Recognise everyday scams, with practical WhatsApp and Telegram lessons on account takeover, fake support, group and crypto traps, privacy, recovery and a messaging safety checklist.
These are realistic simulations based on recurring reported patterns. No message is copied from a private victim conversation.
Platform names and logos identify the type of simulated message for educational purposes. Stable Circle Academy is not affiliated with or endorsed by these platforms, and third-party trademarks remain the property of their owners.
Select a pressure tactic. The counter-move works even when the scam is completely new.
Act now before you can think or verify.
Pause for ten minutes and independently contact the real person or organisation.
Figures are historical reported data from the linked official source. They illustrate patterns, not the probability that any one learner will be targeted.
The FTC reported $2.7 billion in reported losses from scams originating on social media from 2021 through June 2023. Shopping produced the most reports; financial-opportunity scams produced the largest losses.
Verify: FTC Data Spotlight ↗IC3 recorded about $6.57 billion in related financial-fraud losses in 2024 and about $672 million in confidence and romance-fraud losses. Reports are not the same as all incidents, but they show the scale of harm.
Verify: 2024 IC3 Annual Report ↗SABRIC reported that digital banking fraud represented 65.3% of reported incidents in its 2024 crime statistics and stressed that social engineering exploited human behaviour rather than technical compromise of banking platforms.
Verify: SABRIC 2024 statistics ↗The South African Police Service documented SMS messages that claimed a case or warrant existed for a traffic fine and then directed victims to make fraudulent payments. Verify any claimed fine through an independently found official channel.
Verify: South African Government / SAPS warning ↗If you can recognise the pressure tactics, you can spot new scams even when the story changes.
Using the internet is like learning to drive: useful everyday freedom comes with hazards you can learn to recognise and navigate. Keep enjoying your devices. These lessons build confidence through practical habits, not fear; no habit removes every risk.
A scammer creates an emotional state, narrows the victim's options, discourages outside advice and then directs payment or disclosure. The story changes; the pressure sequence repeats.
Most scams lean on a small set of forces: urgency, fear, greed, trust-building, isolation, authority, scarcity, secrecy, social proof, pressure and payment. The details may change, but the emotional structure often does not.
A scammer may pretend to be helpful at first, then create urgency, then push for secrecy and fast payment. That sequence is often more important than the exact topic.
A practical rule is simple: slow down when a message tries to rush you.
A supposed trading mentor shows fabricated account gains, says a limited opportunity closes tonight, and insists the learner keep the method secret from family.
A reusable scam-spotting framework helps learners recognise a new fraud even when they have never seen that exact script before.
When something feels urgent, ask: what am I being pressured to do, what is the payment method, and who benefits if I rush?
Romance scams and impersonation scams build trust before asking for money, secrets or shame-based compliance.
The scammer builds trust or copies a trusted identity, introduces a crisis, and asks for secrecy, money, documents or participation in a supposed financial opportunity. Grooming may last weeks or months.
Romance scams often begin with friendly contact, then intensify over time until the scammer invents travel problems, emergencies, customs fees or supposed financial opportunities. The relationship is the bait.
WhatsApp 'new number' scams and family-emergency scams rely on urgency and trust. The message may claim to be a child, sibling or friend who lost a phone and needs immediate help.
Once emotion is high, the scammer pushes the victim to keep the conversation secret and act quickly without independent verification.
A WhatsApp message says, 'Hi Mom, this is my new number. My banking app is locked and rent is due in 20 minutes.' The profile photo is copied from social media.
Long-term grooming can make a false request feel emotionally reasonable even when it is objectively suspicious.
If someone asks for urgent help from a new number or unfamiliar account, call them back using a number you already trust.
Do not rely on the profile picture or the emotional history alone. Verify identity through a separate trusted channel.
Marketplace scams often look like ordinary buying and selling until the payment or delivery step goes wrong.
Fake buyers and sellers move the conversation off-platform, provide forged proof of payment, send copied courier pages, request overpayment refunds or collect goods before real funds clear.
Facebook Marketplace and similar platforms are common targets for fake buyers, fake sellers, overpayment tricks and fraudulent proof of payment. A seller may receive a doctored EFT slip or a buyer may be sent a fake courier link.
