Scams
What a scam message looks like in 2026
Deliveries, refunds and account warnings remain the three dominant pretexts because they arrive when you plausibly expect them. Here is how to read one calmly.
Updated 7 min readqikfox
The short answer
Most scam messages use one of three pretexts - a delivery problem, a refund or payment issue, or an account warning - because each plausibly explains an unexpected message and each justifies urgency. The structure is always the same: a believable reason, a deadline, and a single link. Verifying through a channel you chose defeats all of them.
Key points
- The pretext is chosen to match something you might genuinely be expecting.
- Urgency exists to prevent verification, not to convey importance.
- One link and one action is a structural tell worth noticing.
- Correct personal details prove data was obtained, not that the sender is genuine.
- Voice and video can now be imitated, so unusual payment requests need a second channel.
The three pretexts
Delivery messages work because most people have something in transit and the stated problem is trivially solvable: a small fee, a re-scheduled slot, an address confirmation. The amount is deliberately small enough not to warrant thought.
Refund and payment messages work in both directions. Money owed to you lowers suspicion, while a failed payment threatens interruption of something you rely on. Both push toward entering card details.
Account warnings are the most valuable to attackers, because the target of the exercise is the credential itself. Unusual sign-in detected, storage full, subscription lapsing, action required to avoid suspension.
- Delivery: a small fee, a missed slot, an address to confirm.
- Money: a refund waiting, a payment failed, a subscription lapsing.
- Account: unusual activity, verification required, imminent suspension.
The structure underneath
Strip the branding and every one of these messages has three parts: a reason that explains why it arrived, a deadline that discourages checking, and exactly one route forward. The single route is the tell - genuine organisations expect you to reach them the way you normally do.
Urgency is doing the real work. It is not there to convey importance; it is there to compress the interval in which you might think. Recognising that inversion is most of the skill.
What no longer helps
Poor grammar is no longer a dependable signal, since text generation is trivially available. Correct personal details are not reassurance either: names, addresses, order numbers and partial card digits circulate after breaches, so accuracy proves only that someone obtained data.
Caller display and sender names can be forged, and thread history can be reused after an account is compromised. Voice and video imitation are now practical enough that hearing a familiar voice is not verification for a payment request.
One response that covers all of it
Do not act inside the message. Close it, then reach the organisation the way you normally would - the app, a bookmark, or the number printed on your card - and ask whether the notice is real. Genuine issues will be visible there; invented ones will not.
For requests involving money from someone you know, verify on a different channel and accept a short delay. Legitimate requests survive a five-minute pause; fraudulent ones depend on its absence.
qikfox products aim to help before the click rather than after: safety context alongside search results, and browser warnings that state what was detected and offer a way back. Neither replaces the habit of verifying independently.
Reporting and cleaning up
Report the message to the impersonated organisation and to your national reporting service, then delete it. If you entered credentials, change that password on the real site, sign out other sessions, and enable stronger authentication. If you entered card details, contact your bank immediately - card fraud is usually reversible when reported quickly.
Questions and answers
Related qikfox pages
Recognising phishing pages
What happens after the link is clicked.
qikfox Search
Safety context before the click.
Security Center
Current advisories and notices.
Contact qikfox
Report an impersonation attempt.
Back to Guides · Written and reviewed by the qikfox editorial team. Published .
Put the advice into practice
qikfox Safe Browser applies most of what this article describes by default, and works alongside qikfox Search, Antivirus and VPN.