Scam identifier: three questions, and the scam gets a name

Not a checker you paste a message into. Three questions about the shape of what arrived, which is why it works on a phone call, and why nothing you received leaves this page.

The hardest moment in fraud is not recognising a scam afterwards; it is the sixty seconds while it is happening, when the story is plausible and the pressure is real. A name changes that moment, because a pattern you can name is a pattern you can step back from.

Identify it

Every pattern this tool knows, with its tell and its next step

• The family-emergency call. A panicked voice, then someone official taking over the line, then a courier or a transfer. A real emergency never forbids you to hang up and call back on a number you already have. Next: Hang up. Call the family member on the number you already have. Do not use any number the caller gave you.
• The bank fraud-team call. They already have your password and are calling to collect the one-time code, often warning you not to trust anyone else who calls. No legitimate organisation ever needs that code read back. Next: Hang up and call the number on your card. Never read out a one-time code, and never move money to a “safe account”; no such account exists.
• The technical-support call. Your device is reportedly infected and they need remote access to fix it. Nobody can detect an infection on your machine from outside it. Next: Hang up and install nothing. If you already granted access, disconnect from the network and change passwords from a different device.
• The missed-parcel fee. A small redelivery charge with a link. The fee is trivial because the card details are the actual product. Next: Do not use the link. Check the courier’s own app or website for the tracking number you already have.
• The prize or refund you did not expect. Money is owed to you and the details need confirming. Nothing legitimate requires your card number to send you money. Next: Delete it. If you think a refund is genuinely due, contact the organisation through an address you already have.
• The account-suspended message. An urgent claim about an account with a link that resembles the real address closely enough to pass a glance. Next: Open the service’s own app and look for the warning there. If a password was entered, change it and change your email password first.
• The free in-game currency page. A generator promising game currency in exchange for a login. A platform never distributes its own currency somewhere else. Next: Change the account password immediately, then the email password. Turn on two-factor authentication if the platform offers it.
• The relationship that cannot video-call. Weeks of warmth, then a crisis abroad that needs money moved quickly, and always a fresh reason the camera does not work. Next: Send nothing and talk to someone you trust before acting. Reverse-search the photographs; they are usually taken from someone else.
• The investment that shows profits. A friendly introduction, a platform displaying gains, and a withdrawal that never completes. The dashboard is part of the product. Next: Stop paying in. Contact your bank, and report it: this category accounts for the largest reported losses.
• The credential-harvesting email. A login page that looks right, reached from a message rather than from an address you typed yourself. Next: Change the password there and anywhere you reused it, email account first. Then turn on two-factor authentication.
• The unexpected invoice or subscription renewal. A charge you do not recognise, with a number to call to cancel it. The call is the scam, not the invoice. Next: Do not call the number. Check the account or card statement directly for the charge; if it does not exist, delete the message.

How it decides

Three answers — how it arrived, what it claimed to be, and what it asked for — are matched against a fixed table of known scripts. There is no model and no guessing, which means the same three answers always produce the same result and the tool never invents a category to fill a gap.

Where the combination does not match a named script, it says so and falls back to the three tests that apply to everything: manufactured urgency, a request for secrecy, and an action that cannot be undone. Almost nothing gets past all three.

Why naming the pattern helps more than a warning

General advice to be careful does nothing under pressure, because the whole design of these scripts is to make the next thirty seconds feel urgent. A named pattern works differently: it converts an unfolding situation into a recognised one, and recognition is what restores the second thought.

It also removes the shame, which is the reason so many of these cases stay quiet for weeks. Being caught by a rehearsed script that is tested on thousands of calls is not a character flaw, and seeing the thing you received described as a known type makes that obvious.

The rule behind all of them

Every pattern in the table can be interrupted by one sentence: nobody legitimate objects to you hanging up and calling back on a number you already have. Not a bank, not the police, not a courier, not a family member.

That is worth agreeing as a household rule in advance, because it needs no judgement in the moment and no knowledge of which script is running. A caller who resists it has answered the question for you.

If money has already moved

Call the bank or card issuer first, on the number from your card, and use the words “I think I have been defrauded”; that phrase starts the right process. Keep every message, number and name; do not delete anything. Change the password on anything you gave details for, starting with the email account.

Then report it, and tell one person in the family. The scripts rely on embarrassment to buy time for a second attempt, which is common; the fuller sequence is on the grandparents’ page.

Sources

• Canadian Anti-Fraud Centre · checked 2026-09-02