Scam Case Library
Eight scam patterns taken apart, case by case — every one documented in an official FTC or FBI IC3 alert, with the signals to spot and the move that breaks the script.
Scam warnings usually fail at the moment they are needed: they describe a category (“beware phishing”) while the victim is inside a story with names, deadlines and a voice they trust. This casebook works the other way round. Each case is one documented pattern, reconstructed from the official alert that describes it — how contact starts, how the story escalates, where the money move hides, and which signals were visible from inside the story all along.
Every case below is a pattern, documented by the Federal Trade Commission or the FBI’s Internet Crime Complaint Center (IC3) — the two US bodies that publish scam alerts from real complaint data. Each case shows how the scheme unfolds, the signals that give it away, and the move that breaks it. Use the filters to browse by how the scam reaches you, then run any real message through the Scam Message Checker or the Suspicious Link Checker.
1 · The government official who needs payment today
How it unfolds
- A call, text or official-looking letter claims to be from a government body — the tax authority, Social Security, the police, a court, even the FTC itself — sometimes with a fake badge or employee-ID number and spoofed caller ID.
- The script picks a threat: taxes owed with arrest promised, benefits about to stop, a fine for “missed jury duty”.
- Payment must be immediate and untraceable — wire, gift cards, crypto — or, in the FTC-impersonation variant, you are told to move your money to “protect” it.
Signals to spot
- Government does not open contact by text or social media, and never demands payment by gift card, wire or crypto.
- A badge number offered as proof — real agencies do not authenticate themselves that way; scammers impersonating the FTC even invent “agent” badge numbers.
- Any version of “pay now or be arrested / lose your benefits”.
Break the script
Hang up. Find the agency through its official website yourself and ask whether the claim exists. Report it to the FTC.
Pattern source: FTC Consumer Advice, “How To Avoid Imposter Scams” — consumer.ftc.gov/features/how-avoid-imposter-scams; corroborating alert: FTC, “No, FTC ‘agents’ with badge numbers aren’t calling you” (May 2025).
2 · The bank “fraud department” that moves your money
How it unfolds
- A call or a text alert claims fraud was spotted on your bank, investment or retirement account — the text variant asks you to reply YES or NO about a “suspicious purchase”, or to call the number in the message.
- The helpful “fraud department” offers to protect your money: move it to another account, or read back the verification code just sent to your phone.
- The moved money goes to the scammer; the read-back code is the key that lets them into your account as you.
Signals to spot
- “Move your money to protect it” — a real bank never asks this, in any wording.
- Any request to share a verification code. No genuine fraud department will ever ask for one.
- The contact path is the one the message supplied, not the number on your card or statement.
Break the script
Stop the conversation. Call the number on your card or statement, or open the bank’s own app, and ask whether anything is wrong.
Pattern source: FTC Consumer Alert, “Got a call about fraud activity on your bank account? It could be a scammer” (June 2024) — consumer.ftc.gov; the text variant is item 3 of the FTC Data Spotlight “Top text scams of 2024” (April 2025).
3 · The virus warning that wants you to call
How it unfolds
- A pop-up (or an unsolicited call) claims your computer has a virus and urges you to call a number or click a link — the “warning” may freeze the screen or speak aloud.
- The “technician”, claiming to be from a real company such as Microsoft or Apple, makes the problem sound grave and urgent.
- They ask for remote access to your computer, card or bank details, or payment — often insisting on gift cards, a money transfer or Bitcoin.
Signals to spot
- Legitimate tech companies do not contact you out of the blue about a problem, and real security warnings never ask you to call a phone number.
- Remote-access software is the payload: once installed, the “repair” can rummage freely.
- Payment demanded in gift cards, transfers or crypto for a “repair”.
Break the script
Close the pop-up (force-quit the browser if it will not close) and never call the number. If you already granted remote access, treat the machine as compromised: disconnect it, and get help from a provider you choose yourself.
Pattern source: FTC Consumer Alert, “How can you spot a tech support scam?” (September 2020) — consumer.ftc.gov.
