How to identify a scammer

Do you know how to identify a scammer? Protecting yourself against scams online and over the phone takes constant vigilance. So many aspects of everyday personal, professional and financial life now take place on computers and devices.

While people and companies work hard to keep all their digital information private and encrypted, scammers are always seeking opportunities to trick people into revealing anything that can give them a way in. And scammers continue to be fairly good at it. In 2024, the FBI's Internet Crime Complaint Center reported receiving over 800,000 complaints, with total losses due to cybercrime exceeding $12.5 billion, a 22% increase from the previous year.

Knowing what to watch for is one of the smartest ways to prevent it from happening. Here's how to identify a scammer and what you can do to keep your personal and financial information safe.

1. Bank imposter scams

Your bank will never call and ask you to provide confidential information, such as your username, password or one-time passcode (OTP).

However, scammers often impersonate banks or fraud departments. When calling customers, they often mask their phone number so it appears on caller ID as the actual bank. Along with requesting your personal information, scammers may also ask you to transfer funds or send a wire transfer during the call. But this is not something your bank would ever do.

If you receive a call that appears to be from your bank or the Citizens Fraud Department and you’re asked for private details, hang up. Call your bank using the number on its website or your credit or debit card, not the number provided by the suspected scammer.

2. Spotting scam links online

Email, text and chat services are classic avenues for scammers trying to get you to reveal sensitive information. It doesn't take much to create a spoof message that looks like it's from someone you know or a trusted institution.

Fake messages on their own usually aren't harmful if you don't interact with them, but they can include links — in plain sight or disguised — that start a chain of damaging actions once you click on them.

In some cases, the links direct you to a website that asks you to enter personal or financial information, such as a bank account password or your Social Security number. But clicking on links can also inadvertently authorize a malware download that may use a computer virus to copy your personal information or lock your device and demand payment to unlock it.

Once you know how to identify a scammer and a fake link, it becomes easier to distinguish harmful messages from legitimate ones. Fake links are more likely to contain:

• A misspelled name or extra characters: With URLs, getting the name nearly right is not good enough. A spammer trying to access your financial information may ask you to click on a close but incorrect name like "CitizenBank.com" (note the missing "s" in the URL) or "Citizens-Bank.com" (note the hyphen, which Citizens doesn't use). Rather than clicking the link as prompted, only visit the company directly using a website or app you know is authentic.
• Numbers in place of letters: An especially tricky maneuver scammers will use is to swap a number for a character. A zero and the letter O look a lot alike on a screen, as do the number 1, a capital I and a lowercase L in certain fonts. A scammer might try to look legitimate by sending you to "Faceb00k" or "Goog1e."
• The wrong domain: The top-level domain is the last part of a URL, like .gov, .com and .edu. A scammer pretending to be from the IRS or Veterans Administration may try to send you to "IRS.com" rather than IRS.gov or "VA.info" instead of VA.gov. The top-level domain is a marker of what kind of site you can expect to visit and should always match what the business or organization uses on its true website.

Often, a scam message will hyperlink text rather than display the phony URL, so it can be very deceptive. Hover the cursor over the link to verify that the displayed text is accurate. On a smartphone, you can usually do this by pressing down for several moments rather than tapping. This action should display the destination URL, and you'll be able to spot the scam.

If you can't determine if the link comes from a trusted source, don't click on it. Instead, contact the company or sender directly to verify the information.

3. Ignoring the phishing bait

Some messages may not use fake links but could still be trying to hook your attention and gain your trust in other ways. Phishing, for example, happens when someone prompts you to voluntarily share personal information.

If you're ever asked to provide confidential information over an email or by text message, it's usually best to refuse. Trustworthy organizations will always want your personal details to remain secure and will therefore either use a verified encrypted site, will offer their main phone number for you to call or handle it in person if possible.

Phishing scams can include senders posing as charities, credit card companies or financial assistance agencies. It can be hard to distinguish them from the real thing, but here are a few tell-tale signs:

• Grammar and spelling mistakes: Most phishing messages would fail a basic spell check, so keep an eye out for misspellings, misused words or grammatical mistakes. "You're response required!" or "Verefy your information" are classic examples.
• Demands for personal information: You know the drill by now. Your bank, credit card company and others will never email to ask for your password or other private information, like your Social Security number. But scammers will.
• Unusual tone: If you receive an email from a colleague that sounds abnormally casual, be wary. Scammers pretending to be from legitimate institutions may also take the opposite tactic. They'll be overly formal and a little impersonal, addressing you as "sir or madam" rather than using your name.

