Chances are you know somebody who has been scammed online -- assuming you haven’t been a victim yourself. As cybercriminals have gotten more sophisticated with their tactics, falling prey to a scam has almost become a rite of passage, whether it’s a case of identity theft or a quick cash grab.

Last year alone, consumers lost over $12.5 billion to fraud, according to Federal Trade Commission data released earlier this year. That’s a 25% jump over the year before.

So what scams are people still falling for? Lots. Fraudsters try to separate you from your money and personal information using many clever tactics. We asked cybersecurity experts for advice on how to spot, report and protect yourself from each of the most common types of scams circulating today.

Common scams: How to spot and avoid them

Social media takeover

How it works: It’s perhaps unfair to say that anyone falls for a social media takeover scam, since often a criminal has guessed or stolen your password and suddenly they’re pretending to be you on Facebook, LinkedIn or another social media site. In these cases, you often have no idea it has even happened until somebody you know is nice enough to point it out to you.

But social media accounts being taken over is currently the top threat for consumers, according to the Identity Theft Resource Center. An estimated 35% percent of the public has had this happen to them in 2025, up from 29.4% in 2024, per the ITRC. Or, put another way, impersonation scams in general (such as somebody on the phone pretending to be a family member and asking for bail money) shot up 148% in the last year, according to the ITRC.

If somebody does take over your social media account, that could be bad for you -- and your friends and family. If your social circle is chatting with “you” and has no idea that it’s a hoodlum halfway around the world, they may feel perfectly comfortable sharing their personal information.

Red flags: Does your father, uncle, friend or whomever is reaching out to you over social media seem a little off? Maybe they're using a turn of phrase that they never use or what they’re asking you for is unusual. Are they asking for some personal information, fast? If you’re about to hand over some personal data to that family member, like your “dad” who says he needs your Social Security number right now for his tax forms, and you feel anxious or rushed, that should make some alarm bells go off. (If it really is your dad, he’s going to be proud of you for taking the step of calling him to see if he really did ask you for your Social Security number.)

How to protect yourself: A password manager can invent and organize passwords for you, so a crook can’t guess and then steal your social media account. But protecting yourself from the criminals who have hijacked a family member or friend’s social media account mostly involves you being self-aware about how thieves trick people out of their money.

“Scams work because they target people, not systems,” says Clyde Williamson, senior product security architect at Protegrity, a data security company headquartered in Stamford, Connecticut. “They use bits of real information, often gathered from data leaks, public records or social media, to build trust. Scammers understand how to manipulate your relationships and emotions to get you to act quickly before you think. When someone seems to know who you are, where you work or who your family is, it lowers your guard.”

Job and employment scams

How it works: The job opportunity may come through a text, an email, a phone call or perhaps a message over LinkedIn (or you might go to the crook, answering a classified ad that looks real enough but isn’t). But there are scammers who want to hire you -- or rather, they act like they do.

Their goal is to get you to offer up typical documents that you often do have to furnish to get work, such as a picture of your driver’s license, Social Security number and checking account number (so you can be paid via direct deposit). Then, of course, if the scam works the way it’s designed to, you’ll pay the money and then never hear from the “employer” or “job recruiter” again.

Red flags: First of all, if an employer or job recruiter reaches out to you by text with an unsolicited employment offer, that should ring a few bells. How often do employers and recruiters really do that? (Hint: never.) Secondly, if you’re being asked to furnish payment documentation before you’ve really discussed the job or done an interview, run.

How to protect yourself: Only apply for jobs at companies you know and trust or -- because, yes, there are a lot of perfectly good small startups and mom-and-pop companies worth working for -- at businesses you have thoroughly researched.

Focus on writing the best resume you can and job networking, and if anyone approaches you about a job, do your own independent research on them. Be more than a little cynical about anyone who pops up out of nowhere with a dream job offer.

Lottery and prize scams

How it works: Essentially, these scams work by convincing you that you’ve won the lottery -- and all you have to do is provide some personal information, such as your checking account number, so you can receive your money. Or you might be asked to pay some cash upfront for the lottery’s taxes before you can claim your prize.

It’s hard enough to win reputable, actual lotteries. But with a lottery prize scam, you’re guaranteed to lose big (that is, as much money as the scammer can trick you out of). AI in particular has helped scammers create legitimate-seeming notices and social media direct messages.

The lottery “company” may even send you some money to prove that they’re on the up and up, says Darren J. Mott, co-founder and director of cyber operations at Five Eyes LTD, a cybersecurity firm that protects businesses’ logistics.