4 · The parcel that needs a small fee
How it unfolds
- A text, usually dressed as the postal service, says a delivery has a problem and links to a site that looks like the real carrier’s.
- The site asks for a small “redelivery fee” — a dollar or two, which feels harmless.
- The fee is the bait: what the page really harvests is the card number — and sometimes the Social Security number — entered to pay it.
Signals to spot
- An unexpected delivery problem for a parcel you cannot identify, resolved only through the message’s link.
- A carrier look-alike domain; the fee is small precisely so it slips under your guard.
- The most reported text scam of 2024 in FTC complaint data — expect volume, not craftsmanship.
Break the script
Do not tap the link. Track the parcel in the carrier’s own app or by typing its address yourself; a genuine carrier problem survives that route, a fake one does not.
Pattern source: FTC Data Spotlight, “Top text scams of 2024”, item 1 — Fake package delivery problems (April 2025) — ftc.gov. The Spotlight reports $470 million lost to text scams overall in 2024.
5 · The unpaid toll that never existed
How it unfolds
- A text imitates a real highway toll program — the FTC names SunPass in Florida and FasTrak in San Francisco among those copied — saying a balance is unpaid.
- The link leads to a payment page styled as the toll operator’s.
- The page collects card details, and sometimes a Social Security number, for a charge that was never real.
Signals to spot
- Toll agencies do not collect surprise balances by text link; the charge, the message and the deadline are all invented.
- The same small-amount psychology as the parcel fee: cheap enough to pay without thinking.
Break the script
Ignore the link. If you have an account with the toll program, sign in the way you normally do and check the balance there.
Pattern source: FTC Data Spotlight, “Top text scams of 2024”, item 4 — Bogus notices about unpaid tolls (April 2025) — ftc.gov.
6 · The “wrong number” that becomes an investment
How it unfolds
- An innocent misdirected text arrives — a wrong number, a mistaken appointment. Apologies turn into friendly conversation, often with romantic undertones; the same script runs from fake dating and social-media profiles.
- Over days or weeks the new “friend” earns trust, then mentions their own success investing — frequently in cryptocurrency — and offers to share the trick.
- Victims are directed to bogus investment platforms. Small early “withdrawals” may be allowed to build confidence; then larger deposits lock in, fake fees or “taxes” are demanded to release them, and the friend vanishes. The FTC describes victims losing everything they put in, often tens of thousands of dollars.
Signals to spot
- A stranger who arrives by accident and stays by design.
- The relationship can never meet in person — abroad, oil rig, military — but the investment advice arrives on schedule.
- Any platform the friend supplies, and any fee demanded to unlock your own money.
Break the script
Never invest on the direction of someone you have only met by message, and never pay to withdraw. Cut contact once investing enters the chat.
Pattern sources: FTC Data Spotlight, “Top text scams of 2024”, item 5 — “Wrong number” texts (April 2025) — ftc.gov; and FTC Consumer Advice, “What To Know About Romance Scams” — consumer.ftc.gov.
7 · The QR code that arrives uninvited
How it unfolds
- Variant one (IC3, July 2025): an unsolicited package with no sender information arrives containing a QR code. Scanning it prompts the recipient to enter personal or financial information, or unwittingly downloads malicious software that steals data from the phone.
- Variant two (IC3, November 2021): inside impersonation, romance and prize schemes, the scammer supplies a QR code tied to their own crypto wallet and walks the victim, step by step, to a physical cryptocurrency ATM to insert cash and pay by scanning it.
- Once sent, the crypto is the scammer’s almost instantly and is typically moved overseas, making recovery unlikely.
Signals to spot
- A QR code with no accountable sender is a link you cannot read — treat it with the same suspicion as a shortened URL from a stranger.
- Payment by QR at a crypto ATM is a payment to a stranger’s wallet, whatever the story around it says.
Break the script
Do not scan codes from unsolicited packages. Never pay anyone — agency, “bank”, or new friend — by QR code at a crypto ATM.
Pattern sources: FBI IC3 Public Service Announcement PSA250731, “Unsolicited Packages Containing QR Codes Used to Initiate Fraud Schemes” (July 31, 2025) — ic3.gov; and IC3 PSA211104 on cryptocurrency ATMs and QR codes (November 4, 2021) — ic3.gov.
