Know the script.
Break the spell.

What it is

A believable alert, offer, delivery problem, toll notice, bank warning, job lead, or accidental message is used to trigger a reply, click, call, credential entry, or payment. “Smishing” is phishing delivered by SMS.

Documented milestone

Security agencies treat smishing as a channel variant of phishing, not a con invented by one culture. In 2024, consumers reported $470 million lost to scams that began by text—more than five times the 2020 figure.

Detection signals

• Unexpected package, toll, purchase, bank, job, or “wrong number” message
• Link domain does not match the named organization
• One-time code, password, card, or identity request
• Small fee or account-closure threat under a deadline
• Friendly mistake that pivots to romance, work, or investing

Who faces exposure

Anyone with a phone. Context raises risk: expecting a delivery, actively job hunting, traveling, or responding in a second language. The condition—not the person—is the target.

What it is

A criminal builds affection, friendship, or exclusivity, then invents a crisis or steers the relationship toward a fake crypto, gold, forex, or private investment platform.

History, scale, and enforcement

Online romance fraud predates WhatsApp. The FBI recorded nearly 15,000 confidence/romance complaints and over $230 million lost in 2016. IC3 recorded 23,159 complaints and $929.3 million lost in 2025 across all channels. In June 2024, two women were arrested in an alleged scheme involving at least 16 alleged victims and more than $7 million; charges remain allegations until proved.

Detection signals

• Rapid affection, exclusivity, or a shared-future script
• Fast move from a social or dating platform to WhatsApp
• Repeated inability to meet or verify live
• Military, travel, medical, visa, or frozen-account crisis
• Private investment group, fake profits, then withdrawal “taxes”

Who faces exposure

People seeking connection, grieving, isolated, newly divorced, traveling, or exploring investments may receive tailored approaches. Nearly 60% of people reporting a romance-scam loss to the FTC in 2025 said it began on social media.

What it is

Catfishing means presenting a fabricated or stolen identity online. It can lead to romance fraud, investment loss, sexual exploitation, stalking, or emotional harm—but not every fake profile requests money.

Documented milestone

The FBI was publicly using and defining “catfishing” by December 2013. That is an early authoritative record, not proof that impersonation began then. FTC data show $2.1 billion lost to all social-media-originated scams in 2025; that total is not catfishing loss.

Detection signals

• New account with sparse authentic history
• Photos or biography inconsistent across sources
• Immediate intensity and off-platform pressure
• Refusal of spontaneous voice, video, or independent verification
• Repeated failed meetings followed by money, image, or access requests

Evidence test

Check account age and history, perform a reverse-image search outside the conversation, ask for a spontaneous non-sensitive verification, and call known contacts through a saved number.

What it is

Strangers may impersonate relatives, banks, police, lawyers, tech support, or romantic partners. Financial exploitation may also come from a trusted caregiver, friend, fiduciary, or relative.

History and major case

The FBI says IC3 had received grandparent-scam reports since 2008. In March 2025, prosecutors charged 25 Canadian nationals in an alleged call-center conspiracy said to have taken over $21 million from older Americans in more than 40 states.

Detection signals

• Relative claims arrest, crash, injury, kidnapping, or travel crisis
• Call passes to a supposed lawyer, doctor, police officer, or bondsman
• “Gag order” or instruction not to tell family or the bank
• Cash courier, wire, crypto, or gift-card demand
• New signer, beneficiary, unexplained withdrawal, or caregiver control

Scale without exaggeration

FinCEN analyzed $27 billion in suspicious elder-exploitation activity in filings from June 2022–June 2023. That is not a loss total: it can include attempts, duplicates, transfers, and amendments. About 80% of analyzed filings involved stranger/imposter scams and 20% theft by someone trusted.

What it is

A supposed bank security team reports suspicious activity, then asks for a one-time code, remote access, or a transfer to “protect” the money. A real bank does not need a customer to move funds into a stranger-controlled safe account.

Reported scale

The FTC said people reported nearly $1 billion lost to business impersonators in 2025, with bank impersonators producing the highest losses in that group. IC3 separately approximated 4,700 account-takeover complaints and $359.7 million in loss.

Detection signals

• Password reset, MFA change, SIM port, or new recovery method
• Unknown-device login or sudden account lockout
• Fraud alert followed by a one-time-code request
• New payee and rapid wire, ACH, P2P, or crypto transfer
• Instruction to ignore the number on the bank card

Safe response

End the contact. Call the number printed on the bank card or use the institution’s known app. Ask the fraud team to verify recent security changes and transfers. Report active theft quickly; recovery options narrow with time.

What it is

A criminal impersonates or compromises an executive, vendor, school administrator, payroll contact, title company, board member, or trusted professional to redirect a payment or sensitive record.

Reported scale

IC3 recorded 24,768 business-email-compromise complaints and $3.047 billion in reported loss in 2025, the second-highest cyber-enabled fraud loss category after investment fraud.

Detection signals

• New payment instructions or bank-account change
• Look-alike domain or altered reply-to address
• Executive urgency paired with secrecy
• Payroll, W-2, student, donor, or vendor-data request
• Request bypasses an established approval path

Evidence test

Verify any payment or credential change through a known phone number and a second authorized person. Compare the full domain, reply-to address, prior invoice details, and known vendor process.

What it is

A supposed notario, consultant, travel agent, official, or insider guarantees a visa, work permit, green card, asylum result, tax resolution, or special access—then requests money, original documents, or false forms.

Documented milestone

The U.S. meaning of “notary public” differs sharply from the legal authority associated with notario in parts of Latin America. That semantic mismatch is the mechanism; culture is not the risk. DOJ issued a national notario warning in July 2009.

Detection signals

• Guaranteed legal or immigration outcome
• Payment for free government forms
• Blank, false, or untranslated document
• Threat of arrest or deportation unless paid immediately
• Gift card, crypto, wire, or P2P demand from an “official”

Major case

In June 2024, a consultant was sentenced to 63 months after a scheme targeting Spanish- and Haitian Creole-speaking communities involved more than 1,000 victims and over $3.9 million. No authoritative nationwide total specific to immigrants or non-English speakers was located in the primary sources reviewed for this guide.