The Scam Archive

Real examples, plainly explained. Search by scam, sender, domain, or phone number and learn the red flags before you click.

Plain language
No jargon
Real screenshots
Not mockups
Shareable tips
Family-friendly

Search the Archive

AI search powered by Algolia

Latest additions

Newest examples in the archive, with the screenshot from each report.

See full archive
Unknown AdobeInvoice

Blurred Adobe invoice behind a login box that asks for your email password

A page titled "Invoice Portal" shows a blurred Adobe invoice in the background, with an amount due, an agreement number and payment instructions that cannot be read. On top of it, a box says "This is a permissions-based security document" and asks you to "Log in using your email address" with your email and password. It was first observed in Egypt on October 31, 2026, at titan-invoice[.]surge[.]sh, a free web hosting address that has nothing to do with Adobe. The page code sends what you type to a Discord chat channel.

Read more
Unknown Fake InvestmentCrypto

Digital Gold crypto investment site promising up to 9.5% profit a day

A website called Digital Gold describes itself as "a United Kingdom registered investment firm" working in crypto, forex and crypto mining. It offers three plans that promise 2.00%, 5.00% or 9.50% profit every day, with minimum deposits from $100 to $15,000. It shows the logos of Blockchain.com, Binance, Coinbase, Wave and Grayscale, reviews that claim profits within 48 hours and "over 100,000 dollars", and live statistics that claim 7,973 running days. It was first observed in India on October 31, 2026, at digital-gold[.]vip. The site links a certificate of incorporation for "UPBIT MINNER LTD", company number 14728395, but the UK Companies House register lists that number under a different company, and the site's own contact address is in New York, United States. The domain was registered on July 25, 2026.

Read more
Unknown AirtelIndia

Fake Airtel Diwali gift page promising ₹2,000 cash to everyone

A Hindi-language page with the Airtel name and logo wishes visitors a happy Diwali and says a ₹2,000 cash reward is available for everyone. It shows a festive banner with a "अभी पाएं" (get it now) button, a like counter and a list of comments from people who say the money reached their account and that they shared the page in all their WhatsApp groups. It was first observed in India on October 31, 2026, on short, random-looking .buzz addresses such as mgojd[.]buzz, wmbry[.]buzz and qcoph[.]buzz, none of which belong to Airtel. The same page code was used in August 2026 for a Pakistan Independence Day "cash gift" on other .buzz and .xyz addresses.

Read more
Unknown StokomaniFrance

Fake Stokomani shop selling an electric bike for 89 euros

A French-language shop whose page title ends in "Stokomani" sells a "Vélo électrique MileCity 1" (MileCity 1 electric bike) for 89.00€ instead of 300.00€, under a "Prix Déstockage" (clearance price) label and a "Stock limité – 4 articles restants" (limited stock, 4 items left) warning. It was first observed on October 30, 2026, at stokomanie-france[.]com, an address with an extra "e" in the name that was registered on September 11, 2026, seven weeks earlier. The link carried paid-advert tracking tags from Facebook.

Read more
Unknown TelegramMalaysia

Fake Malaysian status check page that asks for your Telegram phone number

A Malay-language page headed "LENGKAPI DATA" (complete your data) offers a free "Semakan Status" (status check) for "your application", without saying what the application is. It asks for your full name as written on your identity card and the phone number registered to your Telegram account, and then asks for the verification code Telegram sends to the app and the Telegram two-step verification password. It also asks for a copy of a MyKad (Malaysian identity card) and a CV. A "Pendaftaran Terkini" (latest registrations) list marked "Live" is generated at random by the page. It was observed in Malaysia on October 30, 2026, at register.nty-my[.]com/my-gov/. Copies of the same page were first observed in Malaysia on August 4, 2026, on subdomains of ap-my1[.]com.

Read more
Unknown Orange MoneyJordan

Fake Orange Money Jordan login page that sends your password, code and ID photo to Telegram

An Arabic-language page titled "Orange Money - تسجيل الدخول" (Orange Money sign-in) asks for a phone number starting with 077, 078 or 079 and a password. The page code then asks for a code sent by text message, then a wallet number, national number or passport number, ID number and date of birth, and finally opens the camera to photograph the front of an ID card. Each step is sent to a Telegram bot, and the person running it chooses what the page asks for next. It was first observed on October 29, 2026, at orangemoneyjordann[.]blogspot[.]com, a free Blogger blog that forwards visitors to a page on htmlspace[.]app.

