I’m the Which? Tech editor – here are 7 links I’d never click

Online scams can be frustratingly hard to spot, with criminals using copycat websites, realistic messages and the power of AI to create more believable scams.

We regularly hear from members who have lost money or handed over personal information after falling victim to fraud. In many cases, scammers rely on people reacting quickly without stopping to question what they’re seeing, whether that’s a text message, social media advert or unexpected email.

As Which? Tech editor, Lisa Barber knows that staying safe online often comes down to spotting the red flags before it’s too late. Below, she reveals the links, messages and websites worth avoiding, plus the tell-tale signs everyone should know. 

Get tech help from humans

Solve your tech issues and get expert buying advice by chatting to our support team as often as you need for only £36.75 year.

Buy and save

Save 25% – was £49, now £36.75 for a year, offer ends 8 June 2026

Already a Tech Support member? For more help and 1-2-1 technical advice, including protection against scams and malware, go to our Tech Support online booking tool.

Meet our expert

'I started my career at Which? as an assistant editor on the magazine I now edit, Which? Tech. With more than 20 years’ experience in consumer tech journalism, I’ve commissioned and edited content covering everything from product testing to investigations into scams and online fraud.

'As editor of Which? Tech, I work closely with our Tech Support and scams teams, so I regularly see the tactics criminals use to trick people into opening malicious links, handing over personal data and losing money online. Think before you click – it could save you a fortune.'

Lisa Barber, Which? Tech editor

1. Suspicious social media ads

We spot scam ads on social media all the time and regularly warn people about them in our Scam Alert newsletter.

Some are more obvious than others. Investing in random Bitcoin schemes from a company you’ve never heard of is unlikely to make you money. Buying a patch or some strange ‘miracle’ salt won’t help you lose weight quickly, either. Others are less obvious, such as ads that use a legitimate company’s branding and ask you to fill in a customer survey. 

And even if one seems easy to spot now, there’s a chance you’ll eventually come across one that bypasses your defences, especially as scams become more convincing with the help of AI.

Before you click, ask yourself these two things:

• Is this too good to be true? 
• Is it posted from an official channel of a legitimate company? 

It is, quite frankly, appalling that social media companies aren’t doing more to stop scam ads. When we flag these ads, the platforms typically tell us they've removed the scams due to violating their policies, and that they don't allow scams on their platforms. 

Yet we still see more ads appearing. And you, your friends and your family probably do, too.

Tech analyst firm Juniper Research estimated that social media companies made nearly £3.8 billion in revenue from scam ads in Europe in 2025.

A good antivirus package can help protect you from malicious links, scam websites and malware. See our pick of the best antivirus software.

2. Missed delivery messages

‘Delivery not achieved’ – all I need to do is either click the link or reply ‘Y’ to get it all sorted out. Yeah, right. And I’ve got a bridge I can sell you.

Never, ever click on a link from a message like this. If I’ve got a package I’m waiting for, I’ll always check the official website or app to find out where it is. The Royal Mail app is very useful, too, as you just paste into it the delivery code the retailer sent you. 

Take particular care at busy times of year, like Christmas. Scammers will always try it on then, as they know so many of us are waiting for deliveries. I know someone who ended up handing over their credit card details after ordering a Christmas present online and then falling for one of these messages.

Another giveaway is urgency. Scam texts often try to panic you into acting quickly by threatening returns, extra fees or missed deliveries if you don’t respond immediately. And remember – legitimate delivery firms won’t ask you to confirm sensitive information or payment details via a random text link.

3. Copycat websites

This used to be a common scam, but I haven’t seen it in a while – I’m including it here in case, like whack-a-mole, it pops up again. Particularly as more of us are using AI and relying on it to help find the right site.

Back in the day, you’d use a search engine to find the right website to renew, say, your passport or driving licence. ‘Helpful’ websites would appear, claiming to take the stress out of the process or even pretending to be the official sites themselves.

At best, you’d overpay for something you could have easily done via the gov.uk website. At worst, you’d overpay and hand your details directly to scammers, ready to be reused or sold on.

Only use official websites. For government services, that usually means checking the address ends in .gov.uk. And if you need a hand filling something in, the Post Office can usually help – or you could ask a neighbour or relative.

Be cautious about clicking sponsored search results, too. Scammers have been known to pay for ads that appear above genuine websites in search results.

Things every PC owner should do to keep their data safe – keep personal information secure with strong passwords, two-factor authentication and password-protected drives.