Mott says he once spoke to a woman who was convinced she won a lottery and kept getting cash sent to her in small, incremental amounts.

“Each time, she thought she was one step closer to getting the money,” Mott says, and so the woman kept agreeing to wire money to the lottery company in order to get prize winnings. She lost $200,000, Mott says.

Red flags: The good news is that the red flags are easy to spot. But it takes some willpower because it’s really tempting to think, “What if these guys are real? I don’t want to miss out on winning money.” But if you're being told that you’ve won a lottery that you didn’t enter or have never heard of, your skepticism should go way up.

The Federal Trade Commission says there are three major red flags: 1) You’re being asked to pay money to get your prize. Even if the reasons sound plausible -- you’re paying for shipping and handling the bedroom suite you just won -- it’s a scam. 2) You have to pay to improve your odds of winning. Uh, no. 3) You’re being asked to give your personal information, such as a checking account number, in order to get paid. Also, no. (Look, if you’re wondering how you’ll get paid, just remember that a big, reputable organization would probably direct you to one of their retail partners to go collect your winnings in cash.)

Also, if you’re being pressured to pay money or give out personal information to win your prize, that’s another big clue that this is a scam.

How to protect yourself: Pay attention to the warning signs and only enter sweepstakes, contests and lotteries with reputable companies. Working with prize companies that have reached out to you over text or email is (ahem) a lousy bet.

You may also want to look into a data removal service. What’s that, and how can it help? Well, it may not help, but it can’t hurt. Data removal services help consumers shrink their digital footprint by removing private data from the internet, making it less likely that a data broker will sell your information to scammers.

Rental and purchase scams

How it works: These are cons in which the scammer tries to convince a victim that they can buy or rent something for a really cheap, too-good-to-pass-up price. This is a classic scam that has been around forever. In fact, in the late 1800s and early 1900s, con artists became infamous for selling the Brooklyn Bridge to immigrants. They would explain how operating the bridge was profitable but a challenge, and, hey, would you like to buy it?

Well into the 21st century, the same principles are at work. Criminals try to rent out or sell super cheap and attractive beachfront properties, for instance, and if you fall for it, you can wind up broke by giving somebody a month’s rent, a security deposit and an application fee.

Red flags: There often aren’t a lot of red flags, which makes avoiding this scam a challenge. Crooks often will take actual listings with real photos and put them on their own websites.

How to protect yourself: You can generally avoid buying or renting something that doesn’t exist or isn’t the scammer’s to sell or rent out if you do some due diligence. For instance, type the address of the property you’re interested in into a search engine and see what comes up, as suggested by the FTC’s website. If you notice that the property is owned by another rental company, you may be on the verge of being scammed.

And if you’re being asked to pay money through gift cards, cryptocurrency or a wire transfer, this is almost certainly a scam. If it is a scam, you won't be getting your money back. If you pay the “landlord” company with a credit card and it turns out to be a rip-off, you’ll be far more protected.

Romance scams

How it works: It’s a tale as old as dating sites. Even in the 1800s and early 1900s, you could read a dating classified ad in the newspaper and, if you answered the wrong ad, be scammed out of your money or your life. 

The way it typically works today is that you go to a reputable dating or social media site. You end up meeting somebody who is photogenic and charming. You fall in love, possibly because the person is feeding you AI-generated responses to your emails. Maybe you talk on the phone. You never actually meet, but don’t worry, you will, you’re told, as soon as your online love finds a way to make it to your neck of the woods or treats their ill parent.

At some point, you’ll be asked for money, possibly multiple times, to help with airfare or the funeral to care for the ill parent, but that’s OK, because you’re in love, and your significant other will pay you back when you see each other in person. Except that you’re never going to actually meet.

Mott says that he once spent an hour talking to the mother of a friend of his wife’s. She had met someone on Facebook whom she fell in love with.

“I spent an hour explaining to her the flaws on his FB profile and that he would ask her for money. She left still not believing he was anything but authentic,” Mott says.

But she realized that maybe Mott had a point when two days later he asked her for $25,000 so he could finish a project and then finally come see her.

Red flags: The obvious red flags are, hopefully, just that: obvious. If your online interest continually finds reasons to not meet, that may suggest something problematic is going on. If your new love seems to be hurrying the relationship along and professes love for you far too quickly, that may be an issue. But unfortunately, some con artists really are in this for the long haul -- they don’t move fast, and they are happy to spend a lot of time building up your trust.

