Common warning signs include urgent requests for money, unexpected links to log in or verify details, messages that exploit emotion, and offers that seem too good to be true. Friend requests from accounts that look familiar but behave oddly, or messages that pressure the recipient to act quickly, are also strong indicators of social engineering.
How to recognise a scam message at a glance
The strongest clue is usually not one single trick, but a cluster of pressure tactics. Scam messages often try to rush you, move you off-platform, or make you act before you can verify who is really contacting you. The message may look ordinary at first glance, yet its purpose is to bypass your normal caution.
Pay attention to whether the sender is asking for something that should never be handled casually in a message, such as login details, payment, one-time codes, or account recovery steps. If the message creates a sense of urgency or secrecy, that is often part of the scam rather than a sign that the issue is real.
A useful mindset is to treat the message as untrusted until you can confirm it through a separate channel. That means checking the account independently, using a known website or app, and not relying on the link or contact details inside the message itself.
What the message is trying to make you do
Scam messages usually aim to get the recipient to click, pay, reply, or reveal information. The message may imitate a friend, customer support agent, delivery service, bank, or platform notice, but the common thread is that it asks for fast action without normal verification.
Watch for emotional hooks as well. Fear, excitement, sympathy, curiosity, and embarrassment all lower resistance. A message that claims your account will be locked, your package is waiting, your payment failed, or your friend is in trouble may be crafted to prevent careful checking.
Look closely at the request itself. If the sender wants you to sign in through a link, transfer money, approve an access request, or share a code that was sent to you, the message is not just informative, it is trying to steer you into giving away access or value.
Why familiar-looking messages still fail basic checks
Scammers rely on familiarity because it lowers suspicion. A profile photo, display name, or profile that resembles someone you know can be enough to make a message feel legitimate. The account may also use a believable story, copied language, or a hacked friend account to increase trust.
Small details often reveal the fraud. The tone may be slightly off, the wording may be generic, or the conversation may jump quickly to money or credentials. Links may lead to lookalike pages, shortened URLs, or login prompts that do not match the platform you expected to use.
Even when the account is real, the message can still be malicious if the account itself has been taken over. That is why the safe test is not whether the sender looks familiar, but whether the request makes sense and can be confirmed independently.
Risk and Threat Considerations
Scam messages matter because they are often the first step in a larger attack chain. A single convincing message can lead to credential theft, payment fraud, account takeover, or malware delivery if the recipient follows the attacker’s instructions without verifying the request.
Failure mechanism: The attacker abuses trust, urgency, and social context to push the target onto a fake login page, into sending money, or into revealing codes and other sensitive information.
Impact: The result can be direct financial loss, access to social accounts or connected services, impersonation of the victim, and further fraud sent from a trusted account.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1566 — Phishing | Scam messages use phishing-style social engineering to trick users into action. |
| Recommendation — Map suspicious messages to T1566 and train users to verify requests through separate channels. | ||
| CIS Controls v8 | CIS-14 — Security Awareness and Skills Training | User recognition of scam patterns depends on awareness training and reporting habits. |
| Recommendation — Use CIS-14 to train staff on social engineering cues and reporting steps. | ||
| NIST SP 800-53 Rev 5 | AT-2 — Awareness Training | Recipients need training to spot urgency, spoofing and credential-harvesting prompts. |
| AU-6 — Audit Review, Analysis, and Reporting | Suspicious message handling benefits from monitoring reports and post-incident review. | |
| IA-5 — Authenticator Management | Scam messages often target passwords, one-time codes and other authenticators. | |
| Recommendation — Deliver AT-2 training that teaches users to verify unexpected messages before acting. Use AU-6 to review scam reports and spot recurring message patterns. Apply IA-5 to protect and rotate authenticators exposed by social engineering. | ||
Practitioner Guidance
What to verify: Confirm the request by opening the platform or service yourself, not by clicking the message link. If the message claims to come from a friend, ask a separate question through a different channel that only the real person would answer easily.
Decision rule: If the message asks for a login, code, payment, gift card, or urgent action, treat it as suspicious until proven otherwise. If it pressures you to keep the exchange secret or move quickly, assume the pressure is part of the scam.
Practitioner takeaway: The most reliable scam signal is not the appearance of the message, but whether it tries to shortcut verification and force an immediate, high-risk action.
Related resources from NHI Mgmt Group
- What are the signs that a mobile message is part of a cryptocurrency scam campaign?
- What are the signs that a social media cryptocurrency scam is being used to steal money?
- What are the signs that a holiday scam message is likely fake?
- What are the signs that social media linked identity data is misleading fraud controls?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 31, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org