4. Car park QR codes

Gone are the days when we’d all keep loose change in the car. Now, it’s easy to pay for parking using your phone. Or at least it should be.

Have you got the right app downloaded? If not, you might not want to use mobile data installing it, or your signal may not be strong enough. Thank heavens there’s a handy QR code that you can simply scan, click and use to enter your card details.

Unless, of course, it’s a sticker placed over the real QR code that sends you to a phishing website designed to steal your bank details.

I used my home wi-fi to download the parking app most commonly used in my local area. I recommend this, as it’ll save you hassle later on and means you can pay with confidence. Side quest: find out which app your local hospital uses, just in case – your future self will thank you.

If you’re in a car park and there's a QR code, see if you can pay by another way - a website, for example, if you can't download the app. 

Otherwise, if you really have to scan, double-check you’re not scanning a sticker placed over the original. Use your phone's camera and preview the link first in the pop-up that appears. Look carefully at the website address you’re being sent to – does it look genuine?

You can also use a domain checker, such as who.is, to see when the website went live. Scam websites tend to be short-lived, so anything created recently can be a red flag.

5. Ransom emails

This is a particularly nasty scam. You receive an email claiming that someone has hacked your webcam and recorded you – and that the footage will be sent to all your contacts unless you pay up. This won't resonate with everyone, as it depends on what content you enjoy viewing. But it's absolutely terrifying when it reaches its intended audience.

Some versions even include an old password of yours to make the threat seem more believable. Usually, though, that password has been exposed in a historic data breach rather than stolen directly from your device.

These emails are sent out far and wide, and scammers only need a handful of people to panic and pay up to make them worthwhile. Ignore the message. Do not engage. Do not pay.

For peace of mind, run a good antivirus program and change any passwords mentioned in the email, especially if you still use them elsewhere.

Tech Support members, you can also contact our friendly team via our online booking tool if you're still worried.

If you’re concerned that your email account has been compromised, our step-by-step guide explains what to do if your email has been hacked.

6. Password reset emails I wasn't expecting

It's easy to see why scammers send these emails, as they can look incredibly convincing. They often copy the branding, colours and wording used by well-known companies such as Microsoft, Apple, Amazon or Netflix.

The email will often claim your account will be locked or deleted unless you act immediately. Scammers include this as they want you to react emotionally, so you click straight away and give away your data.

Sometimes these emails are actually from the company itself, as it's been triggered when someone enters your address on a login page – either by mistake or as part of an automated attack using leaked passwords from other websites.

Either way, I would never click. 

If you get a password reset email you weren't expecting, go directly to the company’s website or app and check your account there.

Find out more: why did I receive a password reset email I didn't request?

7. In fact, most messages with links in

I'm not just talking about the 'congratulations, you've randomly won an expensive prize even though you didn't enter a competition' or 'you can earn tons of money from a job that sounds too good to be true' messages that are obviously scams. Whether it's an email from what looks like my bank or a WhatsApp message from what appears to be my mobile provider, I don't click.

Scammers can be incredibly inventive in how they persuade you to click. From 'hey mum, I need your help' messages (the first time I received this, both my kids were sitting next to me as we were watching TV) to deepfake video ads on social media impersonating well-known companies or celebrities. 

Remember that it's a scammer's job to find ways to persuade you to give away your details. Even if it's not as overt as demanding your credit card number, simply getting you to give away some information could leave you vulnerable to a spear phishing attack later on, where you're targeted with personalised messages.

Instead, for peace of mind, I ignore and report scam messages. 

If I genuinely believed I was getting an emergency message from my kids, I'd double-check it was them by ringing their actual phone. Or, if this wasn't possible, I'd ask questions only they would know the answer to. And if there's a chance there really is an issue with an account, I check the app or go directly to the relevant website. Then I can be confident I'm not getting scammed. 

Join Which? Tech Support

Get tech help from humans

Solve your tech issues and get expert buying advice by chatting to our support team as often as you need for only £36.75 year.

Buy and save

Save 25% – was £49, now £36.75 for a year, offer ends 8 June 2026

Which? Tech Support can help you keep on top of your home tech. Our experts explain things clearly so that you can resolve issues and feel more confident using your devices.

Get unlimited 1-2-1 expert support:

• By phone – clear guidance on choosing, setting up, using and resolving issues with your home tech devices.
• By email – outline the issue, and we’ll email you our answer.
• By remote fix – we connect securely from our office to your home computer and resolve issues while you watch.
• In print – Which? Tech magazine – six issues a year delivered to your door.

Join Which? Tech Support.