8 · The family emergency in a cloned voice
How it unfolds
- A panicked call arrives in a voice that sounds exactly like a family member — the FTC’s example is a grandson who wrecked the car and is in jail — begging you to send money now.
- The voice is an AI clone, built from a short clip of the real person’s voice, for example from videos posted online, fed into a voice-cloning program.
- Payment is demanded in hard-to-reverse forms: wire transfer, cryptocurrency, or gift cards with the numbers and PINs read out.
Signals to spot
- The emergency forbids verification: send now, tell no one.
- The payment rails are the tell — bail and hospitals do not settle in gift cards or crypto.
- Your ears are no longer evidence: a familiar voice proves nothing on its own.
Break the script
Hang up and call the person on a number you know is theirs — or reach them through another family member. A code word agreed in advance, in calmer times, settles these calls in seconds.
Pattern source: FTC Consumer Alert, “Scammers use AI to enhance their family emergency schemes” (March 2023) — consumer.ftc.gov.
Spotted your case here? The pattern match is a starting point, not a conclusion — the checkers read the actual message or link in front of you. How the four trust tools judge is documented on the methodology page.
Quick answers
What is the most reported text scam?
Fake package-delivery problems, according to the FTC’s Data Spotlight on the top text scams of 2024 — ahead of fake job offers, fake bank fraud alerts, bogus unpaid-toll notices and “wrong number” texts. The FTC reports $470 million lost to text scams overall in 2024.
All five of those patterns have cases in this library: cases 4, 2, 5 and 6 cover the delivery, bank-alert, toll and wrong-number patterns.
Can a QR code be a scam by itself?
Yes, in two documented ways: unsolicited packages have arrived carrying QR codes that harvest personal and financial data or install malware when scanned (FBI IC3, July 2025), and scammers direct victims to pay at cryptocurrency ATMs by scanning a QR code tied to the scammer’s wallet (FBI IC3, November 2021).
A QR code is an unreadable link. The defences are the same as for any link from a stranger: do not scan what you cannot attribute, and never pay by QR at a crypto ATM.
How do I know whether a message I received matches one of these cases?
Compare the sequence, not the wording: who initiated contact, what pressure was applied, and what money move was requested. Then paste the message into the Scam Message Checker — it flags the same signals (urgency, code and gift-card requests, safe-account scripts, impersonation mismatches) in your actual text.
This tool cannot prove a message is safe — a message matching no case here can still be a scam in a pattern nobody has published yet.
How to use
- Filter by how the approach reached you — text, call, social, package, or the money move it ends in — or read all eight in order.
- In each case, compare “How it unfolds” with what actually happened to you, then read the signals list: those are the points where the script is thinnest.
- For a specific message or link, use the checkers: Scam Message Checker for the text, Suspicious Link Checker for any address inside it.
About this tool
Every case is sourced to the Federal Trade Commission or the FBI’s Internet Crime Complaint Center, the two US bodies that turn real complaint data into public alerts, and every case carries its source link. The casebook deliberately contains no “real scam text”: quoting invented messages as evidence would teach pattern-matching against fiction. What is quoted is the pattern — the sequence and the signals — which is the part that transfers to the next variant.
The eight patterns were chosen because they cover the channels the four verystep trust tools actually inspect: message text (government and bank impersonation, delivery and toll templates, the wrong-number on-ramp), voice (AI-cloned family emergencies), payment rails (QR codes and crypto ATMs), and the pop-up that starts the tech-support script. New official alerts are added as cases when they document a genuinely new pattern rather than a new costume on an old one.
How it works
How to read a case: “How it unfolds” is the script’s skeleton — initiation, escalation, money move. Scam scripts are industrial products; the costume (which agency, which carrier, which toll road) changes weekly while the skeleton persists for years. “Signals to spot” lists the tells that are visible from inside the story at the moment of decision — each maps to a pattern the Scam Message Checker flags mechanically (urgency and threats; verification-code, gift-card, crypto and wire requests; the safe-account script; impersonation mismatches; delivery and toll templates). “Break the script” is always the same underlying move in different clothes: leave the channel the scammer supplied and re-enter through a channel you chose — the number on your card, the carrier’s own app, a family member’s known number.
