Badly written scams still exist, but they are not the ones that do damage. The ones that work land in the right conversation, with the right logo, and ask for exactly one thing: that you hurry.
The sender is not proof
The number or name shown on a text message can be forged, and the fake lands in the same thread as the real ones, right underneath them. Email addresses are imitated just as easily. A message appearing where the genuine ones appear proves absolutely nothing.
The signal that never misses: urgency
"Account blocked", "suspicious transaction, confirm within 30 minutes", "reply or lose access". Urgency is not a stylistic tic: it is the instrument. Its job is to stop you doing the one thing that would collapse the scam — pausing and checking somewhere else.
What no serious provider will ever ask you for
The one-time code that just arrived. Your password. Your PIN. The full card number together with expiry and security code. To install something that lets them see your screen. To move money to a "safe account": that account is theirs. Anyone asking for one of these is running a scam, full stop, however perfect the logo.
The phone call is the hardest to see through
Someone rings claiming to be the fraud team, knows your name and perhaps your recent transactions. It sounds credible because that data can come from an earlier breach. There is one defence and it always works: end the call and dial the number on your own card or inside your own app. Never a number given to you by the person on the phone.
If you have already clicked
Freeze the card immediately from the app or your account area, change the password from a different device, review your transactions and report the one you do not recognise through official channels. Then file a police report: you need it to dispute the payment, and you need it so that account gets stopped before it is used on somebody else. Nobody ever made things worse by moving fast — the mistake is waiting out of embarrassment.