Personal Advice: The Evolution of Phishing
May - June 2026
How scams are reaching people across different channels
Phishing is often associated with suspicious emails, but scam attempts now reach people through many different channels. Cyber criminals may use emails, text messages, phone calls, messaging apps, social media, online adverts, QR codes, fake websites, and even video meeting invites to trick victims into sharing information, clicking links, downloading malware, or transferring money.
While the delivery method may change, the underlying tactics often remain the same. Scammers create urgency, impersonate trusted organisations or individuals, and pressure victims into acting before they have time to stop and think. This can include a fake bank warning sent by text, a phone call claiming there has been suspicious account activity, a WhatsApp message pretending to be from a family member, or a fake online meeting invite asking the user to install an “update” before joining. Recent reporting has also highlighted fake meeting invites abusing platforms such as Zoom, Microsoft Teams and Google Meet.
How These Scams Work
Phishing, vishing and smishing all rely on social engineering. This means criminals try to manipulate people into taking actions they would not normally take. They may impersonate banks, government services, police, delivery companies, online retailers, technology providers, charities, or people known to the victim.
Scammers often begin by creating a believable reason for contact. This may include an alleged suspicious payment, a blocked account, a missed delivery, a refund, an unpaid fine, a prize, or an urgent security issue. They then pressure the victim to act quickly, often by clicking a link, calling a number, entering login details, sharing a one-time code, installing software, or moving the conversation to another platform.
Some scams are relatively simple, such as a text message containing a suspicious link. Others are more involved. For example, a victim may receive a call, then be contacted again through WhatsApp, Google Meet, or another service. Criminals may also use personal information and familiar platforms to make the scam more believable.
A WhatsApp message may feel personal, a phone call may feel urgent, and a Google Meet or video call may appear more official. However, legitimate organisations will not ask for passwords, one-time codes, screen sharing access, or urgent payments through unexpected calls or messages.
Recent Local Incidents
Recent reports to the CSC show that scam attempts are increasingly being delivered through a range of communication channels, including phone calls, text messages, and video calling platforms.
One report involved a resident receiving a message on Facebook Messenger claiming they had won money. The message stated that the victim needed to transfer £500 in order to release an apparent £10,000 prize. This type of scam is designed to make the victim believe they are receiving a larger financial reward, while pressuring them to pay an upfront fee first.
Another report involved a victim receiving a call from someone claiming to be from Santander, followed by a WhatsApp call from another individual who appeared legitimate and had detailed personal information about them. During the call, the victim was instructed to enable screen sharing, log into online banking, share a one-time code and authorise a payment. This resulted in a reported loss of £4,000 with further attempted transactions stopped before completion.
These incidents highlight how phishing, vishing and smishing scams are no longer limited to suspicious emails or traditional phone calls. Criminals are adapting their methods and using familiar platforms to appear more convincing, create urgency and pressure victims into taking action. Whether contact comes through email, text, WhatsApp, Google Meet or a phone call, unexpected requests involving payments, account security, one-time codes, screen sharing or personal information should always be treated with caution and verified independently.
How to Protect Yourself
Stop and take a moment: If you receive an unexpected call, text, email, WhatsApp message, or meeting invite, do not feel pressured to respond immediately. Scammers often rely on urgency to stop you thinking clearly.
Verify the contact independently: If a message or call claims to be from your bank, a government service, police, or another organisation, contact them using a trusted method. Use the official website, a number on the back of your bank card, or contact details you already know. Do not use numbers, links, or email addresses provided in the suspicious message.
Do not share sensitive information: Never share passwords, PINs, one-time passcodes, banking details, or personal information with someone who has contacted you unexpectedly.
Be careful with links and downloads: Avoid clicking links or downloading apps from unexpected messages. If you need to access an account, go directly through the official website or app.
Check the sender carefully: Look for unusual numbers, spelling mistakes, slightly altered names, or email addresses that do not match the organisation they claim to represent.
Be cautious of video calls and meeting invites: If you receive an unexpected Google Meet, WhatsApp, Teams, or video call claiming to be from a bank or support service, treat it as suspicious. Do not join, download software, or provide personal information unless you have independently confirmed it is genuine.
Act quickly if you think you have responded to a scam: If you have shared banking details, made a payment, provided a one-time code, or allowed access to your device, contact your bank immediately. Change affected passwords and report the incident as soon as possible.
Report suspicious contact: Reporting suspicious messages, calls and scams helps build a clearer picture of the threats affecting Island residents and may help prevent others from being targeted.
More information about phishing, vishing, and smishing scams and a wide range of other related topics can be found in the advice and guidance section of the CSC website. Visit our advice and guidance page here: csc.gov.im/advice-guidance