A note on evidence discipline, because this page sells none: the FTC Data Spotlight figures cited here ($470 million reported lost to text scams in 2024; package-delivery problems as the most reported text pattern) are complaint-based reports, not measurements of all fraud — the FTC itself treats them as a floor, since most victims never report. Dates given for FTC pages are the dates of the alerts as published; where an FTC page carries no visible date stamp, the casebook dates it by its dated alert path and says nothing stronger.
Worked examples
Reading a real text against case 4: A text claims a parcel is held pending a $1.99 customs fee, payable within 12 hours at a link. Against case 4: initiation (unexpected delivery problem) ✓, money move (small fee to a look-alike site) ✓, signals (fee-as-bait, invented deadline) ✓. The Scam Message Checker flags the same text independently: delivery-fee template, urgency deadline and a look-alike link.
Reading a call against case 8: A tearful call “from” a grandson: crash, jail, bail needed by gift cards, “don’t tell Mum”. Against case 8: initiation (panicked family voice) ✓, money move (gift cards, secrecy) ✓. The defence is not judging the voice — it is hanging up and calling the grandson’s real number.
Case sources
| Official source | Cases |
|---|---|
| FTC — How To Avoid Imposter Scams (consumer.ftc.gov) | 1 |
| FTC — Bank fraud-activity alert, June 2024; Data Spotlight “Top text scams of 2024”, April 2025 | 2, 4, 5, 6 |
| FTC — Tech support scam alert, September 2020 | 3 |
| FTC — What To Know About Romance Scams | 6 |
| FBI IC3 — PSA250731 (July 31, 2025) and PSA211104 (November 4, 2021) | 7 |
| FTC — AI family-emergency alert, March 2023 | 8 |
Frequently asked questions
Are these real scam messages?
No — deliberately. Each case is a pattern breakdown written from an official FTC or IC3 publication, with the source linked on the case. Publishing invented “example messages” as if they were evidence would mis-teach the patterns; what transfers between variants is the sequence and the signals, and those are what each case documents.
Why only FTC and IC3 sources?
Because they are the primary US publishers of scam-pattern alerts built on complaint data. A case enters this library when an official alert documents the pattern — not when a news story or a security vendor’s blog describes it.
A message I got does not match any case. Am I safe?
No conclusion follows either way. New variants appear constantly, and this tool cannot prove a message is safe. Run the message through the Scam Message Checker for its own signals, and verify any claim through the organisation’s official channel.
I already sent money. What now?
Contact your bank or card issuer immediately — speed matters more than embarrassment. Then report it: the FTC at reportfraud.ftc.gov, and the FBI IC3 at ic3.gov for internet-facilitated fraud. Keep the messages, numbers and receipts.
How are cases added or updated?
When the FTC or IC3 publishes an alert documenting a pattern not already covered — a new channel or a new money move, not a new costume — it is added with its source and date. Existing cases are re-checked against their source pages when the trust cluster is reviewed.
First time embedding? Read the step-by-step guide →
More free tools
AI Image Signals Checker
Read every origin record inside a photo — Content Credentials, IPTC source type, generator tags, saved prompts and workflows — and see a plain list of what is actually there. No score, no verdict.
C2PA Content Credentials Verifier
Check a photo or video for Content Credentials (C2PA): who signed it, whether the signature still validates, and whether AI involvement was declared — verified on your device.
How the Trust Checkers Judge — Methodology
The public rulebook for verystep’s four trust tools: what each one reads, how its three signal levels work, what it refuses to claim, and the limits printed on the tin.
Suspicious Link Checker
Paste a link and read what its structure reveals — look-alike domains, punycode disguises, hidden destinations and bait words — without ever visiting it.
Scam Message Checker
Paste a suspicious text, email or DM and see the warning signs it contains — checked against 31 known scam patterns, entirely in your browser.
Password Strength Checker
How strong is your password — really? Local strength scoring plus a private breach check.