If money has just left your account, stop reading and call your bank's fraud line now. Then report it — in the US at ic3.gov. Speed is the single biggest factor in getting money back. The FBI's Recovery Asset Team froze $679 million of $1.16 billion in attempted fraudulent transfers in 2025, and almost all of those were reported quickly.
If you have time to read, here's what's happening and how to recognise it.
The big ones
Investment and crypto scams
The largest category of loss by a wide margin: $8.65 billion reported to the FBI's IC3 in the US in 2025.
How it works: someone contacts you — a dating app, a "wrong number" text that turns into a friendly conversation, a social media message. Over weeks they build a real relationship. Eventually they mention an investment that's been good to them. You try a small amount. It shows a profit on a website that looks professional. You put in more. When you try to withdraw, there's a tax or a fee. You pay it. There's another.
The website is fake. The profits were numbers on a screen.
The tells: someone you met online who moves the conversation to private messaging; guaranteed returns; urgency; a platform you can't find independent information about; and the big one — any difficulty withdrawing.
If it's happening: stop sending money now. Don't pay the "release fee." Screenshot everything. Report it. And be aware of the follow-on: people who've been scammed are then targeted by recovery scams offering to get the money back for a fee. Same criminals, often.
Tech support scams
A pop-up or a phone call says your computer is infected. Someone helpful asks for remote access, then finds alarming problems, then asks for payment — often in gift cards, wire transfer or crypto.
$2.1 billion reported to the FBI's IC3 in 2025, and it disproportionately affects older adults.
The tell that settles it: Microsoft, Apple, Google and your bank will never phone you unprompted about a virus. A genuine pop-up from your own security software never includes a phone number.
If it's happening: hang up or close the browser — force-quit if you have to. If you gave remote access, disconnect from the internet, have the machine checked, and change passwords from a different device. If you paid, call your bank and report it.
Romance fraud
Often the front end of the investment scam above, but not always. Someone forms a genuine-feeling relationship over weeks or months, then needs money — a medical emergency, a customs fee, a business problem. There's always a reason they can't video call, or the calls are brief and odd.
The tells: they can't meet in person or won't video call properly; the story escalates; they ask you to keep the relationship private; money is requested by gift card, wire or crypto.
If someone you love is in one: approach it gently. Shame keeps people in these situations, and confrontation often pushes them closer to the scammer. Ask questions rather than issuing verdicts.
Voice-cloned relatives
A call from a grandchild, a child, a colleague. The voice is right. They're in trouble — an accident, an arrest, a stranded trip — and need money immediately, and please don't tell anyone.
A few seconds of audio from social media is enough to clone a voice convincingly. The technology is widely available and cheap.
The defence is a family rule, agreed in advance: a code word that only family members know — the household version of the callback discipline in the personal security checklist (planned reference; not yet available). If the caller can't produce it, hang up and call the person back on the number you already have. It costs nothing, and it defeats the voice-cloning attack specifically — which is the one a convincing voice would otherwise win.
If the caller is claiming to be an official — police, tax authority, immigration — the same applies. No legitimate agency demands immediate payment in gift cards or crypto. None. Ever.
Deepfaked video calls at work
The corporate version, and it's not hypothetical: in 2024 an employee at engineering firm Arup transferred roughly $25 million after a video call in which every other participant, including the CFO, was AI-generated.
The defence is procedural. Any payment or bank-detail change gets verified by calling back a number you already have on file — never a number in the request. Finance teams should have this as a written rule with no exceptions for urgency, because urgency is the attack. The business-side version is in minimum viable security.
Attempts against Ferrari and WPP executives in the same period were stopped by exactly this — someone asked a question only the real person could answer.
Sextortion
Someone claims to have intimate images or recordings and demands payment. Sometimes they do; often they don't and are bluffing from a data breach.
This is targeting teenagers heavily, and it is genuinely dangerous — young people have died.
What to do: don't pay, don't send more, don't delete anything. Report it. In the US, NCMEC's Take It Down service can help get images removed, and the FBI takes these reports seriously. If you're a young person reading this: you are not in trouble, and telling an adult is the fastest way out. The shame is the leverage. Removing it removes their power.
SIM swapping
Your phone suddenly loses service. Shortly after, accounts start getting reset — because your number, and the text codes going to it, now belong to someone else.
Prevention: ask your mobile carrier for a port freeze or number lock, and move important accounts off text-message codes to an authenticator app or a passkey.
If your phone unexpectedly loses service, treat it as an attack in progress. Contact your carrier from another phone immediately.
The four habits that prevent most of this
Never act on urgency. Every one of these scams manufactures time pressure, because pressure stops people checking. A real bank, a real agency, a real relative will wait ten minutes while you call them back.
Call back on a number you already have. Not the number in the email, the text, or the caller ID — those are trivially faked.
Agree a family code word. One conversation, permanent protection against voice cloning.
Nobody legitimate wants gift cards. If a payment method is gift cards, crypto, or wire to an unfamiliar account, it's a scam. There are no exceptions to this one.
Where to report
United States: ic3.gov for internet crime; reportfraud.ftc.gov for fraud; identitytheft.gov for identity theft, which also generates a recovery plan. Your bank, immediately, if money moved.
United Kingdom: Action Fraud, or Police Scotland. Your bank immediately.
Everywhere: your bank first, then your national police or cybercrime reporting service.
Report even if you didn't lose money, and even if you feel foolish. These are professional operations run at industrial scale — one network dismantled by US authorities in October 2025 had defrauded Americans of more than $16 billion and was staffed partly by trafficked workers. You were targeted by an industry. Reporting is what builds the case against it.
If someone you know has been caught
Lead with support, not judgment. Victims who feel judged stop talking, and isolation is exactly what the scammer needs.
Help them with the practical steps: bank, report, screenshots, passwords changed from a clean device, credit freeze if identity data was exposed. Then watch for the recovery scam.
What to do next: Agree a code word with your family this week. It takes one conversation and it's the single most effective thing on this page.
Related: The 20-minute personal security checklist (planned reference; not yet available) · Protecting older relatives online (planned reference; not yet available) · What to do after a data breach (planned reference; not yet available)
Sources: FBI IC3 2025 Annual Report (Apr 2026) — loss figures by category and Recovery Asset Team results. US Treasury and Department of Justice — October 2025 action against the Prince Group scam network. FTC — consumer fraud reporting and guidance. NCMEC Take It Down. Hong Kong police and company statements — Arup deepfake case, 2024. UK Action Fraud.