We3volution
Threat Directory
Use this page when you want to check something specific. Each card is a short description of a tactic you may already be seeing.
It is not a complete list. New versions appear all the time. The four-step pattern on How scams work still applies.
Fake celebrity giveaways
A famous person telling you to send crypto to get more back.
What's going on:
A video or post is used to look like an official promotion. You are asked to send funds first. Nothing genuine comes back.
The clues:
Send-first reward. Comments locked. Video that feels off.
What to do:
Do not send crypto or connect a wallet. Treat deposit-matching giveaways as fake.
Fake support accounts
“Helpdesk” accounts that message you first after you post a problem.
What's going on:
Someone pretends to fix a wallet or exchange issue. They steer you into a private chat, a link or a screen share. The aim is a password, seed phrase or approval.
The clues:
They contacted you. They want a seed phrase, keys or a screen share.
What to do:
Close the chat. Open the official app from your home screen. Real support does not need your seed phrase.
Fake parking-fine texts
A text claiming an unpaid parking charge and a link to pay.
What's going on:
The sender copies a council, RingGo, Parkingeye or similar. The page takes payment details. Those organisations do not collect surprise fines only by text.
The clues:
A fine you do not remember. A tight deadline. A link to “view your session.”
What to do:
Do not pay from the text. Check the official app or website you already use.
Fake “new number” family texts
A text or WhatsApp from an unknown number saying a child has a new phone and needs you to save it - then later asks for money.
What's going on:
The first message looks harmless. If you reply or save the number, a second message often follows: a bill, a broken phone, or an urgent transfer. The “new number” story is there so you do not use the number you already trust.
The clues:
“Hi Mum” or “Hi Dad” from a number you do not know. A request to save the number. A money ask soon after. They avoid a live call to the old number.
What to do:
Do not save the number or send money. Call your family member on the number you already have. Forward the text to 7726.
Account-lock texts
A text saying Apple, Microsoft, PayPal, Amazon or Netflix will lock your account unless you verify now.
What's going on:
The link copies a login page. If you sign in there, the account can be taken over.
The clues:
A service you use. A threat of closure. A link, not the official app.
What to do:
Open the real app from your home screen. Do not use the link in the text.
Fake family emergency calls
A call that sounds like a relative in trouble and asks for money or codes immediately.
What's going on:
Someone on the phone claims there is an accident, arrest or other crisis. They may sound like a person you know. They want a transfer, gift cards or a security code before you can check.
The clues:
Unknown or odd caller ID. Pressure to stay on the line. A request for irreversible payment.
What to do:
Hang up. Call that person on a number you already have saved.
Dangerous wallet approvals
A site that looks like a login but asks your wallet to allow token transfers.
What's going on:
Connecting can just show your public address. Signing can give a contract permission to move tokens. That is the step that causes the loss.
The clues:
The wallet window talks about allowances or moving tokens, not a simple connection.
What to do:
If you cannot explain the request, reject it and close the tab.
Fake investment websites
A dashboard that shows profits, then blocks withdrawals until you pay more.
What's going on:
The numbers on screen can be invented. Extra “tax,” “fees” or “verification” payments are used to take more money. There is often nothing real to withdraw.
The clues:
Guaranteed returns. You must deposit more before you can take money out.
What to do:
Stop sending funds. A screen can show any balance.
Look-alike payment addresses
An address that matches the start and end of one you use, or a paste that changes.
What's going on:
Long addresses are easy to skim. A surprise transfer in your history, or a changed paste, can send funds to the wrong place.
The clues:
Familiar first and last characters, different middle. The pasted address does not match what you copied.
What to do:
Check the whole address. Copy from a saved contact, not the last line in your history.
Fake marketplace sales
An advert for a car, phone, ticket or rental. You pay. The item never arrives.
What's going on:
The listing looks local and cheap. Payment is pushed off-platform or “to hold the item.”
The clues:
A price well below the market. Pressure to pay now. Refusal to use the platform’s own checkout.
What to do:
Do not pay outside the platform. If it feels rushed or too cheap, walk away.
Unexpected QR codes
A code in an email or text that hides a website you cannot read first.
What's going on:
The code is treated like a link you cannot inspect easily. Scanning it can open a clone site or a page that asks for a login or wallet approval.
