Every scam type, exposed.

Temu is a real company, not a scam — PDD Holdings, traded on NASDAQ. That is the easy part. The harder truth: the platform draws serious data-privacy complaints, ships goods that have failed independent safety testing, and has become a favorite costume for scammers running fake-order phishing and counterfeit storefronts. The brand is legitimate. Much of what gets done in its name is not.

Royal Match is a real game from Dream Games — $3B+ in lifetime revenue, 55 million monthly players. It is not a scam. The ads are the deception: the dramatic "save the king" rescue scenes barely exist in the game you actually download.

There is no free Robux generator. Roblox says so plainly, and so do I — every one is built to steal accounts, harvest data, or install malware. The "generator" is the bait; the theft is the point. And this one is aimed squarely at kids.

The ad above a search result is not vetted by Google for honesty — it is paid placement. Scammers buy the top slot to push phishing pages, fake "support" lines, and malware, often impersonating the very brand you searched for. The first result is sometimes the most dangerous one.

DHgate is a legitimate Chinese wholesale marketplace founded in 2004, with an escrow payment system and a buyer-protection dispute process — it is not a phishing scam, and most orders do arrive. The real risks come from its open-marketplace model: widespread counterfeits and "replicas," wildly inconsistent quality, and long shipping times. It carries a very low Trustpilot score and appears on the USTR 2025 Notorious Markets List. The biggest dangers are off-platform payment scams, fake DHgate-branded phishing sites, and counterfeit goods sold as genuine.

StockX is a legitimate, established resale marketplace for sneakers, streetwear, and collectibles that routes items through an authentication step before they reach the buyer. It is generally safe and delivers authentic products for most buyers — meaningfully safer than unverified peer-to-peer resale. But authentication is not flawless: Nike's 2022 lawsuit alleged counterfeit pairs slipped through, and counterfeiters now fake StockX green tags and receipts. The bigger consumer risk is fake "StockX" sites, phishing, and social-media impersonation accounts that use the brand to lure buyers off the real platform.

Poshmark is a legitimate social resale marketplace (publicly listed, owned by South Korea's Naver) that has operated since 2011 with a large user base and high app-store ratings. The platform itself is safe to use, with "Posh Protect" buyer protection covering items that arrive damaged, counterfeit, or not as described when you stay on-platform. Almost all Poshmark fraud is off-platform: bot comments urging you to "kindly email me," fake "Item Sold" emails that trick sellers into shipping early, and fake-check or overpayment schemes. The brand name is also abused in phishing and impersonation messages.

A patient con. The scammer builds a relationship first — romance, friendship, a "wrong number" that turns into daily contact — then steers you onto a crypto platform that looks real and is not. The name is literal: fatten the target on fake gains, then slaughter. By the time a withdrawal stops going through, the money and the person are both gone. These run for months before the ask.

There is no real investment — just new money paying old investors, dressed up as returns. It holds until the inflow slows, and then it fails all at once. Madoff is the famous version; the same structure runs through countless smaller crypto and "guaranteed return" schemes. Steady, generous returns that no one can quite explain are the tell.

A platform or self-styled "expert" promises reliable profits trading currencies — guaranteed, low-risk, all upside. Real forex trading is neither guaranteed nor low-risk, which is the first lie. The platform is usually fake, the gains on your screen are just numbers, and the withdrawal is where it ends.

Someone calls claiming to be police, customs, or a federal agent, says you are implicated in a crime, and keeps you on a video call they will not let you end — sometimes for days. The badge is fake, the warrant is fake, and the isolation is the weapon. It has taken over $350 million in India and is now working through diaspora communities in the US.

A pop-up, email, or call claims your computer is infected and that Microsoft or Apple needs to fix it — for a fee, and with remote access to your machine. None of it is real. Microsoft and Apple do not cold-call you about viruses, and the only thing that gets compromised is whatever you let them touch.

An email says your Geek Squad membership just auto-renewed for a few hundred dollars and gives you a number to call for a "refund." There is no subscription and no charge. Calling hands you to a scammer who will walk you into giving up bank access to "reverse" it.

Someone claims to be the IRS, Social Security, Medicare, or the police and demands immediate payment or your personal details — or else. Real agencies do not open with threats, do not take gift cards or crypto, and do not arrest you over the phone. The pressure is the product.

A call, text, or email claims there is a problem with your Amazon account, order, or Prime membership, and that you must act now. Amazon does not fix account problems by asking for gift cards, remote access, or your password. The "problem" exists only to get you on the phone.

Someone claiming to be your bank's fraud department says your account is under attack and that you need to move your money somewhere "safe." That somewhere is theirs. A real bank never asks you to transfer funds to protect them — the call itself is the fraud.

A caller claims to be the electric, gas, or water company and says your service will be cut off within the hour unless you pay right now, usually by gift card or app. Utilities do not run hour-long ultimatums or take gift cards. The clock is fake; it exists to stop you from thinking.