The scam usually tries to move the conversation off-platform into private messaging where evidence is easier to manipulate. Fake customer support or courier staff may then request fees, remote access or personal details.
Always verify payment through your own banking app or trusted payment record rather than a screenshot sent by the other person.
A Facebook Marketplace buyer sends an EFT screenshot and a courier arrives immediately. The seller's own banking app shows no cleared funds.
A convincing screenshot can be fabricated in minutes. Independent verification is what stops the trick.
Before releasing goods, confirm funds in your account and compare the sender details, reference and timing against your own records.
Fake employment, fake stores and fake support are all variants of the same deception pattern.
A fake opportunity or problem creates a reason to pay upfront, disclose identity information, buy equipment, complete endless paid tasks or install remote-control software.
Employment scams may promise easy remote work, ask for a fee to unlock earnings or turn into a task-based scheme that requires more payment to withdraw money. The 'job' is often the lure.
Online shopping scams use fake stores, copied product photos, counterfeit domains and non-delivery. Tech-support scams use phone calls, pop-ups or screen-sharing requests to seize a device.
A common warning sign is any request to install remote-access software or pay a fee before you can receive a promised benefit.
A Telegram recruiter offers simple product-rating work. Early tasks show small profits, then the platform demands a large deposit to unlock earnings.
These scams target people who are trying to earn, buy or fix something quickly, which makes them especially effective.
Never let a stranger control your device or ask you to pay money to unlock wages, refunds or support.
Authority and legitimacy are powerful tools for fraud when they are faked.
Fraudsters borrow authority, regulation, celebrity or charitable urgency. They threaten consequences or promise exceptional returns, then route payment to accounts they control.
Government, police, tax, courier and bank impersonation scams use authority to create fear. The scammer may threaten arrest, account closure or a lost package unless payment or verification happens immediately.
Financial-opportunity scams can involve forex, shares, commodities, property, AI bots, crypto, fake trading platforms and Ponzi or pyramid structures. The promise is usually an outsized outcome with little risk.
Charity and disaster scams exploit sympathy after a crisis. They can be especially convincing because the emotional goal is to help, not to profit.
A WhatsApp group impersonates a financial company and promises R6,000 back from R2,500 in a short period, echoing a 2025 FSCA public warning.
The more convincing the authority or opportunity, the more important it is to verify independently.
If someone claims to be a bank, tax office or police officer, end the call and contact the organisation using a number from its official website.
A threatening traffic-fine message can be a payment-phishing trap, even when it uses official-looking names, logos or legal language.
Criminals impersonate a traffic authority, claim that a fine is overdue, threaten penalties or legal action and push the recipient to a fake payment page. The page may steal card details, banking credentials, a PIN, an OTP or other login information.
Criminals may send an SMS, WhatsApp message or email claiming that you have an unpaid traffic fine. The message may threaten additional penalties or legal action, claim the fine must be paid immediately, or include a link to a copied payment website.
Do not click a suspicious payment link and never provide card details, a banking password, PIN, OTP or login credentials. A professional-looking page does not prove that the payment destination is legitimate.
Verify the fine independently through the official website or contact centre of the relevant traffic authority. Do not use the contact details or payment link contained in the suspicious message.
An SMS says an unpaid traffic fine will trigger legal action today. A short link opens an official-looking payment page that asks for card details and an OTP.
Threats and urgency can push a person to pay before checking whether the fine, authority or payment destination is real.
Close the message. Find the relevant authority through an independently verified government website, then check the fine using that official channel.
Urgency + threats + a payment link = stop and verify first. Legitimate organisations should never require your banking PIN, password or OTP to pay a traffic fine.
Modern scams can use cloned voices, fake videos and malicious links to create pressure quickly.
AI can imitate a voice, face or writing style in real time, while phishing links steal credentials and sextortion uses fear or shame. Deepfake community streams, fake giveaways and poisoned search ads can all look professional without being authentic.
AI-generated images, real-time voice clones and deepfake video calls can make a message seem far more believable than a simple text scam. These tools are used to impersonate family members, managers, influencers and customer support agents, including fake community livestreams and giveaway announcements.