The clues:
A picture of a QR code instead of a normal link. Pressure to scan it now.
What to do:
Do not scan a QR code from an unexpected message. Check the official app yourself.
Unexpected tokens and NFTs
An asset you did not ask for, with a link to claim or sell it.
What's going on:
Anyone can send a token to a public address. The danger is not receiving it. The danger is visiting the linked site or approving a transaction.
The clues:
A surprise token. A website in the name or image. A “claim” or “sell” instruction.
What to do:
Leave it alone. Do not claim, swap or follow the link.
Recovery scams
After a loss, someone offers to get the money back for a fee.
What's going on:
The offer targets people who already feel desperate. The “investigator” or “agent” cannot recover the funds. The fee is a second loss.
The clues:
Contact after a scam. Pay first. Big promises.
What to do:
Do not pay. Use the official reporting routes on the Stay Safe page.
Fake ads in search results
Paid results that copy a bank or wallet site.
What's going on:
The top result can be an advert for a look-alike site. If you sign in there, you may hand over a password or recovery phrase.
The clues:
A “Sponsored” or “Ad” label. A web address that is slightly wrong.
What to do:
Do not use the first ad for a financial service. Use a bookmark or type the address.
Fake crypto tax bills
A message saying you owe tax on crypto and must pay or connect a wallet now.
What's going on:
The sender pretends to be a tax authority. The link leads to a look-alike page that asks for payment or a wallet connection. Real tax offices do not collect overdue crypto tax that way.
The clues:
Threats of fines or frozen funds. A request to pay in crypto. A “government” page that wants a wallet connection.
What to do:
Close the message. Sign in to the official tax site yourself.
Fake tools, VPNs and virus scans
A free VPN, virus scan, AI helper or browser extra that is not what it claims.
What's going on:
The listing looks helpful. After you install it, the tool can read what you type, watch the sites you visit, or ask for permissions it does not need. Some copies of known VPN or antivirus brands are only look-alikes. Some start useful, then change later.
The clues:
A pop-up saying your device is infected. A “free unlimited VPN.” An AI or coupon add-on from an unknown publisher. Permissions for the whole browser, your files, or every site you open.
What to do:
Install only from the official site of a name you already trust. Check the publisher, reviews and permissions. Do not install from a scare pop-up or a search ad.
Fake job offers
High pay for easy remote work, then a request for crypto or a file to install.
What's going on:
The “job” is a way to get payment, personal details or software onto your device. Real employers do not charge you to start.
The clues:
Pay-to-start. Crypto fees. A task file from outside an official store or challenge on GitHub.
What to do:
Do not pay. Do not install unexpected files. Do not interact with code on GitHib.
Fake delivery and parcel texts
A text saying a parcel is held, needs a fee, or must be rebooked.
What's going on:
The message copies Royal Mail, Evri, DPD, Amazon or similar. The link goes to a page that takes card details or asks you to install something. Couriers do not collect random fees by surprise text.
The clues:
A parcel you were not expecting. A small fee. A short link.
What to do:
Do not tap the link. Track the parcel in the official app. Forward the text to 7726.
QR overlays on machines and signs
A sticker or extra code on a real parking machine, charger or till that sends you to a fake app or payment page.
What's going on:
The genuine machine may have a QR code for an official app. A sticker can sit on top of it, or a second code can be added nearby. Scanning it can open a look-alike parking or payment app that takes card details or a login.
The clues:
A code that looks newly stuck on. A slightly different brand name. A page that asks for payment before you have opened the official app you already use.
What to do:
Do not scan a code on a machine or sign unless you are sure it is part of the original panel. Open the official parking or council app from your home screen, or pay at the machine itself.
Fake emails, texts and chats
Messages that look like a bank, tax office, delivery firm or workplace and push you to act now.
What's going on:
A message uses a familiar name and asks you to open a link, call a number or download a file. If you do, you may land on a copy of the real site and type a password, or you may install something harmful.
The clues:
Unexpected contact. Hidden sender address that does not match the real organisation. Urgent warning or prize. A link that does not look quite right.
What to do:
Do not use the link, number or attachment. Open the official app or type the address yourself.
