OneHaven Safety Assessment
Nothing was taken. No account was touched, no information was collected, and nothing happened to your phone. This message was a safety exercise, and the link brought you here.
OneHaven Scam Library
What each one looks like, the warning signs, what to do in the first hour if one turns out to be real, and every number and link you need to report it. Written plainly, free, and nothing on this page asks you for information.
If you are feeling foolish right now, please do not. These messages are written by people who do this full time, tested on millions of recipients, and refined until they work. Falling for one is not a sign of carelessness or of age. It is a sign that the message was good. The only thing that reliably helps is having seen one before, which you now have.
Here is what was in the message you just received, what the warning signs were, and what to do if one of these is ever real.
Fraud losses in the United States reached about $16 billion in 2025, the highest on record. Below is what is actually being sent to people right now, separated by who it targets, along with the warning signs and what to do.
The one habit worth building
Not the link, not the phone number in the message, not the reply. If a text says there is a problem with your bank, your delivery, your insurance or your account, close it and go to that company the way you normally would. Open their app. Use your own bookmark. Type the address into the browser yourself. Call the number printed on your card or your paper bill.
If the problem is real, it will be waiting for you there. Every single time. A real alert is never only in a text message, it is also in your account. And if there is nothing there, there was never anything there.
This one habit defeats almost everything on this page, because none of it survives you arriving through your own front door instead of theirs. It takes about ten seconds.
If you are ever going to look closely at a message rather than just close it, these are the things worth looking at, roughly in the order they give a fake away.
This is the most reliable check there is, and almost nobody knows it. The real owner of an address is the bit immediately to the left of the .com, not the first thing you read.
If you would rather have it checked for you, paste the link into our link checker. It runs entirely on your own phone and we never see the link.
yourbank.example/alerts/verify
Real. The name sits right before the top level domain. Everything after the first slash belongs to them.
yourbank.secure-login-verify.example/alerts
Fake. This address belongs to secure-login-verify.example. Your bank's name is only a label sitting in front of it, which anyone can put there.
yourbank-support.example
Fake. An added word makes it a completely different address that anyone can buy for a few dollars.
A parcel you did not order. A toll on a road you have never driven. A refund for a subscription you do not have. A prize from a draw you never entered. That single question ends a surprising number of these before you look at anything else.
Real companies do not text you from an ordinary mobile number, and they do not text from an email address. A message that claims to be your bank but arrives from a random ten digit number, a number from another country, or something like [email protected], is not your bank.
Today. Within the hour. Before midnight. Or your account closes, your service is cut off, your prize is reallocated. Genuine organizations move slowly and put things in writing. Pressure is there to stop you checking, so when you feel it, that is the moment to slow down rather than speed up.
Not your bank, not support, not a platform, not a friend. A verification code sent to your phone is the key to your account. There is no situation in which a real person needs you to read it out.
Gift cards. A cryptocurrency machine. A wire transfer. Gold. Cash handed to a courier at your door. Payment apps marked as friends and family. No real company, agency or police force collects money any of those ways, and none of them can be reversed. The payment method alone tells you what this is.
Do not reply to the message to find out whether the message is true. Open the app, ring the number on your card, or ask someone you trust. If it claims to be family, call them back on the number already in your phone.
Copy a distinctive line from the message and search for it. These are sent to thousands of people at once, so if it is a known scam, other people have usually already written about it.
A greeting that does not use your name, or uses it oddly. Spacing or punctuation that feels slightly off. A logo that is a little wrong. A friend who does not quite sound like themselves. You do not need to explain why something feels strange to be allowed to stop and check.
Almost every scam in this guide runs into at least one of these.
Not a bank, not a government agency, not the police. A bank that believes your account is at risk freezes it. It does not ask you to empty it.
The number on the back of your card. The number in your own contacts. Never a number from the message itself, and never by tapping to call back.
If anyone directs you to a cryptocurrency ATM and sends you a QR code to scan, it is a scam. There is no legitimate version of that request.
Reported fraud losses in the United States reached about $16 billion in 2025, the highest on record. These are the specific ones showing up most.