Sextortion and blackmail often combine embarrassment with urgency. The scammer may claim to have compromising images or to know private information and then demand payment or more content.
Phishing, smishing and malicious links remain common entry points because they can steal credentials, reset access or install malware with a single click. Search-engine poisoning adds malicious Google or Bing ads and look-alike results that imitate real wallet tools, bridges and explorers. Type a known address or use a verified bookmark instead of trusting the first result.
A video call that looks like a community leader announces an urgent giveaway and tells viewers to open the first sponsored search result. The result imitates a real explorer but requests a wallet signature.
A realistic voice or video does not prove authenticity. The verification habit matters more than the media quality.
When a message is emotionally intense, verify through a second channel you already trust before replying or paying.
Do not pay blackmailers, do not click rushed links and do not share private material to prove you are real.
If you clicked, replied, paid or shared information, the response should focus on limiting further damage.
Scammers often follow the first loss with account takeover, identity misuse or a fake recovery service. Fast containment and evidence preservation reduce secondary harm.
Stop the conversation, preserve evidence and report the account or number. Change passwords if login details were shared, and contact financial providers quickly if money was sent.
If identity documents, selfies or banking details were shared, watch for account misuse and place fraud alerts where available. If you installed software or granted remote access, remove it and review the device carefully.
The sooner you act, the better your chance of reducing additional harm.
After losing money to a fake trading platform, a supposed law firm offers recovery for an upfront fee. It is a second scam targeting known victims.
The first mistake does not have to become the final one. Rapid follow-up can still protect other accounts and money.
Save screenshots, note dates and times, and move the conversation to a safe record before blocking the scammer.
An attacker can misuse your WhatsApp identity through registration-code theft or a linked device.
An attacker starts registration with your number, then invents a reason to ask for the six-digit verification code. Another trick asks you to scan a QR login code or approve device linking disguised as a vote, giveaway or support check.
The registration code and the two-step PIN/password are separate secrets. Neither belongs in a chat. QR login codes and linking approvals can grant access while your phone still works. Receiving an unexpected code alone does not prove a takeover.
Encryption cannot make an attacker-controlled account or linked device trustworthy. A real friend's compromised account may send the request.
If locked out, re-register your number using the official WhatsApp app on a trusted phone. Follow its verification and recovery instructions. An unknown two-step PIN/password may require recovery or a waiting period; the official PIN guide describes seven days. Nobody offering paid recovery can legitimately bypass the app's waiting instructions.
A school-group friend says, 'I sent my code to your number by mistake.' Later a vote-for-my-child page asks you to link a device.
Combining account controls with independent verification helps protect your conversations, contacts and money.
Find Linked Devices without linking anything. Check you recognise every entry.
A scam can imitate family, a boss, a business or support, including from a real contact's hacked account.
The sender borrows trust and adds urgency to redirect money or obtain a login. New-number stories, family emergencies, fake boss requests and changed supplier bank details all try to skip normal checks.
Saved chat history is not proof of who is typing now. Call a previously known number or use an established separate channel. Do not use the new number or callback link supplied in the request. Follow normal family or business verification; a familiar-sounding voice alone is not enough for an unusual payment.
A business-account label, logo or verification badge does not prove a payment request is safe. Fake Meta/WhatsApp support may threaten suspension or offer a badge to steal credentials. Open support from the app yourself.
Unsolicited groups may stage fake testimonials, forwarded claims and giveaways. Verify admins with an independently known organisation contact; leave suspicious groups. Shortened links hide destinations. A QR code can hide a payment destination, phishing page or device-linking request; inspect its purpose instead of trusting its appearance.
Module 4 explains WhatsApp profile-photo, About, Status and Groups privacy. These settings reduce exposure but do not prevent a hacked contact from messaging you.
Your boss's photo appears on a new number asking for R2,500 urgently. A group admin posts testimonials and a QR payment code.
Combining account controls with independent verification helps protect your conversations, contacts and money.
Choose a known callback channel for urgent family and work money requests.
A stolen login code or session can let someone impersonate you and access cloud chats.
