money is gone.
The tell: a check sent to you plus a request to send part of it back. A genuine buyer pays the agreed amount, full stop.
Romance, investment and "pig-butchering" scams
Romance scams build a relationship — sometimes over months — through a dating app or social media, then engineer a crisis (a medical bill, a customs fee) that only money can solve. A crueler hybrid, "pig butchering," blends romance with a fake investment: the warm contact walks you through "investing" on a crypto platform and shows fake gains, until any withdrawal attempt triggers endless "fees" and the money is gone.
Plain investment scams skip the romance and lead with the returns: guaranteed profit, no risk, "get in before it's too late." The tell across all of these: a relationship or opportunity that routes to money you cannot get back, plus a promise that violates a basic rule of finance. Real investments never guarantee high returns with no risk; claiming it is itself proof of fraud.
Impersonation: IRS, bank and tech support
Impersonation scams borrow an authority's name to manufacture compliance. Three common faces:
- Government (IRS, Social Security): threats of arrest, lawsuits or a "suspended" Social Security number, demanding immediate payment. The IRS writes first and never takes gift cards.
- Your bank's "fraud department": a call claiming your account is under attack, asking you to "verify" by reading back a one-time code or to move money to a "safe account." A real bank never needs either — that move is the theft.
- Tech support: a pop-up or call warning your computer is infected, asking for remote access or payment to "fix" it. Real companies do not cold-call about your device.
The shared tell: an authority contacting you out of the blue and asking for secrecy, remote access, a one-time code or an unusual payment. It is proven real only by you calling the official number, never by anything the caller says.
Job and employment scams
These exploit hope and the awkwardness of onboarding. A "remote job" or "mystery shopper" role hires you fast, then sends a check to "buy equipment" (the fake-check scam in a work badge), asks you to process payments through your own account (making you a money mule), or requests your bank and Social Security details before any work exists.
The tell: a job that pays you before you have worked, asks you to move money, or wants sensitive details up front. Legitimate employers collect tax and direct deposit details after a real hiring process, never as the opening move.
The families are few and their tells are stable. When a new story appears, the useful question is not "have I seen this exact one?" but "which family is this, and what is its tell?" Report any of them at IdentityTheft.gov or the FBI's IC3, even if you lost nothing. The next lesson moves from spotting scams to the layered protections that make your accounts hard to crack in the first place.