Advance-fee scam alert: How scammers trick you into paying upfront

Scams aren’t always obvious. Some setups sound reasonable and look highly convincing, especially when fake offers use stolen identities and registration details copied from real businesses or official databases. This borrowed legitimacy can make warning signs harder to spot.

This article explains how advance-fee scams use psychology and confusion to make upfront payment requests seem legitimate. It covers how to spot suspicious payment demands, how to check offers before engaging, and what to do after a suspected scam to protect personal information and funds.

What is an advance-fee scam?

An advance-fee scam is a financial fraud scheme where scammers ask for money upfront in exchange for a promised benefit, such as a payout, loan, job, prize, contract, or investment return. It’s a common “give money to get money” setup.

The scam message typically references an opportunity, reward, or service and then claims that the person must pay a fee before receiving it. The promised benefit never arrives.

How an advance-fee scam works

All advance-fee scams follow a similar pattern.

Phase 1: A fake offer or opportunity

It usually starts with an unsolicited message or call, although some scams spread through social media posts and online ads. The offer promises an attractive benefit or investment opportunity.

Phase 2: A credible-looking pitch

Once the person engages, the scammer builds a pitch around half-truths, borrowing details from real companies, market events, or investment language to feel familiar.

For example, investment scammers may impersonate registered firms, advisers, or newly created companies, using official-sounding claims about initial public offerings (IPOs), private offerings, or market opportunities to appear legitimate. Scammers posing as advisers may start with well-known companies to build credibility, then steer the target toward smaller, harder-to-verify ones.

Scammers also fabricate evidence of success through fake online news, reviews, and testimonials, or by using apps with manipulated account dashboards that show fake profits. The Federal Trade Commission (FTC) warns that investment scammers often invent success stories and testimonials or make an offer seem connected to current news or market trends.

Phase 3: The upfront fee demand

Before the person can receive the promised benefit, the scammer introduces an upfront payment under the guise of a routine administrative step. Depending on the type of upfront-fee scam, this fee may appear as a:

• Tax
• Deposit
• Processing fee
• Application fee
• Withdrawal fee
• Account charge
• Loan repayment or release fee

Phase 4: Repeat extraction attempts

After the first payment, the scammer invents new fees or other excuses to keep extracting money, such as an additional tax, a processing delay, or a verification issue. Some allow a small early withdrawal to reduce suspicion before requesting larger deposits. This exploits the sunk cost fallacy: after money has already been paid, an additional fee may seem like the final step required to receive the promised benefit.

The hidden danger: Data harvesting

Financial loss is the main risk, but some scams also collect personal and financial information. Fake providers may request banking details, identity documents, signatures, or tax information as part of a supposed application or verification process.

Criminals can use this information for identity theft, account takeover, credit fraud, or future scam attempts. Even if no payment is made, shared data can create lasting risk.

Common types of advance-fee scams

Advance-fee scams use different pretenses, but tactics overlap. These are common versions seen online.

Loan and credit scams

These scams promise a loan or credit card regardless of credit history, often via calls or fake ads that pitch quick, no-check approval. Some claim to connect the person with a lender. Approval depends on paying an "application," “processing”, or “insurance” fee.

Also read: But Now Pay Later fraud.

Investment and crypto scams

Investment and crypto scams promote high-return opportunities, fake trading platforms, or supposed recovery services. Fraudsters may impersonate registered firms, advisers, or Securities and Exchange Commission (SEC) contacts. Crypto variants often advertise deposit bonuses, raffle airdrops, mining pools, or fake account dashboards that show false profits.

Romance and pig butchering scams

Long cons that often start on social media, messaging apps, dating apps, or wrong-number texts. Once trust is built, the scammer introduces a supposed investment opportunity or trading tip and uses fake screenshots or dashboards to push the person toward a fraudulent platform.

Also read: Military romance scams: How to protect yourself.

Job and employment scams

Job and employment scams use fake roles or work-from-home offers that promise high pay for little effort. The person may be asked to pay upfront for training, equipment, supplies, or certifications. Some scams send a fake check as a bonus or equipment payment; the person deposits it, keeps a small amount, and sends the rest for a supposed work task. The bank later reverses the deposit, and the person loses the transferred money.

