Privacy
Short version: this site uses Google Analytics to see which pages get read, and nothing else. No accounts, no advertising, no other third-party trackers, no newsletter list.
What this site does not do
- No analytics beyond Google Analytics, and it sets cookies only if you choose "Accept all". See below.
- No cookies of our own. The only thing we store in your browser is your cookie choice.
- No accounts, no logins, no comment system.
- No advertising and no ad networks.
- No email collection unless you choose to subscribe to the weekly digest, see below.
- No third-party scripts beyond Google Analytics. Fonts and everything else are served from this domain.
Weekly email digest
If you subscribe, we collect your email address and nothing else. Signup is double opt-in: we send one confirmation email, and your address is added to the list only when you click the link in it. If you never click, it is not stored by us and the link expires after 48 hours. We use the address only to send the weekly digest, and we never sell, rent or share it.
The list is held and the emails are sent by Resend, which acts as our processor. Every digest has an unsubscribe link that works in one click; unsubscribing stops the emails and marks the address as unsubscribed. To have an address deleted entirely, email us at the address on the contact page.
Cookies and your choice
The first time you visit, a prompt asks you to choose. Accept required and
Accept all are equal buttons, and the whole site works with either. Your choice is saved in your
browser's local storage (one small entry, howscamswork-consent), not in a cookie, and nothing is
saved before you press a button. You can change it at any time with "Cookie choices" in the footer. If your
browser sends a Global Privacy Control signal, we treat it as "Accept required" and do not ask.
Google Analytics
The site uses Google Analytics (GA4). If you choose Accept all, it sets cookies
(_ga, _ga_*) and records page views, referrers, approximate location, and device type.
That data goes to Google and is governed by
Google's privacy policy. We use the aggregate
numbers to see which schemes people actually read; we do not attempt to identify individual visitors, and no
other tool on this site shares data with Google.
If you choose Accept required, Google Analytics sets no cookies and stores nothing in your browser. The Google tag is still loaded in a restricted mode (Google Consent Mode), so Google may receive a basic, cookieless signal that a page was loaded, without a persistent identifier. Advertising storage, advertising data and ad personalisation are denied in both cases, and this site shows no advertising.
The "Am I being scammed?" checker
The checker runs entirely in your browser as static JavaScript. Your answers are never transmitted anywhere; there is no server to receive them, because this site is static files on a CDN. Nothing is stored between visits: closing or reloading the tab discards your answers.
Because it is client-side, you can use it with your network disconnected, and you can read the code: it is plain JavaScript delivered with the page.
Site search
Search is powered by Pagefind, a static search index built at publish time and served from this domain. Your queries run in your browser against index files fetched from this site. Nothing is sent to a search provider and queries are not logged.
What the host sees
How Scams Work is served as static files by Cloudflare Pages. Like any web host, Cloudflare processes connection data, IP address, request time, requested URL, user agent, to deliver pages and to mitigate attacks. That processing is Cloudflare's, governed by Cloudflare's privacy policy. This is separate from the Google Analytics traffic described above, and no visitor-level reports are generated or reviewed from either source.
Embedded video
Where a page embeds an official public-education video, it uses a click-to-load facade: nothing is
requested from YouTube until you click play, and the embed then uses the privacy-enhanced
youtube-nocookie.com domain. If you do not click, no request reaches Google. If you do,
YouTube's own terms and privacy policy apply to that request.
Contacting us
If you email a correction or a question, we have your email and whatever you put in it, for as long as it takes to deal with it. It is not added to any list, not shared, and not used for anything else. Please do not send us documents containing your own or anyone else's financial details, identity documents, or case files, send those to your bank and your national reporting agency instead.
Children
This site is general reference material and is not directed at children.
Changes
9 September 2026: added Google Analytics, described above. If anything else changes, this page will change first and will say what changed and when.