The Lure

Dive 4,000 metres. Meet the animals that trick their prey, and the scams that copy them.

Start the dive Or practise spotting scams

The mimic octopus

Sunlight zone, 0–75 metres down · Thaumoctopus mimicus

A mimic octopus on dark sand, its striped brown and cream arms spread out and its eyes raised on stalks.

It survives by disguise

Most octopuses hide. This one hunts in broad daylight on open sand, in full view of the fish that eat octopuses. It was only discovered in 1998, off Sulawesi in Indonesia.

Instead of hiding, it pretends to be something dangerous. It flattens into a flatfish, trails its arms like the venomous spines of a lionfish, or hides six arms in a burrow so the other two look like a banded sea snake.

It seems to pick whichever disguise will scare the predator in front of it.

Scammers use disguises too

They pretend to be someone you already trust: your bank, a delivery company, your boss, or your own child with "a new number". Anyone can make a text or email show any name.

Like the octopus, they pick the disguise you are least likely to question, then ask for something that person never would: money, a code, your password.

How a safe-account scam plays out

  1. A text from "Northway Bank" lands in the same thread as your real bank texts. It says a £849 payment has been stopped and gives a number to call.
  2. A calm "fraud team" answers. They know your name, your address and the last four digits of your card. Details like these are sold from old data leaks.
  3. They say your account has been compromised, possibly by someone inside the bank, so you must not mention it to branch staff.
  4. To protect your savings, you are asked to move them today to a new "safe account" in your name.
  5. The money leaves in minutes and is split across accounts run by the criminals. The "fraud team" stops answering.

The moment to stop A bank never asks you to ring a number sent by text. Use the one on the back of your card.

In the UK in 2025

Down 12%

Losses to impersonation scams fell 12% in 2025 and cases fell 11%, while purchase, investment and romance scams all grew. UK Finance

Find the disguise

One of these texts isn't really from Northway Bank. Which one?

1 of 10

The giant siphonophore

Sunlight zone, deeper, 75–200 metres down · Praya dubia

A giant siphonophore glowing pale blue-green against black water: a long, thin, beaded chain looping across the frame.

Many small bodies pose as one big animal

It looks like one long creature. It is really a colony of tiny bodies called zooids, joined together. Each has one job: some swim, some catch prey, some eat.

Together they can stretch 40 to 50 metres, one of the longest animals on Earth, and glow a soft blue to draw prey into a curtain of stinging threads.

Scammers fake a crowd

One seller can pose as thousands of happy customers: fake reviews, bought followers, "10,000 sold" counters and "41 people are looking at this" pop-ups.

A big crowd feels safe, so a fake one makes a bad shop look popular. Fake reviews have been illegal in the UK since April 2025, but they are still everywhere.

How a fake shop plays out

  1. An advert offers walking boots at 60% off. The shop has a 4.9-star rating from more than 2,000 reviews.
  2. The reviews were all posted within two weeks, and many repeat the same few phrases.
  3. At checkout there is an extra 10% off if you pay by bank transfer instead of card.
  4. An order confirmation arrives. The tracking number never updates.
  5. A month later the website has gone. A card payment could be charged back; for a bank transfer you have to make a scam claim and hope.

The moment to stop A shop that wants a bank transfer instead of a card is asking you to give up your protection.

In the UK in 2025

71%

of all bank-transfer scam cases in the UK in 2025 were purchase scams: paying for something that never arrived. UK Finance

£118.1m

lost to purchase scams in 2025, up 20% on the year before. UK Finance

Find the fake crowd

One of these shops is propped up by fake reviews. Which one?

1 of 10

The hatchetfish

Twilight zone, 200–600 metres down · Sternoptychidae

A silvery hatchetfish seen side-on, with a deep, flat body, large eye and a row of light organs along its belly.

It blends into the light

Below 200 metres, predators hunt by looking up for a dark shape against the last faint light from above.

The hatchetfish has a row of light organs, called photophores, along its belly. They glow to match the light from above and erase its shadow. From below, it vanishes. This is called counter-illumination.

Fake websites blend in too

A fake site copies the real one so closely that nothing looks wrong: same logo, same colours. The only difference is the address, and it is made to look almost identical.

parcelpost-redelivery.co is not parcelpost.co.uk. iarkspur.co.uk starts with an i, not an l. The part just before .co.uk or .com is the website you are really on.

How a parcel text plays out

  1. A text says ParcelPost could not deliver your parcel. To rebook, pay £1.45 at parcelpost-redelivery.co.
  2. The website is a perfect copy of the real one: logo, colours, tracking page.
  3. You enter your card details. The payment "fails" and asks you to try again, so they get your details twice.
  4. Days later, "your bank" calls about a suspicious £1.45 payment. They know about it because they took it.
  5. From here it becomes a safe-account call, and your savings are the target.

The moment to stop Read the address before you tap: the name right before .co is the website you are really on.

In the UK in 2025

£423.5m

taken in 2025 using stolen card details online, across 3.2 million cases. Card details are what fake websites are built to collect. UK Finance

66%

of bank-transfer scam cases in 2025 started online. UK Finance

Find the fake address

Which of these links is the fake ParcelPost?

1 of 10

The beluga whale

Twilight zone, deeper, 600–1,000 metres down · Delphinapterus leucas

A white beluga whale in an aquarium, swimming face-on towards the camera through dim green water, its rounded forehead catching the light.