A call or text says your account has been compromised and the only way to protect your money is to move it, to a "secure account," to crypto, to gold, or into the hands of a courier. There is no safe account. This is now the single largest impersonation category, at roughly $1 billion reported in 2025.
A pop-up or a call claims your device is infected. You call, they take remote control, and then either they charge you or the call escalates into a fake fraud investigation that empties your accounts. This was the third largest loss category in the country in 2025, at about $2.13 billion.
A voice that sounds like your grandchild says they have been in an accident or arrested and need money now, and please do not tell their parents. A few seconds of audio from a public video is enough to clone a voice convincingly.
A stranger makes contact, often by a wrong number text or a dating profile, and builds a genuine relationship over weeks. Then comes an investment on a professional looking platform. The platform is fake and the balance is a number on a screen. Investment fraud was the largest loss category in the country in 2025, at about $8.65 billion.
A text claims a package cannot be delivered or that you owe a small unpaid toll. The amount is tiny on purpose, because a small sum feels easier to settle than to question. This is the highest volume scam type in the country.
An unsolicited offer of free braces, catheters, genetic tests or a new insurance card, in exchange for your member number. Equipment you never ordered then gets billed to your plan, sometimes for years.
Someone poses as a teenager, moves fast to flirting, sends a photo and asks for one back. The moment an image is sent the tone changes: pay now or this goes to everyone you know. It can happen in as little as five minutes. Reports reached over 50,000 in 2025, about 137 a day, and the targets are overwhelmingly boys aged 14 to 17.
Sometimes nothing was even sent. Some threats use a stranger's photo or an AI generated fake and simply claim it is you.
A message, often from a friend's account that has already been taken over, says they got locked out and your number received their code by mistake. Can you send it over. That code is the key to your own account.
Free credits, skins, a creator drop, a giveaway in a Discord server. Enter your login or complete a "human verification" survey. There is no generator. Game currency can only be bought inside the game.
A remote job you never applied for, paying unusually well. Small tasks pay out at first, then you are asked to deposit your own money to unlock the next set. Or you are asked to receive money in your account and pass it on, which makes you a money mule.
Sneakers, tickets, a console, well below market, with a seller who wants payment by a method that has no protection.
Apps that alter a normal photo taken from social media or a yearbook. The image is fake but the humiliation is real, and increasingly it comes from classmates rather than strangers.
Money first, because that is the only window that closes.
Card or bank transfer: call the number on the back of your card and say the word fraud. Payment app: report it in the app and call your bank. Gift cards: call the card issuer with the number and receipt and ask them to freeze it. Crypto: contact the exchange or machine operator. Speed matters more than anything else here.
A release charge, a tax, an unlock fee. That is the second scam, and almost every victim gets approached by it.
Email is the master key, because every other reset runs through it. Then banking, then anything that reused the same password. Use a different device if the first one might be compromised.
Mail forwarding rules, recovery phone numbers, new payees, new authorized devices. This is the step people skip, and it is how access gets kept after a password change.
Free, no effect on your score, and it must be done three separate times. Equifax 888-298-0045, Experian 888-397-3742, TransUnion 800-916-8800.
If personal details were exposed, IdentityTheft.gov builds a step by step plan and produces the report banks ask for. If the person affected is 60 or over, call the National Elder Fraud Hotline and a case manager will do much of this with you.
Every link and number here is current. Nothing on this page asks you for information.
Sextortion in particular can feel like the end of everything, and it is not. It ends, usually quickly, once an adult knows. If you are struggling, the 988 Suicide and Crisis Lifeline is free, confidential and available every hour of every day.
Call or text 988
Agree a family code word. It takes thirty seconds, it costs nothing, and it defeats voice cloning completely, which is the thing that has made the family emergency scam so effective.
An AI can clone a voice from a few seconds of video. It cannot know a word you agreed at the kitchen table.
Someone in your family cared enough to find out whether a fake one would get through, while it was still safe to find out. That is worth a thank you more than an argument.
OneHaven is building quiet protection that works in the background for kids and for aging parents, watching for the language of a scam in progress and letting someone know. It never blocks anything and it never reads messages sent to you.
Join the waitlist