The guides below are the working core of ScamSupport. Each one walks through a single scam pattern in depth — what the message looks like, what the criminal is trying to do, why the pattern works, the exact red flags that catch it, and what to do if you have already clicked, replied, or paid. Every guide carries a “Last reviewed” date and a sources footer citing the regulator, brand or charity whose policy or contact details it draws on. When a UK rule changes — Action Fraud being replaced by Report Fraud in December 2025, the FSCS deposit limit rising to £120,000 in the same month, the PSR mandatory APP-fraud reimbursement scheme launching in October 2024 — we work through the affected pages and re-date them.

If you have an email or text in front of you right now and want a fast answer, paste it into the ScamSupport scanner — the detection model runs entirely in your browser so the message never leaves your device. If you have already lost money or shared personal information, jump to the Recover section for the right sequence of steps. The guides below are the reference material in between — for understanding the pattern, recognising it next time, and helping the people you know recognise it too.

Brand impersonation

The single most common scam pattern in 2026: an email or text that looks exactly like it came from a brand you actually use — Amazon, Apple, Microsoft, PayPal, Netflix, Royal Mail, the major couriers — warning of a payment that has failed, an account that has been suspended, or a parcel that needs a small fee to release. The pattern works because the brand voice is technically trivial to copy and because most people read the message on a phone screen where the sender domain is hard to inspect. Each guide below names the exact patterns being used against the brand it covers, the brand’s real verification routes, and what to do if you have already clicked.

Scams that pretend to come from major brands — spotting the differences between the real and the fake.

Government & council impersonation

Tax refunds you can claim. Tax demands you must pay. Penalty charges from the DVLA. Benefit changes from the DWP. Council tax adjustments. TV Licence cancellations. The shared pattern across this category is impersonating an authority — one that the recipient has limited experience challenging — and using that authority to create urgency. UK government departments do not, as a rule, email or text you a link to claim money or pay a debt. The guides below cover the impersonated department’s actual contact and verification routes, the specific phrasing the scam tends to use, and what to do if you have replied with personal details or paid anything.

Scams that impersonate government departments and local councils — the highest-volume UK category.

Financial & crypto scams

The highest-loss-per-victim category by a wide margin. A scam impersonating your bank’s fraud team. An investment platform that looks regulated but is not on the FCA Register. A cryptocurrency “recovery” service contacting people who have already lost money. The bank-impersonation pattern is the volume engine; the investment and crypto patterns are the catastrophic-loss engine. Each guide below covers a specific brand or pattern within the category, the regulator-verified verification route (the FCA Financial Services Register, the 159 Stop Scams short number), and the reimbursement and dispute routes available where loss has already occurred.

Scams targeting bank customers, investors and crypto traders — the highest-loss category.

Channel-specific (text, WhatsApp, voice, QR)

The same scam patterns shift channel as defences harden on the old ones. Smishing (scam text messages) overtook email phishing for volume some years ago. WhatsApp “Hi Mum” family-impersonation scams have become a major UK consumer-fraud category, particularly when paired with AI voice cloning of a relative’s voice. Quishing — scam QR codes on parking meters, posted letters and restaurant tables — is a smaller but growing problem. Each guide in this category covers a single channel-specific pattern, the platform-level controls that defeat it, and the cross-channel verification rules that work regardless of which medium the scam arrives through.

Scams that use specific delivery channels — SMS, encrypted messengers, voice calls, QR codes. Browse the full messaging-scam hub →

Romance, job offer & identity

Slower than the brand-impersonation pattern, but consistently higher in average loss because the relationship builds over weeks or months before the financial ask. Romance scams shape the entire interaction around the eventual money request; fake-job-offer scams sit in front of a target-rich audience (people actively job-hunting); identity scams gather the documents needed to open accounts in the victim’s name. These scams are emotionally costly as well as financially, and the recovery section covers both sides — the bank-refund routes for financial loss and the protective registrations (CIFAS, credit-file Notice of Correction) for identity exposure.

Long-form social-engineering scams that build a relationship before extracting money or data.

Foundational & business

Two guides for the reader who wants the underlying mechanics rather than a specific brand walkthrough. “How to spot phishing emails” gives the seven structural tells every phishing message shares — the framework that lets you spot any phishing attempt regardless of brand. Business Email Compromise covers the most expensive scam category per incident: an email that appears to come from a senior colleague or a known supplier, instructing an urgent payment or a change of bank details. Losses run to tens of thousands of pounds per case; the guide covers the technical controls and process controls that defeat the pattern at source.

Universal phishing-detection skills and business-targeted scam patterns.

If a pattern you have spotted isn’t covered

Scam patterns shift faster than any single resource can track. If you have received something that doesn’t map cleanly to any of the guides above, the contact page is the place to flag it — we read every submission and they shape which guides get written next. If you are looking for a particular brand or scam type that isn’t listed here, the ScamSupport scanner works as a generic checker for any message regardless of category — it does not need a matching guide to give you a verdict. And if the scam has already happened, the Recover section is the next stop, with the right sequence to follow when money or personal information has been exposed.

How we keep these guides current

Each guide carries a “Last reviewed” date in the page header and a sources footer naming the regulator, brand, charity or government department the page draws on. When a UK rule changes — the December 2025 launch of Report Fraud, the December 2025 FSCS uplift to £120,000, the October 2024 PSR mandatory reimbursement scheme — we revisit the affected guides and re-date them, with a brief note where the change is material. Where a specific statistic or contact detail cannot be verified against an authoritative source, we remove it rather than guess. The site is small enough that careful accuracy is achievable and large enough that getting a fact wrong would matter to real people making real decisions.