The Biggest Online Scams of 2026 (So Far) — and What's Coming Next

A year of new masks on old tricks

Scan the headlines and it can feel as though a new kind of online fraud is invented every week. In truth, most of what makes the news is not a new scam but a new coat of paint on a very old one. The tools change — a cloned voice here, a slicker fake shop there — but the machinery underneath barely moves, because it runs on a small, stable set of human reflexes that no software update can patch: the urge to help someone in trouble, the fear of losing money, the pull of a bargain, the wish to be trusted and to trust.

This article is a tour of the scams doing the most damage as 2026 unfolds, grouped so that the shared pattern becomes visible rather than lost in the variety. It is not a countdown or a league table — precise rankings shift constantly and any firm number would be a guess — but a map of the territory, with a route into each topic if you want to go deeper. At the end we look at how artificial intelligence is changing the threat, and at the single habit that keeps working no matter which version knocks on your door next.

Impersonation: the scam wearing a trusted face

The largest share of everyday online fraud is impersonation — a stranger borrowing the identity of something you already trust so that its authority does the persuading for them. This is the family your whole inbox and phone belong to.

It includes the bank impersonation call that spoofs your bank's number and talks you into moving your own money "to safety"; the fake delivery text demanding a tiny redelivery fee to harvest your card and set up a follow-up call; the "Hi Mum" message that plays on love from an unknown number; the phishing email engineered to make you click before you think; and its physical cousin, the QR-code trap that hides a hostile web address inside an innocent-looking square. Different costumes, one method: reach you through a channel you use for real business, wear a trusted name, and manufacture a reason to act now.

Buying and selling: where your money meets a stranger

The second great cluster gathers around commerce — the moment you hand money to someone you cannot see.

Here sit the fake online shops that are mass-produced from off-the-shelf templates, harvest a wave of orders, and vanish; the marketplace traps on Vinted, eBay and Facebook that try to lure buyers and sellers off the platform's protection; and the subscription trap that turns a "free trial" into months of quiet charges. The thread running through them is a nudge toward payment you cannot reverse — a bank transfer, a captured card, an irreversible method chosen precisely because it slams the door on a refund, as our ranking of how to pay online safely sets out in full.

The long cons: investment, crypto and romance

Some scams are not a quick strike but a slow cultivation, and these tend to inflict the heaviest individual losses.

Investment and crypto scams dress fraud in the language of responsible finance — slick dashboards, calm "account managers", returns that never dip — and lean on cryptocurrency's irreversibility to keep the money once it moves. Romance scams build a real relationship on a false person before ever mentioning money, exploiting not carelessness but the human wish to be known. The two increasingly merge in the "pig-butchering" pattern, where a patient online friendship or romance becomes the on-ramp to a fake trading platform. Because these cons run on genuine emotion, they are the hardest to see from the inside and the cruellest when they collapse.

Identity, jobs and the trap after the trap

Three more categories round out the year's picture, and they often feed one another.

Identity theft is the quiet crime that turns leaked personal details into accounts, loans and benefits opened in your name — sometimes the end product of a phishing page or a data breach further up the chain. Fake job offers prey on hope, extracting upfront "fees", identity documents, or your bank account itself in a money-mule scheme. And shadowing all of the above is the recovery scam: weeks or months after a loss, a stranger makes contact promising to recover the money for a fee paid up front — a fresh con that preys on people the first scam already hurt, and one of the most reliable ways to turn one loss into two.

| Scam family | The lever it pulls | Where to read more | | --- | --- | --- | | Impersonation | Trust in a familiar name and authority | Bank, delivery, "Hi Mum", phishing, QR | | Buying and selling | The wish for a bargain; an irreversible payment | Fake shops, marketplaces, subscription traps | | Long cons | Genuine emotion — hope, love, financial ambition | Investment/crypto, romance | | Identity and jobs | Leaked data; the need for work | Identity theft, job scams | | Recovery scams | Desperation to undo a loss | The sequel to every scam above |

What's coming next: AI moves the goalposts

The clearest trend running beneath all of this is that the tools are getting cheaper, faster and more convincing, and artificial intelligence is the reason. It is worth being measured about this rather than breathless, because the fundamentals have not changed — but the friction has fallen, and that matters.

Three shifts are already visible in outline. Written scams are getting harder to dismiss on spelling and grammar alone, because polished text is now trivial to generate at scale. Voices and faces can be imitated well enough to power the family-emergency call and the fake-executive payment, which is why we have a dedicated piece on voice cloning and deepfakes. And the growing pools of leaked personal data make targeting more personal — a scam that already knows your name, your recent purchase or your employer is far more persuasive than a blind guess. A fourth shift is quieter but just as consequential: automation is beginning to run the conversations themselves, so a plausible back-and-forth no longer needs a human tending every victim, which lets a single operation stretch across many more targets at the same time. None of this invents a new human weakness; it simply lets the old exploits run more cheaply, more convincingly and against more people at once. The sensible reading is not panic but a shift in where you place your trust: away from how genuine a message looks or sounds, and toward whether you can confirm it through a route you chose.

Before you go

Here is the way to carry all of this without needing to memorise a hundred scams. Think of the individual frauds as weather and the human levers beneath them as climate. The weather changes constantly — a new delivery-text wording this month, a fresh crypto brand next month, a deepfake gimmick after that — and if you try to prepare for each front as it rolls in, you will always be a step behind, dressed for last week's storm. The climate, though, barely moves. Urgency, authority, a bargain, love, fear, the hope of undoing a loss: that short list has driven fraud for as long as fraud has existed, and it will still be driving the scams that have not been invented yet.

So dress for the climate, not the weather. Build the handful of habits that answer the levers rather than the disguises — slow down when you are rushed, verify authority through a channel you chose, distrust a payment you cannot reverse, and keep money and strong feelings in separate rooms — and you are already equipped for next year's models, sight unseen, because they will be pulling the same levers in a new costume. That is also the honest place for a tool in all this. Across every scam in this list, the durable move is to check before you commit, and the CheckAScam checker now coming together is meant to make one part of that faster — the sites and links these frauds resolve to, which are addresses it can weigh. The other part, the phone call and the voice and the relationship, will always need a human's pause. It is still being built, and it was never going to replace the pause; it is there to reward it.