The archive

Online threats we’ve flagged before

The back catalogue. These have rolled off the live radar, but the tricks still go around.

← Back to what’s current

Human-checked. No bots posting straight to your feed. 13 older waves flagged, 5 November 2025 – 7 July 2026.

Privacy

Your chatbot isn’t your mate (and that’s fine)

Spending hours pouring everything into an AI chatbot can quietly mess with your mood, because it feels like it gets you when it actually can’t. It’s not a real friend, and it’s no replacement for actual people when things get heavy.

The move Set yourself limits, take proper breaks, and take the big stuff to a person you trust — not a bot.
Privacy

Some face unlock systems can be fooled by a photo

Some phones, usually ones that just use the front camera, can be fooled by a photo of your face. Face scanners that map your face in 3D are much harder to trick.

The move Use a strong PIN, passcode or fingerprint for your phone lock, and turn on 2FA for your most important accounts.
Seen via Which?
MalwareWhatsApp

That random WhatsApp ‘document’? It can hijack your PC

People are being targeted on WhatsApp with messages carrying what looks like a business document — but it’s really a script file in disguise. Open it on a Windows PC and it can quietly install software that hands a stranger control of your computer.

The move Don’t open attachments you weren’t expecting — check with the sender on another channel first.
Practise it: Swipe to Survive →
Scams

That ‘handmade’ shop with the sad story? Might be all fake

Some accounts on social media are pulling people in with emotional sob stories, deepfake videos and ‘artisan’ shops selling stuff that doesn’t actually exist. The sad story rushes you so you pay before you think to check anything.

The move Slow down, check the shop’s URL properly, and look the seller up somewhere else before you send a penny.
Practise it: Spot the Fake →
Seen via Which?
Account takeoverInstagramMetaTelegram

Hackers tricked Instagram’s AI bot into stealing accounts

People are being targeted via Instagram after hackers worked out how to social-engineer Meta’s AI support bot into resetting passwords. Once they’re in, they lock the real owner out and take over the account. It’s proof that even an official help tool can be played.

The move Turn on two-factor authentication now, so a password reset alone can’t get anyone into your account.
Phishing

Fake World Cup ticket sites are out to score your cash

Scammers are spinning up websites that look exactly like the official FIFA shop, selling tickets and merch that don’t exist. Hand over your card and details and they just vanish with both.

The move Only buy from the official seller — get there by typing the address in yourself, not from an ad, DM or search result.
Practise it: Would You Click? →
Deepfakes

Crooks are using AI to fake images for blackmail

Blackmailers are taking ordinary photos and videos of young people and using AI to twist them into fake or embarrassing images, then using those to threaten them. The pictures aren’t real, but the threats are — and the goal is to scare you into paying or sending more.

The move If someone threatens you with an image, don’t pay or panic — block them, screenshot the threat, and tell a trusted adult straight away.
Practise it: Spot the Fake →
ScamsAndroidGoogle Play

"See anyone’s call history" apps were faking the whole thing

Apps claiming to show you the call log of any phone number got over seven million people to pay up — but they did nothing they promised. Google pulled them, but copycats with new names keep popping back up.

The move Before you pay for any app, search reviews outside the store and check exactly what it’s asking permission to access — if it can’t actually deliver what it claims, it’s a scam.
Practise it: Permission Panic →
Phishing

That ‘your data’s been breached’ alert might be the scam

Scammers are sending fake breach warnings designed to panic you into clicking a link or typing in your login. The whole point is to rush you — fear makes people skip the checks they’d normally do.

The move Don’t tap the link — open the real site or app yourself and check your account there.
Practise it: Would You Click? →
Deepfakes

That panicked voice on the phone? Could be AI

Scammers can now clone someone’s voice with AI to fake an urgent call, like a mate or family member begging for help fast. The whole trick runs on panic, so they push you to act before you think.

The move If a call feels urgent or off, hang up and reach that person back on a number you already have before you do anything.
Practise it: Spot the Fake →
Deepfakes

Nearly all of us use AI now — and half are watching for fakes

New research for Safer Internet Day 2026 shows almost every young person in the UK uses AI, and most say it makes life better. But more than half are uneasy about it being used to make fake or dodgy images of them — deepfakes built from real photos.

The move If a fake image of you or a mate shows up, don’t panic-react — screenshot it, report and block, and tell someone you trust who can help.
Practise it: Spot the Fake →
Account takeoverInstagramTikTokYouTube

Got followers? Scammers want your account, not your content

People with a following on Instagram, TikTok and YouTube are being targeted with fake ‘brand deal’ DMs that hand over login details or drop malware. Once they’re in, they hijack the account to push scams to everyone following you.

The move Turn on 2FA now, and if a brand slides into your DMs, verify it through another channel before clicking anything.
Practise it: Swipe to Survive →
Account takeoverWhatsApp

They don’t need your code if they can watch your screen

Scammers are video-calling people on WhatsApp out of nowhere, claiming to be from your bank or an app’s support team and that something dodgy has happened to your account. Then they talk you into sharing your screen — and every verification code and password that pops up, they’re reading in real time.

The move No bank or support team will ever ask you to share your screen or install an app to fix your account — end the call and open the real app yourself.
Practise it: Swipe to Survive →