The phone rings and it is a grandchild in trouble — an accident, an arrest, a hospital — who needs money now and begs you not to tell their parents. The secrecy is the giveaway. AI voice cloning has made the voice convincing; the demand for silence and speed has not changed.

Callers posing as Medicare, an insurer, or a health agency try to pull your Medicare number, bill for care you never received, or sell you fake plans and equipment. Your Medicare number is as sensitive as your Social Security number — guard it. Medicare does not cold-call to sell you things.

The cruelest one: it targets people who have already been scammed. A "recovery agent," lawyer, or official promises to claw your lost money back for an upfront fee — and simply takes more. Legitimate recovery is never sold by cold-callers demanding payment first. Being a victim once makes you a marked target, not a likely refund.

A profile that is a little too perfect builds a relationship fast, then — always before you have met in person — an emergency arrives that only money can fix. The person may not exist; the photos are usually stolen. Affection is the lever, and the asks do not stop after the first one.

A romance scam in a uniform: the scammer claims to be a deployed service member, leans on stolen photos and a patriotic backstory, and uses "deployment" to explain why you can never meet or video chat. The military does not need your money to bring someone home on leave.

Someone claims to have intimate images of you and threatens to send them to your contacts unless you pay — often when they have nothing at all. Paying only proves you will pay again. This increasingly targets teenagers, and the move is the same: stop responding, save everything, and report it.

A storefront with real-looking products and unreal prices takes your payment and either ships nothing or sends a counterfeit. Many are built fast and abandoned just as fast. Pay by credit card so you can dispute it, and be wary of a brand-new site selling brand-name goods for a fraction.

On Facebook Marketplace, Craigslist, and the like, the scam runs both ways — fake listings that take a deposit, buyers who "overpay" with bad checks, counterfeit goods, and a push to move off-platform. Keep it in person, in cash or platform-protected payment, and treat any nudge toward Zelle or gift cards as a stop sign.

An adorable pet, advertised by a "breeder" or seller, that does not exist. You send a deposit, then the fees stack — "shipping," "insurance," a "special crate" — for an animal that never ships. The emotional pull is the leverage. See the pet, in person, before any money moves.

A listing for a place the "landlord" does not own — often with photos lifted from a real listing — collects application fees, deposits, and first month's rent for a unit you will never get keys to. The push to pay before you tour is the tell. Never wire money for a rental you have not stood inside.

A job listing that is really a harvest — for your personal information, an upfront "fee," or your unwitting help laundering money through fake checks. Legitimate employers do not charge you to work or mail you a check to deposit and forward. If the offer arrives before any real interview, be suspicious.

A "work from home" gig pays small commissions for simple tasks — liking videos, rating products — until you are asked to deposit your own money to "unlock" higher earnings. The early payouts are bait. The deposit is the scam, and it does not come back.

Zelle, Venmo, and Cash App are legitimate. The problem is their best feature: payments land instantly and are nearly impossible to claw back, which makes them a scammer's preferred exit. Americans lost close to $400 million to peer-to-peer payment scams in 2024. Treat "send it on Zelle" the way you would treat handing over cash.

A text says you owe a small unpaid toll and must pay immediately to avoid fees or losing your license. The toll agency did not send it; the link harvests your card and details. Real toll systems do not collect by panic text — go to the agency's actual site if you are unsure.

A text claims USPS, FedEx, or UPS could not deliver your package and needs you to click to reschedule or pay a fee. The link is the point — it leads to a fake page built to take your card and login. Carriers do not charge redelivery fees by text.

A text poses as your bank's fraud alert and asks you to confirm a charge or click to "secure" your account. Replying or clicking connects you to the scammer, not the bank. If a text makes you anxious about your money, call the number on your card — never the one in the message.

A stranger texts like they have reached the wrong number, you reply to be polite, and the conversation just keeps going. That is the design. Weeks of friendly chat build trust before the pivot to a "great investment" — it is often the front door to pig butchering.

The costliest fraud there is, measured in dollars. A scammer impersonates an executive, vendor, or trusted partner over email and convinces an employee to wire funds or quietly change payment details. There is no malware to catch — it is social engineering aimed at whoever can move money. Verify any payment change by voice, on a number you already have.

With a few seconds of audio — often lifted from social media — a scammer can clone a loved one's voice and call you mid-"emergency," needing money immediately. Your ear believes it. Agree on a family code word now, and when the panic call comes, slow down and verify on a number you already trust.

AI-generated video puts a familiar face — a celebrity, a CEO, a public figure — behind a fake investment, crypto giveaway, or endorsement. The face is real; the words were never said. If a video is rushing you toward a wallet or a website, assume it is manufactured until proven otherwise.

Phishing used to give itself away with broken grammar. AI fixed that. The emails are now clean, personalized, and plausible, which means the old "look for typos" advice is dead. Verify any request through a channel you control, not the one that contacted you.

An AI chatbot plays the attentive partner, builds a daily emotional habit, then steers the relationship toward gifts, money, or crypto. The affection is generated; the financial ask is the point. Loneliness is the vulnerability being mined.