How to protect yourself: Even if you search for love on the best dating apps, that won’t necessarily protect you, since criminals use those too -- although if you’re paying for a service, that might weed out a lot of them.

You really want to keep your guard up, take your time meeting a stranger online and stick to the dating apps for awhile, before, say, drifting off of them. A lot of scammers like to steer their targets to encrypted messaging apps, where they’ll leave less of a paper trail for law enforcement to study later. In other words, you have every right to be suspicious of a person acting suspiciously.

Blackmail scams

How it works: One moment you’re living your best life (or at least having an ordinary day), and the next, you’re being told by somebody over an email, text or video message that the person has sensitive information of yours that they’re going to share with the world -- unless you pay up. Sometimes they’ll say that they’ve hacked your web camera and are going to share images you surely don’t want anyone to see. In February 2025, People.com reported a 16-year-old committed suicide after a blackmailer threatened to release nude pictures of the boy to his friends and family (they were AI-generated photos; it’s unclear whether the teen knew they were fake).

Red flags: If someone threatens to reveal information about you, damage your reputation or cause you harm in any way, you're being blackmailed. 

How to protect yourself: Call the police. Maybe the FBI. If you’re a minor, tell your parents or guardian or some adult you trust -- and, yes, contact law enforcement, too. We’re not being alarmist. That’s what you do when you’re being blackmailed. However, do not panic or assume that your life is about to be ruined. That’s exactly what the blackmailer wants you to think.

That’s what blackmailers want -- for you to be freaked out. “Bad actors focus on emotions, like scarcity, fear, love, etc.,” Mott says.

Charity scams

How it works: This is another classic. A grifter tries to convince you that the money you’re about to part with is going to a good cause. They often come around the holidays but can also appear after a natural disaster or when tragedy hits the news. Sometimes these “charities” will contact you by suggesting that you pledged a donation that you actually didn’t.

Red flags: For starters, if you don’t remember pledging a donation, you probably didn’t. If the so-called charity wants you to pay with cryptocurrency or gift cards, this is a scam.

How to protect yourself: If you really want to donate, then contact the charity yourself. Find the number or website through a search engine (not from the email or text message itself) and contact the charity directly. Another thing to consider: You probably have antivirus software (in this day and age, you’d better), but a lot of antivirus software companies have introduced sophisticated scam detection features to help people better fight cybercriminals. If you haven’t updated your malware protection lately, you may want to look at the best antivirus software programs and pick one that offers tools to help you keep con artists at bay.

Expert advice: What to do if you spot a scam

If you think you've fallen for a scam or are a victim of identity fraud or theft, immediately report your case to the FTC at ReportFraud.ftc.gov and file a police report. 

We also recommend setting up fraud alerts on your Experian, Equifax and TransUnion credit reports. This way, you'll get alerted if anyone tries to access your credit file or open new accounts in your name.

If you know your data has been leaked in a breach, you may want to freeze your credit reports so that no one can open new credit accounts in your name (the downside is that you also can’t, and you’ll need to unfreeze your credit report if you need to take out a loan).

To help protect yourself from all scams, be cautious about who you share your Social Security number with. In fact, experts advise you to refrain from sharing any personal information on social media, including your email address or the names of family members. It’s also important to get antivirus software installed on your computer to fight malware. If you don’t, eventually you’re going to click on some malicious website.

Additionally, signing up for identity theft protection and monitoring services can also help you avoid identity theft in the future. These companies provide 24/7 monitoring of your credit reports, the dark web, your identity and all your financial accounts on your behalf with the goal of spotting signs of fraud before thieves can finish the job.

But, of course, those are all steps to take after you’ve been scammed, or nearly scammed. In the moment, or before a con artist ever approaches you, your best defense is to practice being calm.

“Protecting yourself starts with slowing down,” Williamson says. “If something feels urgent, take a moment before reacting.”

Williamson suggests confirming what you’re being told through a trusted source. If you’re only getting your information from one person, or perhaps even multiple people on the same phone line (sometimes scammers will trick victims by handing them over to a “manager,” who is just another criminal), then you really haven’t confirmed anything.

“Awareness and hesitation remain two of the most effective defenses against manipulation,” Williamson says. “Scammers don’t need to open a credit card in your name to cause harm. They only need enough personal details and a convincing tone to make you believe their story, and that can be enough to drain a lifetime of savings.”

And listen to your gut, Mott urges. Often, we are in cahoots with the scammer without realizing it. “Once the scam starts, the victims tend to continue on because there is a self-perpetuating need to convince themselves that this isn't a scam,” he says.