The patterns behind every scam

The individual schemes vary endlessly. The structures underneath them do not. This page is the general knowledge: the small number of shapes scams come in, the levers they pull, and how the operations are put together.

The taxonomy

Nearly every scam is one of a handful of shapes wearing a costume. Learning the shapes beats memorising costumes, because the costumes change weekly.

Other: Everything that does not fit the boxes above.
Purchase & marketplace: Goods, tickets, rentals, or pets that were never there.
Impersonation: Someone you are trained to obey: the tax office, the police, your bank, your child.
Identity theft: Your details reused to open, empty, or take over an account.
Investment: Fake returns on a real-looking platform. The highest losses per victim, by a wide margin.
Business & payments: Payment redirection aimed at the person who signs the cheques.
Charity & disaster: A disaster used as a collection tin.
Job & task: Work that costs money instead of paying it.
Tech support & remote access: A fake problem with your computer, fixed by giving away control of it.
Romance & relationship: A relationship built to be spent. Trust first, money second.
Extortion: Payment demanded under threat of exposure, arrest, or harm.

The five levers

Scams do not work because victims are stupid. They work because they apply pressure to things that normally serve people well. Five levers do almost all the work, and recognising which one is being pulled is more useful than recognising any particular story.

Authority. Someone you are trained to obey: a bank, the police, a tax authority, your employer's chief executive. Compliance with authority is normally correct behaviour, which is exactly why it is worth exploiting. The counter is not scepticism about institutions; it is a habit of verifying on a channel you chose. Institutions never lose anything when you hang up and call back.
Urgency. A window that is closing: an arrest today, an account frozen within the hour, a price that expires. Urgency removes the step where you would have checked. Nothing legitimate is destroyed by a twenty-minute delay, and treating that as a rule costs almost nothing.
Reciprocity and rapport. They helped you first, or they have been kind for two months. Obligation is the strongest of the levers and the hardest to see from inside, because it does not feel like pressure. It feels like a relationship.
Isolation. "Don't tell your bank what it's for." "Your family won't understand." "This is confidential." Secrecy is not a side effect of these schemes; it is load-bearing, because the most likely thing to stop a scam is a second person hearing about it. A request for secrecy is itself a red flag, whatever the stated reason.
Sunk cost. Once money is in, stopping means accepting the loss. Every additional payment is framed as the one that unlocks the rest, and by the time borrowed money is involved, quitting has become the expensive option. This is why the largest losses happen after the victim has already begun to suspect.

How scam compounds are organised

A large share of investment and romance fraud aimed at English-speaking countries is produced industrially, in compounds. The UN Office of the High Commissioner for Human Rights, in its 2026 report on trafficking into cyber scam operations, put the workforce at at least 300,000 people from 66 countries, with 74% of compounds still in the Mekong sub-region.

The organisational detail that matters to a reader is this: the person messaging you is usually not the person profiting, and frequently is not there voluntarily. Treasury designations describe recruitment under false pretences followed by debt bondage, violence, ransom demands to families and forced commercial sex work. Compounds operate with quotas, shift patterns, script libraries and escalation to specialists — the "manager" who appears when a target hesitates is a role, not a person.

Three practical consequences. Arguing with a scammer is arguing with someone on a quota under threat, which is why it never works. Blocking one account changes nothing, because the account is infrastructure. And the script's consistency is why the pages on this site generalise: recognising the shape of one operation's approach tells you what the next one will do.

See where they run from →

How money mules fit in

Stolen money has to land somewhere a bank will not immediately freeze. That somewhere is a mule account: an ordinary personal or business account whose holder has been recruited, deceived, paid or coerced into receiving and forwarding funds.

The recruitment usually looks like a job — "payment processing", "financial agent", "flexible work from home" — or arrives through a romance. Students, new arrivals and people in financial difficulty are targeted hardest. Being a mule is a criminal offence in most jurisdictions whether or not the person understood what they were doing, and a conviction closes off banking for years, so "I did not know" is a much weaker position than people expect.

If you have been asked to receive money into your account and send it on, for any reason, by anyone you met online — that is the offer. Say no, and report it. See money mule and how mule networks are structured on our sibling site.

Payment rails, ranked by how much protection you have

The single most useful question when something feels wrong is not "is this person genuine?" It is "if I am wrong about this, can I get the money back?"

Credit card. The most protection. Chargeback rights, and in some jurisdictions the card issuer is jointly liable for the purchase.
Debit card. Some protection, weaker, and the money leaves your account immediately.
Payment apps between individuals. Usually treated as cash between friends. Buyer protection typically does not apply to "friends and family" transfers.
Bank transfer. A recall request is possible, and only in the first hours, and only if the funds are still there. Reimbursement rules for authorised push payment fraud are improving in some countries but are not automatic.
Wire transfer. Same as above, faster and usually cross-border, which makes recall harder.
Cryptocurrency. No reversal exists. Occasionally an exchange will freeze a deposit if told fast enough. Otherwise the money is gone.
Gift cards and cash couriers. No mechanism of any kind. A request to pay this way is, on its own, sufficient evidence of fraud.

This is why scammers steer so hard toward the bottom of that list, and why the steering itself is the reliable signal — more reliable than anything about the story you are being told.

What actually stops a scam

A second person. Telling someone breaks isolation and is the intervention with the best record. It is also what the scheme works hardest to prevent.
A callback on a number you found. Defeats caller ID spoofing, cloned websites and voice deepfakes in one move.
Delay. Every scam needs a decision now. Almost nothing legitimate does.
A family code word. Costs nothing, and defeats the entire family-emergency and voice-cloning category.
Checking the regulator's register yourself. Not the link you were sent — the register you navigated to.
Being told. The FBI's victim-notification programme contacted almost 9,000 people who were being scammed and did not know, and estimates it saved them $562 million. If you think someone you know is in one of these, say so, even awkwardly.

The vocabulary

22 terms, defined plainly — the ones investigators use, and the ones the operators use.

Full glossary →