How to spot an online scam

Author: Adam Birchall

Last updated: 24 January 2020

Online scams are a billion pound industry in the UK. Their number, type and sophistication are growing all the time.

You don't have to fall victim, though. So long as you know what to look for, and how to avoid them, you can go a long way towards keeping yourself - and your bank account - safe. Here's how to spot scam emails and websites.

• It doesn't look professional. Typos and general bad English are a common sight in many online scams, and are an immediate warning that something is off.
• It demands urgent action. A lot of scam emails try to frighten you into acting quickly, without thinking about what you're doing. These are often security-related - your Google account has been compromised, or the Inland Revenue is about to take you to court for an unpaid tax bill, and so on.
• The contact was unexpected. Most email scams are not targeted, they're sent to thousands of people in the hope that someone will be snared. If you receive an email out of the blue, treat it with caution, or just delete it. Similarly, companies are unlikely to contact you by tracking you down on WhatsApp or some other random service.
• They request personal information. No reputable business will ever ask you for sensitive personal information, especially bank details, passwords or PINs in an email.
• The deal's too good to be true. The old adage: if a deal sounds too good to be true, it probably is. Don't be tempted by offers of free money, even if it's a tax rebate - a common scam itself.
• They ask for unusual payment methods. You get a layer of protection when you pay for something by credit card or through a service like PayPal. Being asked to pay in an unusual way - through a bank transfer, bitcoin or even iTunes vouchers - is an immediate red flag.
• It contains threats. Not all scams try to convince you they're innocent. Some are open attempts at extortion. An email might claim your webcam has been hacked and you've been spied on (spoiler alert: it hasn't). It might mention one of your old passwords or part of your phone number to make you feel even more vulnerable. Don't worry, most likely this has been leaked by some other service that was hacked and is now freely available online. Delete and move on.

How to avoid being scammed

Knowing what to look out for is the first step towards avoiding falling victim to a scam. On top of that there are a number of other steps you can take to keep yourself safe.

First of all, be suspicious. Simply being aware of the prevalence of online scams should help you continually question the emails you receive and the websites you visit. Don't give out passwords, PINs or other sensitive information because genuine companies will never ask for it. Keep an eye out for topical scams as well. When the holiday firm Thomas Cook went bust recently, a bogus website sprung up claiming to be able to help customers claim back their money.

Also, watch out for scams that start offline. While you're looking out for dodgy emails and websites, it's easy to be thrown off guard by approaches you weren't expecting. This could be a call from someone claiming to be from your broadband provider, or from Microsoft tech support, or from Amazon, or Visa. Or a text message from a courier asking you to re-arrange delivery of a package. All of which will lead you to either hand over your credit card details, or install remote access software that gives a scammer control of your computer. These can be extra hard to spot because caller ID can be spoofed to make it look as though the call is genuine.

Try to verify who has sent an email by looking at the address in both the From and Reply To fields, and also check the URL of any websites you visit. When you visit important sites like your bank, type the address directly into your browser or use a bookmark rather than clicking a link.

And try and use reputable sites when you're shopping, or at least check online reviews of a business before you hand over any money. There's a growing market for ticket scams, where a slick-looking website sells high priced concert tickets that don't actually exist.

Above all, exercise good PC health. Use anti-virus software (some broadband providers offer this for free). Don't re-use passwords. Check your online accounts regularly for any suspicious activity. Don't share too much personal information on social media, and restrict who can see it. And if you do encounter an attempted scam, always report it.