Bank or police “fraud” calls
A caller says they are from your bank or the police and your money is at risk.
What's going on:
They want you to move money to a “safe account,” read out a code that just arrived, or stay on the line while you log in. Banks and police will not ask you to do that.
The clues:
A text first, then a call. Pressure not to hang up. A request for a one-time code.
What to do:
Hang up. Call the bank on the number on your card, or the police on a number you look up yourself.
Recycled social accounts
An old profile reused to make a new project look established.
What's going on:
An account with history and followers is switched to a new token, “support” role or investment story. The age of the account is meant to stand in for trust.
The clues:
Long account age, a quiet gap, then a sudden change of topic to crypto or finance.
What to do:
Scroll the old posts. Account age alone does not make a project real.
Fake social profiles
An account that copies a real person or organisation to start a conversation.
What's going on:
A name, photo or company style is copied so the chat feels familiar. The next step is usually money, codes, a wallet connection or a move to private messages.
The clues:
New account, few posts, details that do not add up, a fast friend request or a first message that is too familiar.
What to do:
Do not send money or codes. Check with the real person or company through a channel you already use.
Romance and long-game investment scams
A long online relationship that turns into an investment pitch.
What's going on:
Trust is built over weeks. Then a “platform,” “manager” or relative’s project appears. The dashboard can show profits that are not real.
The clues:
No meeting or live video. Talk moves from personal life to your money. Extra deposits to “unlock” funds.
What to do:
Speak to someone you know in person. Do not send money to someone you have never met.
Remote tech-support scams
A pop-up or call says your computer is infected and an agent must take control.
What's going on:
They want remote access, payment for “cleanup,” or help logging into a bank. Microsoft and Apple do not cold-call about viruses.
The clues:
A full-screen warning. A phone number to call. A request to install remote-access software.
What to do:
Close the browser. Do not allow remote control. If needed, take the device to someone you chose.
Fake wallet apps and extensions
Look-alike apps that ask for your recovery phrase.
What's going on:
The app copies a known brand. During “setup” or “sync” it asks for existing seed words. If you type them, the wallet can be copied.
The clues:
Wrong publisher. New listing for a well-known brand. A prompt to enter an existing seed phrase.
What to do:
Install only from the official site. Genuine apps do not need your old seed phrase to continue.
Lost signal and SIM-swap risk
Your number is moved so text codes can be intercepted.
What's going on:
If your mobile number is taken over, codes sent by text can go to someone else. Accounts that only use SMS codes are then easier to open.
The clues:
Sudden “no service.” Unexpected SIM or account-change messages from your network.
What to do:
Call the network on an official number. Move important accounts off SMS codes to an authenticator app.
Hype tokens you cannot sell
Heavy promotion of a token that buyers cannot sell.
What's going on:
Urgency and social pressure are used to get people to buy. Some of these tokens cannot be sold by ordinary buyers.
The clues:
A chart that only rises. Locked comments. Criticism removed.
What to do:
Walk away. DYOR. If the chance vanishes when you pause, it was not real.
Tampered hardware wallets
A device from a marketplace that arrives with a seed phrase already printed.
What's going on:
A hardware wallet should create new words on the device during first setup. If the words arrive in the box, someone else may already know them.
The clues:
Pre-printed recovery words. No fresh setup on first use.
What to do:
Buy only from the manufacturer. Do not use a device that arrives with words already written down or damaged packaging.
Message-app codes
A contact asks you to read out or forward a code that just arrived on WhatsApp or by text.
What's going on:
That code can let someone take over the messaging account. They then message your other contacts for money.
The clues:
A sudden code you did not request. A friend saying it was “sent to you by mistake.”
What to do:
Do not share the code. Check with the person on a different channel.
Hang-up and name-check calls
Short calls that test whether your number works, or check your name, then end.
What's going on:
The aim is to see if the number is live, or if your name matches their list. Later messages or pitches often follow.
The clues:
A ring that cuts off. “Is this [your name]?” then silence.
What to do:
Do not call strange numbers back. Do not confirm extra personal details.
Next
Understand the pattern → How scams work
About to click, install or send → Check first & DYOR
How to report → Stay Safe
This list is not complete. New versions appear all the time. If something feels urgent and you cannot match it here, pause and use Check first.