Lottery and prize scams

Scammers tell the person they've won a valuable prize, often from a foreign lottery, a government-supervised lottery, a giveaway, or a sweepstakes. Some impersonate real companies and use gift card giveaways or promotions as the pretext. To claim the prize, the person must provide personal information or pay supposed taxes, shipping, processing, or customs fees.

Also read: Nigerian prince scam: What is it and how to stay safe.

Rental property scams

Rental property scams use fake ads for attractive rentals at unusually low prices. Scammers may ask for an application fee, viewing fee, deposit, or first month’s rent to “reserve” the property, claiming other renters are interested. Some pretend to be abroad and offer to send the keys after payment. Others pose as listing agents and charge a fake commission or use application forms to harvest data.

Refund and recovery scams

Scammers pose as brokers, recovery services, investigators, or law firms offering to recover stock losses or stolen crypto. They may propose buying worthless microcap shares and exchanging them for blue-chip stocks, but require a deposit, bond, or recovery fee first. Legitimate recovery or blockchain investigation services exist, but they don't guarantee recovery and often require repeated upfront payments to release funds.

Also read: Do banks refund scammed money? How to recover your money.

Beneficiary scams

Beneficiary scams, also known as inheritance scams, often involve phishing emails from a supposed law firm, executor, bank, or estate representative. The message claims that a distant or unknown relative left an unclaimed estate, trust, or insurance payout. To receive it, the person must pay legal fees or taxes, provide bank and identity details, or both.

Why these scams work

Advance-fee scams layer known persuasion methods and technology, often relying on several tactics at once.

Psychological tactics

Fear of missing out (FOMO) is common, especially in investment and crypto fraud. Scammers promote rare opportunities to earn exceptional or guaranteed returns, sometimes claiming the money could double or triple. They may exploit real vulnerabilities in crypto and stock markets to make exaggerated claims feel more plausible and distract from warning signs.

Scams also rely on a false sense of urgency. They may claim the offer is time-limited, or that the price of an investment will rise soon. The goal is to pressure the person into paying before they can verify whether the offer or demand is legitimate.

Confidence tricks help seal the pitch and lower skepticism. Fraudsters may fake social consensus by implying experienced investors have already joined. Some, particularly crypto scammers, add the person to group chats where multiple accounts discuss the opportunity.

Spoofed or stolen contacts

Caller ID may appear to match a real professional, a registered firm, or even the SEC, but that doesn’t mean the call is legitimate. Scammers use spoofing tools to make calls appear to come from an official source.

The sender’s identity can also be faked. Scammers may use a real professional's name and an official-looking email address, link to a real firm's website as a distraction, or set up spoofed sites with similar URLs.

Fake companies copy registration details from official databases like the Financial Industry Regulatory Authority (FINRA) BrokerCheck and the Investment Adviser Public Disclosure (IAPD) database. They might also point to registration filings, legitimate BrokerCheck profiles, or real Central Registration Depository (CRD) numbers copied from registered professionals.

Some even encourage targets to “research” the stolen identity, knowing that real details make the impersonation look credible. A quick search may seem to confirm the pitch, even when the real person or firm has nothing to do with it.

Hard-to-reverse payment methods

Even when people discover the fraud and report it, the money may be difficult to recover. Scammers steer payments toward methods that settle quickly and are often difficult to reverse, dispute, or link to the person behind the account.

Common examples include wire transfers, cryptocurrency, prepaid cards, and gift cards. Wire transfers are often difficult to recover because the sender authorizes the transfer of funds from the account. Prepaid and gift cards are risky because scammers can drain the value once they receive the card number and PIN, though victims should still report the scam to the issuer and ask whether recovery is possible.

Crypto payments, likewise, are generally irreversible once confirmed on the blockchain. There’s no built-in chargeback or dispute process, and pseudonymous wallet addresses can make it harder to identify bad actors.

Also read: What is wire fraud, and how can you avoid it?

