An email, text, or DM contains a link to log in, "verify," view a delivery, or check an account.
Links lie. The visible text can say one thing while the actual address points somewhere else. Even when the link looks correct, a single swapped letter (paypa1.com, arnazon.com) is enough.
Go to the site the way you normally would. Open the app. Type the address. Use the bookmark you saved last time. The information will be waiting for you there if it is real.
A sticker over a real QR code (on a parking meter, a menu, a flyer) sends you to a fake payment or login page.
A fake message says your toll account is past due and links to a near-perfect copy of a state turnpike site.
A delivery firm asks for two dollars to redirect a parcel. The two dollars is a foot in the door to your card.