- Published on
The Three Things Scammers Usually Want
Quick read
For everyone
Main point: most scammers want one or more of three things.
- Your money
- Your personal information
- Access to your accounts
Scams can look very different, but the goal is often the same.
If an unexpected message, call, website, or person asks you to pay, share private details, sign in, install something, or provide a security code, slow down and check carefully.
Understanding what scammers want makes it easier to spot what is really happening.
A little deeper
For curious readers
Scams can arrive in many forms: emails, text messages, phone calls, social media messages, fake websites, online ads, marketplace listings, invoices, job offers, investment opportunities, or romance conversations.
The story changes, but the goal is often the same.
1. They may want your money
This could be a fake bill, fake investment, fake online purchase, fake emergency, fake charity, or payment redirection scam.
2. They may want your personal information
This could include your full name, date of birth, address, identity documents, bank details, tax details, medical details, or answers to security questions.
Even small pieces of information can be useful when combined with other details.
3. They may want access to your accounts
This could mean stealing your password, asking for a login code, tricking you into approving a sign-in, or convincing you to install remote access software.
A useful question to ask is:
“What is this person or message trying to get me to do?”
If the answer involves money, personal information, passwords, security codes, or account access, treat the situation carefully.
Technical notes
For confident users
Scam activity often maps to three broad objectives: financial theft, identity data collection, and account compromise.
Financial theft includes direct payments, card fraud, bank transfer fraud, invoice redirection, investment fraud, cryptocurrency transfers, gift card payments, and mule account recruitment.
Personal information can be used for identity theft, impersonation, targeted phishing, account recovery abuse, credit applications, SIM swap attempts, or future scams. Information that seems harmless in isolation may become valuable when combined with breached data or public social media activity.
Account access can be obtained through credential phishing, password reuse, malware, session theft, OAuth consent abuse, remote access tools, or multi-factor authentication fatigue and code theft.
These categories often overlap. For example, a phishing email may first steal login credentials, then use the account to collect personal information, impersonate the victim, and redirect payments.
A useful risk check is to identify the asset being requested: money, identity data, credentials, device access, or authorisation.
If the request involves one of these assets and was unexpected, it should be verified before continuing.