Read more
Unknown TakealotSouth Africa

Fake Takealot daily deal page selling a kitchen appliance bundle at 65% off

A product page with the Takealot name and logo offers a Defy 30L microwave, a Russell Hobbs 6.5L air fryer and a Mellerware glass kettle together for R 599 instead of R1,697, under a "Daily Deal" countdown and an "UP TO 65% OFF" badge. It copies Takealot shopping features such as takealot.credit monthly payments, TakealotMORE free delivery, eBucks and Discovery Miles, and next-day delivery to Cape Town, Durban and Johannesburg. It was first observed in South Africa on October 29, 2026, at tekalotke[.]vercel[.]app, a free Vercel hosting address that is not a Takealot address. The link carried paid-advert tracking tags that included a Facebook click identifier.

Read more
Unknown TokopediaIndonesia

Fake Tokopedia help page that offers redelivery or a refund, then asks you to sign in

An Indonesian-language page with the Tokopedia logo is titled "Pusat Bantuan & Layanan" (Help and service center). Under the heading "Layanan Pelanggan" (Customer service) it asks you to choose an action for your order: request a redelivery, request a refund, or get a refund to your credit card limit. Below the buttons it offers sign-in with Google, e-mail or TikTok Shop. It was observed in Indonesia on October 29, 2026, through a bitly[.]cx short link that opened pusatbantuanrefund-tokopedia[.]webu[.]biz[.]id. Pages with the same menu were first observed on other addresses on September 14, 2026.

Read more
Unknown TelegramIndonesia

Fake Indonesian registration page that asks for your Telegram login code and two-step password

An Indonesian-language page titled "Daftar Sekarang" (Register now) says registration for 2026 is open to all people in Indonesia. It asks for your full name as written on your e-KTP identity card and your active Telegram phone number. It then says a code will be sent by an "official Telegram bot" and asks for that 5-digit code, followed by your Telegram two-step verification password. After that it asks for your full address, postal code, province, city and bank name, and tells you to wait 24 hours for an eligibility check. The page never says what you are registering for. It was observed in Indonesia on October 28, 2026, at css4.regnows-dfg[.]com. The same page was first observed on other subdomains of that address on August 21, 2026.

Read more

Latest WatchOut alerts

Recent warnings. When an alert matches a scam record or a domain already in the archive, a link to that record is included.

All alerts

Browse by category

Categories with examples in the archive, and how many records each one has.

View all
P

Phishing

Attempts to trick victims into revealing credentials or sensitive info by impersonating trusted services.

17 scams

R

Refund / Invoice Bait

Fake invoices or 'refund' notices that trick victims into calling scammers or installing remote-access tools.

4 scams

T

Tech Support / Remote Access

Scammers claim there is a virus or issue and request remote access or payment for fake fixes.

1 scam

I

Investment / Crypto

Fraudulent investments or crypto scams promising guaranteed returns or exclusive offers.

4 scams

R

Romance / Dating

Emotional manipulation via dating platforms leading to requests for money or gifts.

1 scam

M

Marketplace / Classifieds

Fake listings, rental scams, or overpayment schemes on marketplaces and classifieds.

3 scams

J

Job / Work-From-Home

Fake job offers requiring upfront fees, equipment purchases, or acting as a money mule.

5 scams

A

Advance Fee Fraud

Scammers promise a large payout, inheritance, contract transfer, or released funds, then demand fees, bank details, or identity documents before the money can be received.

4 scams

L

Lottery / Prize

Fraudulent prize claims requiring fees or sensitive info to claim winnings.

2 scams

C

Charity / Disaster Relief

Fake charities exploiting disasters or tragedies to solicit fraudulent donations.

1 scam

S

Shipping / Delivery

Fake delivery notifications tricking victims into clicking malicious links or paying fees.

3 scams

I

Impersonation / Social Media

Accounts or pages impersonating individuals or brands to defraud followers.

2 scams

S

Smishing (SMS Phishing)

Phishing attempts delivered by text message linking to fake sites or requesting responses.

2 scams

E

Extortion / Sextortion

Threats to expose sensitive or fake compromising information unless paid.

2 scams

M

Malware / Attachment

Emails or downloads containing malicious attachments or links to malware.

3 scams

C

Credential Harvesting

Fake websites or forms designed to steal login details, MFA codes, or personal data.

5 scams

C

Crypto Wallet / Exchange Impersonation

Fake crypto wallets, exchanges, or airdrops designed to steal private keys or funds.

3 scams

Quick tip: Pause before you pay

Unexpected refunds, gift-card demands, and urgent invoices are classic pressure tactics. Verify using a trusted phone number or website you already know, not the link you were sent.