Most scam messages — whether SMS, WhatsApp, email, or DM — share the same handful of tells. Learn them once and you'll spot 95% of scams in seconds. Here are the 10 red flags, in rough order of frequency.
1. Manufactured urgency
"Pay within 24 hours or your account will be suspended."
"Your package will be returned tomorrow if you don't act now."
Real organizations rarely create artificial deadlines. Banks don't suspend accounts via SMS. Delivery companies don't destroy your package after one missed day. The countdown is there to short-circuit your judgment.
Rule: anytime a message has a deadline, slow down. Verify through an independent channel before doing anything.
2. A lookalike domain
Click here:
https://amzn-secure.com/...
The real Amazon is amazon.com (or your country code). The link above uses amzn-secure.com — close enough that a quick glance might fool you.
Common patterns:
- Hyphens added (
amazon-account.com,paypal-secure.com) - TLD swapped (
yourbank.tk,yourbank.xyz,yourbank.ru) - Subdomain trick (
amazon.com.account-verify.net— the actual domain isaccount-verify.net) - Lookalike characters (
paypaI.comwith capital I instead of lowercase l)
Rule: real big-company links match the company's exact main domain. If anything looks off, it almost certainly is.
3. Generic salutation
"Dear customer,"
"Dear vehicle owner,"
A real notice from your actual bank, government agency, or carrier addresses you by name (and usually includes some context — last 4 digits of your card, your reference number, etc.). A generic salutation means the sender has no idea who you are — because they're spraying the same message to millions.
4. Money request via a link
Real institutions don't ask you to pay via a link in an SMS or WhatsApp. Real payment flows:
- You log in to their official site (typing the URL yourself)
- You go to your usual app
- You pay in person, at a branch, or via your bank's payment system
Anything else asking for your card details through a link you didn't initiate is suspicious by default.
5. Too good to be true
"You've won €5,000! Click to claim."
"Bernard Arnault is giving away money to 10,000 lucky people."
"Make $500/day from home, no experience required."
If it sounds amazing, it isn't real. Strangers don't give money away on the internet. Billionaires don't run lotteries via WhatsApp DMs. Easy-money jobs aren't advertised via cold messages.
6. Emoji-loaded "official" message
🚨 ⚠️ ✅ 🦺 🛂 — a real government, bank, or official courier doesn't send notices decorated with emojis. The decoration is added by scammers to make the message look attention-grabbing and "alert-like."
7. Request for credentials, card details, or codes
"To verify your account, please confirm your password."
"Send us the SMS code you just received to confirm."
Banks never ask for your password. No legitimate service asks for your one-time SMS code via WhatsApp or email — those codes are designed precisely so that even the company doesn't see them.
If anyone — anyone — asks for a code or password, it's a scam. No exceptions.
8. Spelling and grammar mistakes
A real legal notice from a bank or government agency goes through review and proofreading. A scam message is usually translated by software or someone whose first language isn't the target language. Look for:
- Awkward phrasing ("kindly do the needful immediately")
- Inconsistent capitalization
- Punctuation errors
- Wrong currency symbol placement
That said: scammers are getting better with AI translation, so don't rely on this alone.
9. Unsolicited contact
Did you ask to be contacted? If a "bank fraud team," a "customs office," a "tech support representative," or a "long-lost relative" reaches out to you without you having initiated anything, be suspicious by default.
Even if the caller ID or sender appears legitimate — caller ID and SMS sender names can both be spoofed.
10. Pressure not to verify
"Don't talk to anyone about this — this is a confidential investigation."
"If you call your bank, the transaction will be canceled."
If someone tells you not to verify what they're saying, that's the loudest red flag possible. Real institutions actively encourage you to call back through official numbers to confirm.
Putting it all together
Most real scams have 3 or more of these flags simultaneously. If you spot two or three, treat it as a scam by default. If you spot one, look harder before acting.
Want a second opinion in 5 seconds?
Forward any suspicious message to Digiscam on WhatsApp. Our AI reads the message, applies these red-flag checks (and more), and tells you whether it's safe, suspicious, or a clear scam — with a risk score and the specific flags detected. Free, anonymous, works in English, French, and Arabic.