One learned to speak like us

Belugas spend the summer in shallow Arctic coastal water, but they hunt deep. NOAA says they dive to 1,000 metres for up to 25 minutes, and one tagged male reached 956 metres.

In 1984, people at the US Navy's marine mammal programme in San Diego heard what sounded like people talking near the whale pens. Nobody was there. A diver surfaced asking who had told him to get out.

It was a beluga called NOC. Recordings showed he dropped his calls several octaves and copied the rhythm of human speech. He kept it up for about four years.

Scammers borrow a voice

A phone call feels more real than a text, so scammers make it sound right: your bank's real number on the screen, a calm "fraud team", or a voice cloned from a few seconds of someone's social media video.

Caller ID can be faked, so a familiar number proves nothing. The only safe check is to hang up and call back on a number you already have, ideally from a different phone.

How a cloned-voice call plays out

  1. An unknown number rings. It is your son's voice, panicked: he has crashed the car and his phone is broken.
  2. A "solicitor" takes over the call. To keep him out of a cell tonight, £2,000 is needed for the other driver.
  3. You are told not to tell anyone yet, to spare him the embarrassment.
  4. You send the money. Then you ring your son on his usual number, and he is at work, fine.

The moment to stop Hang up and call him on the number you have saved. A family safe phrase settles it in seconds.

In the UK in 2025

17%

of bank-transfer scam cases in 2025 started with a call or text, yet they made up 28% of all the money lost. UK Finance

28%

of UK adults in a 2024 survey of 3,000 people believed they had been targeted by an AI voice-cloning scam in the past year. ITV News, on Starling Bank research

Find the borrowed voice

Three calls from "Northway Bank". Which one is the scam?

1 of 10

The deep‑sea anglerfish

Midnight zone, 1,000–4,000 metres down · Melanocetus johnsonii

A black deep-sea anglerfish with a huge jaw of needle teeth and a single thin rod rising from its head.

It dangles a glowing lure

Below 1,000 metres no sunlight reaches at all. The only light down here is made by animals.

A female anglerfish carries a fishing rod: the first spine of her back fin, tipped with a small sac called an esca, full of glowing bacteria.

She does not chase anything. In total darkness the light is the only thing to swim towards, so she waits for her prey to come to her.

Scammers dangle bait

The bait is something you want: a refund, a prize, a parcel, easy money, or a warning you feel you must fix right now.

The scammer does not have to break in. They dangle the light, add a deadline, and wait for you to click.

How an investment scam plays out

  1. An advert shows a famous TV presenter "revealing" the trading platform that made them rich.
  2. You put in £250. A dashboard shows it growing every day, and a friendly "account manager" calls to check in.
  3. You withdraw £100 and it arrives. The payout is there to win your trust.
  4. You invest your savings. When you try to take it out, there is a "tax" or "release fee" to pay first.
  5. You pay it, and another fee appears. The dashboard was never real.

The moment to stop Celebrities are used in these adverts without their knowledge. Check any firm on the FCA register before you pay a penny.

In the UK in 2025

£221.5m

lost to investment scams in 2025, the biggest share of all bank-transfer scam losses. UK Finance

Up 40%

on the year before, from 14,893 cases. UK Finance

Find the bait

One of these messages is bait. Which one?

1 of 10

The bottom

Abyss, 4,000 metres down and deeper

Down here the only light is made by living things. Every animal you met used a trick. So does every scam.

There is a challenge at each depth on the way down. Scroll back up to try them.

Start a practice dive

How to never take the bait

  1. Stop. A real bank, tax office or delivery company can wait five minutes. Pressure to act now is the hook.
  2. Never use the number or link in the message. Go to the website or app yourself, or call the number on the back of your card.
  3. Read the real address. The part just before .co.uk or .com is who you are really dealing with. Use the checker below if you are not sure.
  4. Change factory passwords. On your router, cameras and smart devices, the day you set them up.
  5. Turn on two-step verification for your email and bank, so a stolen password is not enough on its own.

If you have been scammed

Move fast. These scams are designed to fool careful people, so there is nothing to be embarrassed about.

  1. Call your bank now. Dial 159 from any phone to reach the fraud team at most UK banks, or use the number on your card. The sooner they know, the more they can stop.
  2. Change any password you typed in. Start with your email, then anywhere you used the same password.
  3. Report it. To Report Fraud, online or on 0300 123 2040. In Scotland, call Police Scotland on 101.
  4. Pass on the evidence. Forward scam texts to 7726 (Ofcom explains how) and scam emails to report@phishing.gov.uk (NCSC). Keep screenshots.
  5. Ask for your money back. In 2025 banks paid back £354.3 million to victims of bank-transfer scams, 61% of what was lost (UK Finance). Ask your bank how to claim.
  6. Ignore anyone offering to recover it for a fee. Recovery offers are a known follow-up scam, sometimes run by the people who took the money.

Check a link

Paste a link from a message you are not sure about. It is checked right here on your device. Nothing is opened or sent anywhere.

Send this to someone

The people most likely to take the bait are often the ones least likely to read about it.

Keep practising

60 questions from the dive, and 20 harder ones on real attacks: fake CAPTCHAs, QR code stickers, SIM swaps and more. Every right answer takes you 100 metres deeper.

Start a practice dive