Technical complexity

Many scams exploit the complexity and popularity of AI, crypto, and over-the-counter (OTC) trading. They use buzzwords, dense explanations, and vague claims about a company’s strategy or product, making it difficult for investors to verify claims.

Some promote AI trading platforms or AI-focused companies, or firms that claim to use AI to gain a market advantage. The pitch may claim AI will drive future profits, encouraging people to invest before they understand the company’s product, strategy, or risks.

Similarly, crypto involves concepts that may be unfamiliar to many people, such as gas fees, wallet addresses, private keys, and smart contracts. Scammers may use this technical language to make a vague opportunity feel legitimate or exclusive.

In more elaborate versions, fraudsters use pump-and-dump schemes, touting, or rumors to create a false sense of market momentum. These schemes often involve low-priced or microcap stocks, but social-media stock scams can also target people interested in U.S.-listed companies.

Deepfakes and AI-assisted phishing

Videos and audio clips are no longer reliable proof of someone's identity on their own. AI has made impersonation easier than ever through deepfake technology.

Fraudsters can use AI-generated videos to impersonate real people, including in video-conferencing scams. Similarly, voice-changing and cloning tools can imitate someone’s voice or change the scammer’s accent during phishing calls.

AI writing tools can produce targeted emails and messages at scale, in multiple languages. They can also reduce obvious grammar or spelling mistakes, making phishing harder to spot. AI also speeds up the creation of realistic-looking websites and marketing materials, lowering the effort needed to make a scam look polished.

Also read: AI scams explained: Common tactics and how to stay safe.

Private channels and limited safeguards

Scammers sometimes reach out on a familiar platform, then shift the conversation to a private messaging app to avoid detection. These channels may have less moderation, limited reporting tools, or features such as disappearing messages, which can make it harder to document the scam.

In crypto, uneven regulation and inconsistent platform protections can make scams harder to prevent or recover from. Crypto still has fewer consumer protections than traditional card payments in many cases, and safeguards vary by platform and location. If a fraudulent service disappears, people can still report the incident, but recovery or compensation may be limited, especially when funds were sent through crypto or to an offshore platform.

Warning signs to spot early

Many advance-fee scams share similar surface signals:

• Unexpected or too-good-to-be-true offers: Unsolicited messages, guaranteed returns, “no-risk” claims, quick approval, or prizes that require payment first.
• Pressure to act quickly: Urgent deadlines, limited-time claims, or warnings that the opportunity will disappear if payment is delayed.
• Unverifiable contacts and claims: Missing contact details, avoided phone calls, mismatched email domains, unrelated payment accounts, anonymous teams, or claims that don’t match public records or blockchain activity.
• Suspicious information requests: Requests for passwords, crypto seed phrases, private keys, remote access, or sensitive documents through email, messaging apps, or unsecured websites.
• Unusual payment instructions: Requests to pay through wire transfers, cryptocurrency, gift cards, prepaid cards, or accounts that don’t match the named company or professional.

When any of these signs appear, pause the interaction and verify the provider through independent channels.

Suspicious domains

The SEC’s Public Alert: Unregistered Soliciting Entities (PAUSE) list includes numerous entities that have falsely claimed registration, impersonated real firms, or posed as regulators. Although being on the list doesn’t prove theft, it signals a high-risk entity that should be treated with caution.

Warning lists help with cross-checking, but scam operators often shut down platforms and register new domains to avoid detection. Known links may disappear quickly, so it’s important to check current regulator lists rather than relying only on old URLs.

Scam domains often engage in typosquatting, mimicking legitimate brands through small spelling changes, added words, substituted characters, or different domain extensions. An unusual domain ending can be a small warning sign, especially when combined with recent registration, copied branding, vague company details, or mismatched contact information.

Some phishing sites may also use HTTP, but HTTPS alone doesn’t prove legitimacy.

How to protect yourself

Staying safe online starts with independent research and simple habits.

Note: This guide is for educational purposes only and should not be considered financial or legal advice.

Confirm a provider’s legitimacy before interacting

Fake platforms and offers show a few overlapping signs. Here’s what to look for.