A finance employee gets a live video call from the "CEO" authorizing an urgent wire — and the face and voice are AI fakes good enough to pass. Real money leaves on a fake instruction. Require a second, out-of-band approval for transfers, because the screen can now lie convincingly.

A call comes in: a child's cloned voice, crying, and a "kidnapper" demanding immediate ransom. No one has been taken — the panic is engineered to keep you on the phone and paying before you can check. Hang up, call the person directly, and confirm they are safe.

Malware dressed as the AI tool everyone is downloading — a fake "ChatGPT," "Midjourney," or "DALL-E" app or extension that quietly steals credentials or installs ransomware. The hype is the cover. Get AI tools from the company's own site, not an ad or a search result.

A bot promises hands-off, AI-powered returns that only go up. There is no bot worth trusting here — it is a Ponzi or outright theft wearing an algorithm's clothes. "Guaranteed" and "AI" in the same pitch is a contradiction, not a feature.

You won a lottery you never entered — congratulations — but first you must pay "taxes" or "fees" to release the prize. You cannot owe fees on winnings that do not exist, and real lotteries do not bill you to collect. The prize is the bait; the fee is the whole scheme.

An unknown relative or foreign official has left you a fortune, and only a few advance fees stand between you and millions. The money is not real and never was — the Nigerian-prince classic in a new envelope. Every fee paid just invites the next one.

A platform, signals group, or "mentor" promises outsized, reliable crypto returns, and the dashboard obligingly shows them. The gains are pixels. The deposits are real and gone. When a withdrawal suddenly requires a "tax" or "fee," you are already past the point of getting anything back.

Send one coin, get two back — straight from a "celebrity" livestream or a deepfaked tech founder. No one doubles your crypto for free. The giveaway is a one-way door, and the famous face is borrowed.

Developers launch a token or NFT project, manufacture hype, pull in money — then drain the liquidity and vanish, leaving worthless coins behind. The whole arc can take days. Anonymous teams, buy-only trading, and guaranteed moonshots are the warning signs.

You hit a website, see a routine "Verify you are human" box, and it tells you to press a couple of keys to prove it. Those keystrokes don't prove anything — they paste a hidden command that installs malware you typed in yourself. Security researchers call it ClickFix, and in 2026 it became one of the most common ways attackers break into a device, because you do all the work and your antivirus never sees a file.

This one is patient and quiet. A criminal pairs your real Social Security number with a fabricated name and birthdate to build a brand-new "person," then uses it to open credit. Standard credit monitoring will not catch it, because the name is not yours. The damage can sit for years — US lenders carried $3.3 billion in exposure in 2025 alone — and a child's unused SSN is the prize.

A malicious QR code — slapped over a parking meter, tucked into a menu, mailed in a fake package — sends your phone to a phishing page or a malware download. You cannot read a QR code with your eyes, which is the whole point. Check where it actually lands before you enter anything.

An attacker convinces your carrier to move your number to their SIM, and suddenly your texts — including two-factor codes — are theirs. From there they drain bank and crypto accounts in minutes. Lock your account with the carrier and move off SMS-based two-factor where you can; app-based codes do not travel with a stolen number.

An email leads with one of your real old passwords and threatens to release webcam footage unless you pay in Bitcoin. The password came from an old breach, and the footage almost never exists. It is a bluff wrapped around one real detail — change any password still in use and do not engage.

A phishing email impersonates a breach alert — "your data was exposed, reset your password here" — and the link goes to a fake login or "identity protection" page built to capture credentials. The irony is the point: it weaponizes your fear of being hacked. Go to the real site directly, never through the email's link.

A fake site lives one keystroke from a real one — "paypa1.com," "arnaz0n.com" — close enough that a glance or a fat-fingered URL lands you there. It exists to capture logins and payments. Slow down on the address bar, and treat a link's text as a claim, not a destination.

A package arrives that you never ordered. It seems harmless, even fun — but it means a seller has your name and address and is using them to post fake "verified" reviews. The free junk is not the problem; the fact that your information is out there, being used, is.

Shein is a real retailer, not a scam. The concerns are the substance: clothing that has tested positive for toxic chemicals, documented labor and intellectual-property problems, and a heavy environmental footprint. You will likely get your order. Whether you should want it is the harder question.

Cash App is a legitimate platform owned by Block, Inc. — but its money moves instantly and rarely comes back, which is exactly what scammers want. Regulators noticed: in January 2025 the CFPB ordered Cash App to pay $175 million over fraud-protection failures. The app is real. The "Cash App support" agent in your DMs is not.

Wish is a real marketplace, not a fraud — but the record is rough: 1,178 BBB complaints in three years, 87% of them negative, with recurring problems around product quality, misleading listings, and customer service. You can buy from it. Set your expectations accordingly.

AliExpress is legitimate — part of Alibaba, one of the largest e-commerce companies on earth — and it offers real buyer protection. The risks are counterfeits, uneven sellers, and long shipping. Vet the seller, not just the platform.