This week in scams: the tactics circulating right now
A regularly-updated digest of the scam tactics fraud agencies and our own monitoring are seeing most right now — toll and delivery smishing, AI voice-clone and deepfake fraud, “safe account” bank-impersonation calls, and second-wave recovery scams — with links to what each looks like and how to shut it down.
As of 2026-09-28, the official regulator warning lists ScamEncyclopedia tracks name 11,139 flagged firms and websites, and our breach monitor covers 1,038 known data breaches — the raw material behind most of the tactics below.
Smishing — scam text messages — remains the highest-volume tactic: fake “unpaid toll” demands, missed-delivery notices, and “bank refund” texts that funnel you to a lookalike page to harvest card details and one-time codes. The rule that defeats all of them is the same: never act on a link in an unexpected text; reach the organisation yourself using a number or address you already trust.
AI-enabled fraud is the fastest-moving branch. Voice-cloned “family emergency” calls, deepfake “celebrity” investment and giveaway ads, and deepfake video calls impersonating a CEO to authorise a transfer are all in active circulation. Seeing or hearing someone is no longer proof it is them — verify any urgent money request through a separate, known channel before you act.
Two social-engineering classics are also surging. The “move your money to a safe account” call — someone posing as your bank or the police saying your funds are at risk — is never genuine; a real bank never asks you to move money to protect it. And recovery scams target people who have already lost money: a stranger promising to recover your funds for a fee is almost always the same criminal network working the victim lists. Each item below links to a fuller breakdown and the exact steps to take.
What to do
- Treat every link in an unexpected text as hostile — reach the company through a number or app you already have
- Verify any urgent money request (family, boss, bank) through a separate, known channel before acting — a voice or video is no longer proof of identity
- Remember a genuine bank never asks you to move money to a “safe account”, and no one legitimate charges an up-front fee to recover money you already lost
- Never share a one-time passcode with anyone who contacts you, for any reason
- Report scams to your national fraud service so the current waves are tracked