Scam database

In an advance payment scam, the seller asks the buyer to pay partly or fully in advance before the goods are delivered. After the payment, the seller disappears or stops answering messages and the goods are never delivered.

In a counterfeit scam, the seller claims the product is a genuine brand or designer item but delivers a counterfeit. The most common targets are luxury goods, branded clothing, bags, mobile phones and electronics.

Scammers send text messages or emails in Danske Bank's name. The message urges you to "confirm an upcoming payment" or "approve a transaction" via a link. The link leads to a fake bank page that looks like Danske Bank's genuine page.

On Tori.fi there is a scam where the seller receives a link from the buyer to a fake Tori site that imitates Tori's trade method. While the seller thinks they are receiving a payment via "Toridiili", they end up giving their credit card and bank details to the scam site.

The scammer sends a message on WhatsApp posing as the recipient's child. The scammer claims to have changed number and asks to be contacted on the new number. In the conversation, the scammer eventually asks for money to be transferred for various needs, such as buying a new phone.

The scammer sends a text message in the name of the Tax Administration's Omavero service. The message claims that a new message is waiting for the user in Omavero and urges clicking a link. The link leads to a scam site that fishes for personal and bank details.

The scammer sends text messages in the name of Customs, Posti or Itella. The message reports an arrived parcel that can be redirected to a new address by identifying yourself with bank codes. Using the bank codes, the scammers have taken out instant loans in the victims' names.

The scammers create a WhatsApp account with the company CEO's name and picture and approach the employees. The messages ask for urgent payments or deposits related to company acquisitions that must be kept secret. It is claimed that the CEO is in a meeting and cannot talk on the phone.

The victim receives a text or WhatsApp message that appears to come from S-Pankki. The message asks you to update the S-mobiili app to ensure security. The link leads to a scam site that fishes for bank codes.

In this scam, the seller advertises a product they do not actually have. The advert uses images copied from the internet, and the aim is to get the buyer to pay for a product that does not exist or is never delivered.

In this scam, the buyer claims to have paid for the product and sends a "screenshot" of the payment, which is however forged. The seller never receives the money in their account but believes the payment has already happened and posts the goods to the scammer.

The scammer claims to arrange a "safe" transport or freight service and asks the seller to pay for the freight, insurance or other extra costs in advance. In the end no freight comes, and the scammer disappears with the paid money.

The scammer pays for the product, for example with PayPal or a credit card, receives the product, but reverses the payment afterwards (chargeback). The seller loses both the sent product and the money, because the payment service refunds the payment to the buyer.

The victim receives a text or WhatsApp message that appears to come from Danske Bank. The message urges you to click a link to solve an account problem or to download a "security update". The link leads to a scam site that fishes for bank codes.

The customer is informed by email or text message that they have "won" money in a campaign or lottery organised by Danske Bank. To claim the prize, they are asked to enter account and card details on a scam form.

In this scam, the seller makes the boxes heavy by filling them with sand, stones or other heavy material. The buyer pays for the product based on its weight and receives a worthless product. Common especially in the sale of electronics.

The scammer uses a stolen identity's details to create the impression of a trustworthy seller. Sells products that do not exist and uses a real person's name, email and sometimes even address.

The scammer sends emails or messages promising big discounts in popular online shops. The coupon codes are fake, and the links lead to scam sites that steal card and personal details.

The scammer sends the victim a text or WhatsApp message that appears to come from Nordea Bank. The message demands that the user "confirm" their details or update their account via a link. The link leads to a scam site that fishes for bank codes or credit card details.

The victim receives a text message or email that appears to come from OP (OP Financial Group). The message claims that the user's account has been restricted or requires an urgent confirmation. Via a link or attachment, they try to fish for the user's bank details.

Criminals send text messages and emails in the name of the police, the National Bureau of Investigation or another authority. The sender may show, for example, "KRP", "POL-KRP" or "KrpKutsu". The messages scare you with a summons to questioning, a traffic fine or other criminal penalties, so that the victim clicks a link. Behind the link opens a fake page bearing the police logo, made to fish for bank codes. Extortion messages have also been sent in the name of the police and the National Cyber Security Centre.

The National Cyber Security Centre has received reports of scams based on recorded robocalls, where the caller poses as, for example, a bank's technical support and claims that suspicious activity has occurred on the account. The recording asks you to select a number so that the call is "connected" to the bank's security department. The calls often come from foreign numbers. The aim is to create urgency and fear and get the victim to hand over their codes or transfer money.

Criminals lure victims into investing money in fake investment or cryptocurrency schemes where unrealistically high returns are promised. The contact may come via an advert, social media or a call. At the start, small "returns" may be shown so that the victim invests more. The money ends up with the criminals and cannot be recovered.

Deepfakes produced with AI are increasingly exploited in scams. They have been detected, for example, in investment and CEO scams, where a well-known person's or manager's face and voice are forged in a video or a call. The forgery makes the scam very convincing and hard to recognise.

The scammer creates a relationship of trust with the victim on a dating site or in social media and builds an emotional bond before asking for money. At some point "unexpected setbacks" arise, because of which the victim is asked to transfer money or buy gift cards. About 460 police reports of love and document fraud were made to the Finnish police in 2024, and a total of about 7.2 million euros was lost in them.

The National Cyber Security Centre has received a large number of reports of fake online shops early in the year. The site may look completely genuine or resemble a well-known brand, and you can also end up on it via paid ads. The product is never delivered, or a cheap imitation comes instead, and in the worst case the entered card details end up with the criminals.

A scam page or message asks you to enter your phone number for "verification" and then shows a code. The code actually relates to linking a new device to your WhatsApp account. When you enter the code, the attacker gains parallel access to your account and can read and send messages and spread scams in your name.

In the name of debt collection agencies, scam messages have been sent claiming that an invoice is unpaid or that a debt is going to collection. The message urges you to pay or confirm details via a link that leads to a phishing site. Observations have been made daily.

In messages sent in the name of a dental appointment booking, you are reminded of a booked appointment and told that an unused appointment is charged with, for example, an 80-euro visit fee. The aim is to get the recipient to cancel or confirm the appointment via a link in the message, which leads to a scam site.

A text message claims that a child welfare report concerning the recipient has been initiated. The message causes alarm, and its purpose is to get the victim to click a link "to view the report's details". The link leads to a scam site.

In a message sent in Telia's name, it is claimed that the recipient has an unpaid invoice that is going to collection. The message urges you to pay the invoice immediately via a link to avoid additional costs and restrictions of services. The link leads to a phishing site.

In Fortum's name, scam messages have been sent to fish for the recipient's details. Collected details, such as a phone number or account number, are probably used later in scam calls and other fraud.

The message scares you with the claim that "there is a news photo of you", and the link leads, for example, to a fake of the Finnish Broadcasting Company's news page. Behind the page is an identification page that fishes for the victim's bank codes. The phishing page looks the same as many other scams made with different themes.

A forged message in the tax authority's name offers more tax refund on the grounds that the amount paid earlier "was too small". Behind the link, they try to get the victim's online banking codes. The scam exploits the tax season and people's interest in refunds.

The scam begins with a text message in Traficom's name asking for payment of an overdue invoice and threatening legal proceedings. When the victim reacts, they are soon called in the bank's name and it is claimed that the accounts have been hacked, in order to obtain the remaining codes and empty the accounts. With this pattern, tens of thousands of euros have been lost.

In a scam targeting companies, it is claimed in the name of Statistics Finland that the company must report its debts and loans, or in the name of the business register that the company's details have not been updated. The link in the message leads to a scam site, and the collected details are used in invoicing fraud.