//Christmas 2025 scam season is live so don’t get rinsed before the turkey’s even carved. Action Fraud £224m gone last year (UK), FTC $12.5B in 2024 (US). AI + burners = global nightmare. These 10 are scams smashing UK/US/SG right now. Thread keeps your wallet safe. 🧵
// 1. QR “quishing” stickers in pubs & car parks
Fake sticker over real menu or NCP/Walmart QR — scan and you’re on a cloned Barclays/Chase page. £3.5m / $4.2m gone this year. Long-press the code first — preview the URL every single time.
Fake sticker over real menu or NCP/Walmart QR — scan and you’re on a cloned Barclays/Chase page. £3.5m / $4.2m gone this year. Long-press the code first — preview the URL every single time.
// 2. Royal Mail / USPS “£2.99 / $3.99 redelivery fee” SMS
Live UK: rm-tracklive.co.uk
Live US: usps-delivery.net
Fonts nicked, looks perfect — real carriers never ask for card details for peanuts. Forward 7726 (UK/US) and delete.
Live UK: rm-tracklive.co.uk
Live US: usps-delivery.net
Fonts nicked, looks perfect — real carriers never ask for card details for peanuts. Forward 7726 (UK/US) and delete.
// 3. Deepfake voice “Mum/Dad I’m stuck abroad”
30 secs of TikTok — cloned call — “Need £600 / $800 Apple gift cards urgent”. Up 112 % global. Family safe-word is your lifeline. Hang up, ring back on the number you already have.
30 secs of TikTok — cloned call — “Need £600 / $800 Apple gift cards urgent”. Up 112 % global. Family safe-word is your lifeline. Hang up, ring back on the number you already have.
// 4. AI parcel-tracking sites
“Track here: amazon-delivery.co.uk / amazon-shipping.net”
Pixel-perfect clone — wants £1.99 / $2.99 “verification”. 400 new domains daily. Only track inside the official Amazon/Shopee app.
“Track here: amazon-delivery.co.uk / amazon-shipping.net”
Pixel-perfect clone — wants £1.99 / $2.99 “verification”. 400 new domains daily. Only track inside the official Amazon/Shopee app.
// 5. Gift-card “verify your code” email
Buy £100 / $130 card — instant mail “Enter code to confirm”. Drained in 3 mins. Amazon/Shopee: we NEVER ask for the code after purchase. Turn on purchase alerts now.
Buy £100 / $130 card — instant mail “Enter code to confirm”. Drained in 3 mins. Amazon/Shopee: we NEVER ask for the code after purchase. Turn on purchase alerts now.
// 6. Christmas loneliness romance re-targeting
“Hey remember me from Bumble?” — WhatsApp — “Need £800 / $1,000 to fly home for Christmas”. £93m / $500m+ lost this year. Reverse-image every photo, video call within 72 h or ghost.
“Hey remember me from Bumble?” — WhatsApp — “Need £800 / $1,000 to fly home for Christmas”. £93m / $500m+ lost this year. Reverse-image every photo, video call within 72 h or ghost.
// 7. Fake charity & deepfake celeb begs
UK Starmer deepfake, US fake Red Cross, SG clones
Verify:
fullfact.org/online/keir-st…
redcross.org/donate/donatio…
charities.gov.sg
Donate direct only!
UK Starmer deepfake, US fake Red Cross, SG clones
Verify:
fullfact.org/online/keir-st…
redcross.org/donate/donatio…
charities.gov.sg
Donate direct only!
// 8. Fake online stores & deepfake ads
70 % off iPhone 16 on “amazzon-sale.co” or “temu-deals.us” pushed via FB/Insta. $430m lost US ‘24. Hover links, pay with credit card for chargebacks.
70 % off iPhone 16 on “amazzon-sale.co” or “temu-deals.us” pushed via FB/Insta. $430m lost US ‘24. Hover links, pay with credit card for chargebacks.
// 9. Airline booking imposters
“Your BA / Delta flight delayed — pay £49 / $59 rebooking fee”. Fake site steals card + passport. Book direct on airline site only.
“Your BA / Delta flight delayed — pay £49 / $59 rebooking fee”. Fake site steals card + passport. Book direct on airline site only.
// 10. Holiday visa scams (SG special, but spreading)
“SG Arrival Card S$20 / Bali visa $35 — pay now: ica-fake.gov.sg”. Real ICA never charges via links. Check ica.gov.sg direct.
“SG Arrival Card S$20 / Bali visa $35 — pay now: ica-fake.gov.sg”. Real ICA never charges via links. Check ica.gov.sg direct.
// Instant blocklist — just paste these into RethinkDNS/AdGuard (or check this link for lists: )
*.co.uk/tr/*
*delivery*.*co
*usps-* *singpost-*
*amazon-*.*co
*redelivery-fee*blocklistproject.github.io/Lists/
*.co.uk/tr/*
*delivery*.*co
*usps-* *singpost-*
*amazon-*.*co
*redelivery-fee*blocklistproject.github.io/Lists/
// One setting that stops 85 % of this crap dead
Turn on login + new-device alerts on Amazon, PayPal, every bank. Takes two minutes tops. Scammers log in with your cookies — instant push on your phone.
Turn on login + new-device alerts on Amazon, PayPal, every bank. Takes two minutes tops. Scammers log in with your cookies — instant push on your phone.
// Proper move before January
YubiKey 5 NFC (£55 / $70) — register it everywhere today. Phishing sites get absolutely nothing without your finger on the key.
YubiKey 5 NFC (£55 / $70) — register it everywhere today. Phishing sites get absolutely nothing without your finger on the key.
// Quick recap
New domains daily, patterns never change. Stay suspicious, verify direct, never rush. In US:
SG crew: ScamShield app now.reportfraud.ftc.gov
New domains daily, patterns never change. Stay suspicious, verify direct, never rush. In US:
SG crew: ScamShield app now.reportfraud.ftc.gov
// That’s your lot. Enjoy the mince pies, eggnog, or kueh lapis — not the empty bank balance.
Merry Christmas 🎄🎅
Merry Christmas 🎄🎅
@threadreaderapp please unroll
• • •
Missing some Tweet in this thread? You can try to
force a refresh