If you're sure it's a phishing message, you can ignore it, report it as junk or spam and delete it. You may also want to report it to the organization to let them know a scammer is at work. Just be sure to send a separate message rather than forwarding the original.

4. Impersonation calls and messages with pressure to act

Scams and phishing can take the form of a phone call as well. Callers can sound very convincing, especially now that AI can fake the voices of people you may know.

But no matter how confident they sound, no trustworthy organization will demand your personal information if they're the one who called you, especially if it was unprompted and unexpected.

Here are some pressure tactics to watch for:

• Urgency to pay with threatening consequences: Like scam emails, impersonation calls often give a false sense of urgency. The scammer may be insisting that you owe back taxes or a payment immediately or they'll close your account, cancel your benefits or take legal action.
• Request to make a payment in an unusual way: Another surefire sign of an impersonation call is a demand to make payment by unconventional means. You may be asked to send a cashier's check or money order to an address you don't know. They could suggest you pay with Bitcoin or send a pre-paid debit card. Legitimate organizations generally won't ask for payments by anything other than traditional means of paying by cash, check or credit card directly to their offices and will gladly give you a receipt or record of payment.
• Enticing quick action with a deal, prize or gift: Alternatively, these calls may be offering you good news, such as winning a prize for a contest you didn't enter. The pressure results in a request of giving account information or forfeiting the award. If you think the messages may be real, contact the company directly using a number from a verified source.

The easy solution is to hang up the phone or ignore the email. You can always call the institution directly using a trusted phone number and describe the call or message you received. They'll be able to verify if it was legitimate or not. Remember that you have a right to be cautious and secure with your personal information.

5. "Long time, no see" calls

A friend you haven't spoken to in years suddenly calls, texts or emails you, but they don't have good news to share. They're supposedly in an emergency situation — a family member is sick or they're traveling in another country and had their wallet stolen. They need money now and ask you to help by using a money transfer app.

Your first instinct may be to send them money, but tread carefully. Check with a mutual friend or relative who also knows the person. Also look at the phone number or email they're using. In many cases, scammers will have an email that looks similar to that of the person, but it will be slightly off.

6. Social media scams

The Federal Trade Commission calls social media a golden goose for scammers, and it's easy to understand why. As the famous New Yorker cartoon puts it, "On the internet, nobody knows you're a dog." It doesn't take much effort for people to pretend to be someone else online.

Social media scams can take a few forms:

• Impersonation: A scammer can hack into the account of someone you know or start a fake account and reach out to you, claiming to be that person.
• Dating: Sometimes scammers will try and start a romantic relationship, with asking for money as their ultimate goal. If a stranger adds you as a friend or starts to follow your account and then comes on strong, be cautious. Better yet, don't accept friend requests from people you don't know.
• Investment opportunities: Scammers love to reach out on social media with "amazing" investment opportunities that usually involve cryptocurrency. Often, these opportunities sound too good to be true because they usually are.

The best way to protect yourself on social media is to be suspicious of everything. Do not accept messages or friend requests from strangers. If a friend contacts you with an unusual or urgent message, reach out to them another way, such as by a phone number or email address you know to be correct, to confirm their account hasn't been hacked. Protect your account from hackers by creating a strong, unique password.

Anatomy of common scams

Scammers often use similar tactics to separate you from your personal information. They may pretend to be:

• Your bank
• A friend or relative
• A government agency
• An organization you trust

They may use the following tactics:

• High pressure, pushing you to act now
• Fake emergencies
• Offers or opportunities that sound too good to be true

They'll most likely ask you to send money using:

• A gift card
• Wire transfer
• Cryptocurrency

Some may set up fake online stores and collect your personal information through fraudulent sales.

Be cautious and trust your instincts

It's important to understand how to keep your information protected from fraudulent attacks. Overall, the best defense is to exercise caution. Take care when sharing private information and be wary of links that look unsafe. Your instinct is your best safety net.

Citizens is committed to providing resources to help you bank safely so you're made ready to spot any scams that come your way. Our dedicated colleagues can help you reach your goals securely and safely.

Learn more about cyber fraud and how to protect your personal data at our Cyber Security Center.

Download the full guide here:

Download