The truth is there no way one can be 100 💯 percent sure an ico is not a scam except you are one of the team members, you can rather say the risk of loosing money is low, and back to your question, one can loss money if the project is not one that catches people's interest/attention, one can also loss money if the project team fails in any way to fulfill a particular campaign promise or promises, use athourship as an example, during their ico, people were asked to refer other people to sign up for their newsletter and get 75 ATS token free, at the end, thousands were not paid and that alone made the whole project look like a scam, those who invested in the ICO are yet to recover their money as price of token now is highly below ico price.