Internet fraud is deception carried out online, by email, text, phone or fake websites, to get money, credentials or personal data. Most schemes rely on urgency and trust rather than technical flaws. If you have already paid or shared a code, act in the first hour: your bank first, then reporting.
How does internet fraud usually start?
CISA's guidance on social engineering names the common channels. Phishing uses email or malicious websites to ask for personal information while posing as a trustworthy organization. Vishing does the same by voice and can use VoIP, which makes caller ID easy to spoof. Smishing uses text messages containing links, email addresses or phone numbers that can open a browser or dial a number when tapped. The same CISA piece notes attackers often exploit current events, holidays and economic worries.
The page is archived content from 2021, but the channels it describes are still how most fraud reaches people. Treat its checklist as a baseline, and add what has changed since, such as more convincing writing.
What are the warning signs?
CISA lists these indicators of phishing:
- A sender address that imitates a legitimate business by altering or omitting a few characters.
- A generic greeting and a signature block with no contact details.
- Links whose real destination differs from the text, or URLs with a different spelling or domain ending. Shortened links can hide the destination.
- Poor spelling and inconsistent layout.
- Unsolicited attachments, often paired with urgency.
Treat the spelling clue with caution now. Polished writing is cheap, so a clean message proves nothing. Two other tests are stronger: did I expect this, and does it ask me to act quickly or in secret?
CISA also advises looking for https and a closed padlock before sending sensitive data. That is a necessary check, not a sufficient one. A fraudulent site can have a valid certificate for its own name, so check the domain itself.
What does a typical case look like?
Constructed example: Tom gets a text saying a parcel is held and he must pay a small redelivery fee at a link. The link opens a page that looks like a carrier's site and asks for card details and then the one time code his bank sends. That second step is the tell. A code your bank sends is meant to approve a payment, and if you are asked to read it out or type it into a page you reached from a message, the scammer is approving a payment you did not plan.
What should you do after a loss?
The FBI's Internet Crime Complaint Center gives a clear order on its elder fraud page, and it applies to anyone:
- Contact your bank and other financial institutions to protect accounts. If wire transfers were sent, ask for a recall and a hold harmless letter as quickly as possible, which the FBI says may reduce or eliminate losses.
- Protect your credit by contacting the credit bureaus.
- Report to local authorities and file a complaint at ic3.gov. If you think your identity was stolen, also report at identitytheft.gov.
CISA adds: if you may have revealed information about your organization, tell the appropriate people inside it, including network administrators, so they can watch for unusual activity. If financial accounts may be compromised, contact the institution immediately.
Speed matters because recalls work best soon after a transfer. Do not wait until you feel sure it was fraud.
How to check or apply this
- Write down one rule for your household or team: payments and credential changes are confirmed by calling a number you already had, never one in the message.
- Turn on multifactor authentication for email, banking and work accounts. CISA lists it as an enforceable defense against phishing.
- Keep browser and email anti-phishing features on, and keep devices updated.
- Never read a one time code to anyone who contacted you.
- Keep a short incident card: bank fraud line, how to freeze cards, where to report.
- After any incident, change passwords on affected accounts from a clean device.
Quick check
What is the first thing to do after sending money to a scammer?
Call your bank right away and ask about a recall, then report the incident. Speed improves the chance of recovering money.
Does a padlock mean a website is legitimate?
No. It means the connection is encrypted to the site you are on. A fraudulent site can have one, so verify the domain name too.
Sources
- CISA, Avoiding Social Engineering and Phishing Attacks (archived)
- FBI IC3, Elder Fraud: what to do if you are targeted
Last reviewed: 18 October 2026.
