How We Research & Rate Scams

Where our information comes from

We ground guidance in a clear source hierarchy, preferring primary and official sources over commentary.

• Government and law-enforcement bodies (e.g. FTC, FBI IC3, UK Action Fraud, Europol)
• National consumer-protection and financial regulators and their published warning lists
• Bank, payment-provider, and security-vendor advisories
• Court records, regulator advisories, and official reporting portals
• Reputable, dated cybersecurity research — cited, never presented as our own data

How we cite sources

Where a page relies on a specific figure or a factual claim, we cite the named source with a link, and increasingly the publisher and year. Statistics are quoted from the original agency report — never estimated, rounded up, or invented. Our automated build gate rejects any statistic figure that does not appear verbatim in the scraped source it cites.

How we rate scam risk

Risk levels reflect a combination of how common a scam is, how much a victim typically stands to lose, how hard the loss is to reverse, and how convincing the approach tends to be. They are editorial orientations to help you prioritise caution — not guarantees, and not a substitute for verifying anything suspicious through official channels.

Keeping pages current

Each page carries a 'last reviewed' date. Fast-moving data is refreshed automatically: our threat-feed figures (malicious URLs, crypto-phishing domains, exploited vulnerabilities, tracked data breaches) refresh daily from public databases, and regulator warning-list counts refresh weekly — each shown as an aggregate count with attribution, never republishing the underlying blocklists. Scam alerts and statistics are refreshed from named regulator publications on a recurring basis.

How we handle examples

Example messages and scripts are sanitized and illustrative. We use placeholders such as [name] and [link] and never include real personal data, real account numbers, or working malicious links. Examples show the pattern of a scam so you can recognise it — they are not copies of a specific real message.

What we will never do

• Publish fabricated statistics or figures that are not grounded in a cited source
• Name a specific private individual or company as a perpetrator of a scam
• Republish blocklists, personal data, or working malicious content
• Present illustrative examples as real, attributable incidents

Corrections and right of reply

Regulator warning lists are reproduced as published by the issuing authority and attributed to it; inclusion reflects that authority's determination, not ours. If you believe a page contains an error, or you are named on a reproduced official warning list and wish to respond, contact us and we will review it promptly.