• Domain age: Fraudulent operations often cycle domains quickly. Tools like ICANN Lookup show when a site was registered. A recently created domain can be a red flag, especially if the platform claims years of experience.
• Regulatory licenses: SEC’s database and Investor.gov tools can help check company filings, registered offerings, and investment professionals, but registration or filing information doesn't guarantee that an offer is safe. For trading platforms, look for licensing or registration details, usually under the Legal or Disclosures sections, then verify them in official registries, such as the Financial Crimes Enforcement Network (FinCEN) MSB Registrant Search or Financial Industry Regulatory Authority (FINRA) BrokerCheck in the U.S. For crypto platforms, check the regulator in the jurisdiction where the platform claims to operate.
• Official contact channels: Verify suspicious messages through official channels, not the phone numbers or email addresses in the message itself. If a message claims to come from the SEC, use the personnel locator at (202) 551-6000, call (800) SEC-0330, or email help@sec.gov to confirm.
• Payment destination: Check whether the payment recipient matches the company, platform, or law firm named in the offer. Watch out for transfers to unrelated personal accounts, foreign accounts, or companies with different names.
• Market visibility: A provider claiming major market activity and thousands of investors should have a verifiable footprint and credible media coverage. For crypto platforms, check whether the platform or token appears on reputable aggregators like CoinGecko or CoinMarketCap. A provider that claims major trading activity but has no visible liquidity may be fabricating it.
• Crypto transparency: Some crypto platforms publish wallet addresses, proof-of-reserves reports, or other transparency materials, but these should be treated as supporting signals rather than proof of legitimacy. Cross-check licensing, company details, public reputation, liquidity, and whether claims match visible blockchain activity.

Read more: How to check if a website is safe.

Remember security basics

Advance-fee scams can lead to credential theft, so use strong, unique passwords across platforms and services. This limits the damage if a single account is exposed.

Multi-factor authentication (MFA) adds a strong layer of protection against unauthorized logins and transfers. On banking and trading apps, MFA can give people more time to secure funds after a phishing attempt.

Threat protection tools can help block known malicious, phishing, or scam-related domains that security databases have already identified. For example, ExpressVPN’s Threat Manager can block connections to known fraudulent or harmful websites, but it should be used alongside careful link checking and independent verification.

Read more: Our guides on cyber hygiene and internet fraud cover protection in more detail.

What to do if you’ve been targeted

After a suspected scam or confirmed loss, focus on covering immediate risks and long-term reporting.

1. Stop all communication immediately

Stop replying to messages and ignore requests to send more money to recover funds. Some scammers escalate to threats or blackmail. Paying can signal that further pressure may work and can fuel more demands.

2. Secure remaining assets

Change passwords for all exposed accounts. If financial details were shared, contact the provider immediately to freeze cards and block transfers.

If a crypto wallet's private key or seed phrase has been exposed, move any remaining funds to a new, secure wallet. If the issue involved a suspicious connected app or token approval, revoke permissions using a reputable wallet permission checker or blockchain explorer.

3. Document everything

Save details while they’re still easy to find. This includes emails, payment receipts, website links, and screenshots of forms, dashboards, and conversations. For crypto scams, save transaction IDs, wallet addresses, amounts, dates, and the cryptocurrency type.

4. Try to reverse or block the transaction

Contact the bank, card issuer, payment app, gift card issuer, or wire transfer service used for the transfer. They may be able to reverse or block fraudulent payments. Sharing receipts, transfer details, and scam-related messages can support the claim.

5. Report to authorities

In the U.S., report consumer scams to the FTC, internet-enabled fraud to the FBI’s Internet Crime Complaint Center (IC3), and suspected investment fraud to the SEC. The SEC accepts tips and complaints about possible securities law violations, including fraud, Ponzi schemes, insider trading, and market manipulation.

In Europe, report to the local police, the relevant national cybercrime unit, or the national consumer-protection authority. For cross-border consumer scams, econsumer.gov accepts international complaints and shares them with participating enforcement agencies.

For more information on protecting personal and financial information, see the official FTC guidance.

FAQ: Common questions about advance-fee scams