Scam glossary: every term explained simply (2026)

📞 How the scam reaches you 🧠 How you get manipulated 💰 How the money moves 🦠 The technical threats 🔐 The words of protection

📞How the scam reaches you

The channel through which the message or call reaches you.

Phishing

A message or website imitates a trusted source — your bank, a government agency, a delivery company — to push you into entering your login details or bank information.

💡 An email saying "Your account has been suspended, click here to reactivate it" that leads to a fake login page identical to the real one.

Smishing

Phishing by text message. A blend of "SMS" and "phishing". The message imitates a parcel awaiting delivery, a fine, or a tax refund, with a booby-trapped link.

💡 "Your parcel is on hold pending customs fees, pay at this link."

Vishing

Phishing by phone call (voice + phishing). A voice, sometimes artificially generated, pretends to be your bank, the police or an official service to extract information from you verbally.

💡 A fake bank advisor calls urgently to "cancel a suspicious transaction" and asks for your card code.

Quishing

Phishing via a rigged QR code (QR code + phishing). The code redirects to a fake website instead of the legitimate service expected — a restaurant menu, a parking meter, a parcel.

💡 A sticker QR code placed over the real QR code on a parking meter, leading to a fake payment site.

Spoofing

A technique that displays a fake caller ID — your bank's, a loved one's, or a local number — to put you at ease before you pick up.

💡 A call that shows your bank's official number even though it's coming from somewhere else.

🧠How you get manipulated

The psychological techniques that make a scam effective.

Pig butchering

A trusted relationship — friendly or romantic — built over several weeks before proposing a fake investment, often in cryptocurrency, that seems to pay off at first before the invested money disappears.

💡 A contact met on WhatsApp mentions "a cousin who works in crypto" after weeks of friendly conversation.

Romance scam

A fake romantic relationship built online, often over several months, with the sole aim of obtaining money — for a plane ticket, a made-up medical emergency, or fake customs fees.

💡 An attractive profile on a dating app that consistently refuses video calls and asks for money to "come and join you".

Grooming

The gradual manipulation of a minor online by an adult, aiming to exploit them — sexually or financially. The process is slow and deliberately builds the child's trust.

💡 An online "friend" on a video game who gradually isolates a teenager from their real friends.

Sextortion

Blackmail based on intimate images or videos — real, obtained by trickery, or entirely fabricated — to extort money under threat of releasing them.

💡 After an intimate video exchange on Snapchat, the other person threatens to share the recording with all contacts unless a sum is paid.

Doxing (or doxxing)

Researching and publishing private personal information — address, workplace, phone number — with malicious intent, often to intimidate or enable further attacks.

💡 A username unmasked and its real-world address published in a Discord server after a disagreement.

💰How the money moves

The mechanics used to move or extract money.

Money mule

A person, knowingly or unknowingly involved in fraud, who receives stolen money into their own bank account before forwarding it elsewhere — often for a small commission. It's a link used to blur the money's trail.

💡 An "easy, work from home" job offer that simply asks you to route transfers through your personal account.

SIM swap

Hijacking your phone number to a SIM card controlled by a fraudster — often via identity theft against your carrier — to intercept the security codes sent by text and drain your accounts.

💡 Your phone suddenly loses all network signal; a few hours later, your bank accounts have been drained.

Wangiri

Literally "one ring and cut off" in Japanese. A very brief missed call, often at night, from a premium-rate number abroad, designed to make you call back out of curiosity — and charge a high rate for every minute of the callback.

💡 A missed call at 3am from a number starting with an unfamiliar country code you don't recognise.

Brushing

A seller sending an unordered parcel to your address, then publishing a fake "verified purchase" review in your name on an online marketplace, without your consent.

💡 A small unfamiliar item delivered in your name that you never ordered.

🦠The technical threats

What installs on or acts on your device.

Malware

A general term for any program installed on your device without your knowledge, aiming to steal data, spy on your activity, or take control of it.

💡 A fake photo-editing app downloaded outside official stores that actually accesses your contacts and texts.

Ransomware

Malware that encrypts — locks — your files and demands a ransom payment, often in cryptocurrency, to unlock them. Paying never guarantees your data will actually be recovered.

💡 A locked screen showing a countdown and a Bitcoin payment demand to regain access to your photos.

Trojan horse

Malware hidden inside an app, a cracked game, or a file that looks perfectly harmless — the name comes from the mythological trick of the same name.

💡 A cracked "free" version of a paid game that quietly installs remote access on the device.

Deepfake

An image, voice or video wholly or partly faked with artificial intelligence to convincingly impersonate someone else — a loved one, a celebrity, a company executive.

💡 A video call where "your boss" asks for an urgent wire transfer, with an artificially generated voice and face.

🔐The words of protection

The vocabulary of the tools that defend you — so you understand what you're being asked to activate.

Two-factor authentication (2FA)

A second check, in addition to your password, to confirm it's really you logging in — a code sent by text, a dedicated app, or a physical key.

💡 After entering your password, a 6-digit code is requested, received by text or generated by an app.

OTP code (one-time password)

A single-use code, valid for only a few minutes, used to validate a sensitive action — a login, a transfer, a password change. Never share it with anyone, even by phone: no legitimate bank ever asks for it.

💡 "Never share this code, even with an advisor" — the line that accompanies almost every legitimate OTP text.

End-to-end encryption

Technical protection that makes a message readable only by its sender and recipient — no one else in between, not even the messaging app itself, can read it.

💡 WhatsApp and Signal use this encryption by default on private conversations.