Common impersonation patterns
Lookalike domain
A small spelling change, added hyphen or unfamiliar ending imitates a known address.
Fake support agent
A social account offers urgent help, then requests credentials, codes or money.
Modified installation file
An APK or profile is shared through chat and presented as a special update.
Withdrawal-fee demand
An additional tax, verification or release payment is demanded before funds can move.
Message warning signs
- Urgency: “Act now or your account will be closed.”
- Secrecy: “Do not contact the normal support channel.”
- Guaranteed outcome: “This method cannot lose.”
- Credential request: password, one-time code, recovery code or remote access.
- Changed destination: a new download, payment or support address with no independent notice.
- Advance fee: more money is required to release an existing balance.
Verify through a second route
Do not verify a suspicious message using the link or phone number inside that message. Reach the service through a previously confirmed address. Compare the exact domain and recipient, not just the visible display name.
If you suspect fraud
- Stop communication and do not send additional money.
- Preserve URLs, usernames, messages, receipts and transaction IDs.
- Change reused or exposed passwords from a trusted device.
- End active sessions and enable multi-factor authentication.
- Contact the bank, wallet or card provider immediately.
- Report the account or domain to the platform and suitable local authority.
- Scan affected devices and remove suspicious apps or profiles.
Protect future decisions
Use a password manager, unique credentials and transaction alerts. Keep a written record of the verified domain and support route. Slow down whenever identity, terms or payment instructions change unexpectedly.