Scammers ask for an SMS or in-app Telegram login code, calling it a group-entry or anti-spam check. Telegram account codes can arrive in the service chat named Telegram. Never forward them to a person, bot or supposed staff member.
Enable Telegram Two-Step Verification with a strong password and confirmed recovery email. Review Settings > Devices / Active Sessions. Changing a password is not a substitute for terminating attacker sessions.
If you retain a trusted session, use it to terminate unknown sessions and change the Two-Step Verification password. Check recovery email. Avoid logging out your last trusted session during recovery.
If locked out, regain control of your number through your carrier and follow the official app's login/password-recovery flow. A fresh login may temporarily be unable to end older sessions: use an existing trusted session or follow the app's waiting instructions. Without your number or any session, recovery may not be possible through the normal route. Read warnings before an account reset/deletion, which can lose data.
After Kabelo posts in a group, 'Telegram Safety' DMs him asking for the code in his Telegram service chat to prevent a ban.
Combining account controls with independent verification helps protect your conversations, contacts and money.
Locate Active Sessions and recovery settings without sharing private screenshots.
Fake helpers exploit group conversations to offer private support, airdrops or investment access.
After you post, an attacker DMs you with an admin's cloned photo and similar name. Compare the exact @username against an independently verified source. Basic Telegram usernames use Latin letters, digits and underscores: l/I lookalikes or added characters can deceive. Display names and linked domains can use Unicode character substitutions. A photo, display name or admin badge alone is not identity proof.
Legitimate admins should not ask for seed phrases, private keys, OTPs, wallet-connect signatures, remote access or upfront recovery fees to help you. Even a genuine admin account can be compromised. Reach the project's known website independently and refuse unknown wallet requests.
Malicious bots, fake airdrops and verification pages may gather details or ask for a wallet connection followed by a signature/approval. A signature can authorise asset movement even if described as verification or requiring no gas.
Fake support may ask for screen sharing, AnyDesk, TeamViewer or an APK/app. APKs are Android installation packages; malicious files can steal sessions or control a phone. Do not install files sent through Telegram. Use official stores, verify publishers, limit automatic downloads and avoid unexpected executable files.
Fake investment/earnings groups manufacture testimonials and withdrawal screenshots. Pump-and-dump organisers promote buying to raise a token's price, then sell into the demand. A dashboard balance does not prove funds can be withdrawn. Another scammer may offer recovery for an upfront fee.
You ask a wallet question. An admin lookalike DMs an airdrop bot, then says AnyDesk and a wallet signature will unlock your withdrawal.
Combining account controls with independent verification helps protect your conversations, contacts and money.
Compare fictional @circle_help with @circIe_help. Notice the capital I replacing lowercase l; do not contact either.
Privacy settings reduce exposure; encryption does not prove the other person is honest.
Normal Telegram private chats, groups and channels are cloud chats, not end-to-end encrypted Secret Chats. Secret Chats are device-specific one-to-one conversations with end-to-end encryption. They do not protect against a dishonest recipient, a compromised device or someone photographing the screen.
In Settings > Privacy and Security, review phone-number visibility and who can find you by number, profile photos, group invitations and calls. Choose the narrowest useful audience and review exceptions. People who already know your number may still recognise you.
Forwarded Messages privacy can limit a forwarded message linking back to your profile; it does not prevent copying or screenshots. Public group/channel posts can be seen widely. Private invite-only groups still have members who can copy posts. If you administer a group/channel, review its visibility, admins and invite links.
A stranger moves support to a Secret Chat and claims you can safely send your private key there.
Combining account controls with independent verification helps protect your conversations, contacts and money.
Review phone number, group/call invitations, profile photos and Forwarded Messages settings.
Use these twelve checks for WhatsApp and Telegram, and repeat the device review every month.
This is a practical routine, not a guarantee against scams. Make changes in the official apps, never through a helper's link. These practice checkboxes reset on reload and are not saved to your Academy profile.
Naledi checks both apps before joining a community and agrees to call family on known numbers before urgent payments.
Combining account controls with independent verification helps protect your conversations, contacts and money.
Tick each item after checking it in the relevant app. Ticks reset on reload.
The Academy uses authoritative primary sources wherever practical and converts them into beginner-friendly explanations.