ICOs are selling some bullshit made up coins. You buy these coins. They are valued at what they sell at. If the company goes down the coins essentially become worthless.

It's pretty much like company stock but very 2017.

Sometimes the coins are used by the company's product as currency somehow. So imagine paying to use Facebook in FacebookCoin or whatever. You can pay for ads in ZuckCoin which you get by exchanging $$$ into ZuckCoin. So let's say you put $4,000 into ZuckCoin. Facebook goes down, ZuckCoin is worth nothing because you can't use it anywhere. Nobody would buy it because why would you buy something that's useless.

At least that's how I understand it. I don't know much about crypto.

ICOs are a form of fundraising for crypto-startups; like VC or crowdfunding. You could create a crypto-startup without doing an ICOs.
So now, a lot of crypto-startup (meaning based on blockchain technology, a lot of them using ethereum platform) are using ICOs instead of VC funds to raise money. As @pugson said, they are creating their own coins, that will be used later when the business launches. During an ICO, they propose people to buy their coin using ETH (mostly). When you buy coins from an ICO, you are buying a token for a future use on their platform.

In other words, you are buying a currency that can only be used on a platform that doesn't exist or that they only started to build.

There are no law/rules regulating ICOs, you have no power on the company (unlike VC where you have equity) and anyone can participate in an ICO.

So now, why ICOs are very risky or scam:
- Some are not scam, in the sense that the people raising money are not looking to scam their "investor", but the founder often:
1. create a coin for their business where it is totally useless, it doesn't make sense to use blockchain for their business, so the business will fail (see www.dnxtoken.com/ )
2. are probably not legitimate for this business, weren't able to raise money through VC, have a shitty product, so the business will fail.

• Some are complete scam: Scammer create a useless coin, Pump it - meaning they advertise and evangelize a lot, use different channel to let people think their coin is magic and that buyers will earn a lot of money, use FUD sales technique, making youtube videos "OMG look at this new coin, BUYBUYBUY" etc... people buy their token using ETH or other legitimate currency, the business raise a lot of money in ETH, sell all their ETH and disappear. Some say there were hacked (See recent news on Tether), some just disappear since no-one knew their real identity (see recent news on Confido (CFD) ) This technique above is not only on ICO: scammer can also use existing token, advertise it for no reason, promise people they'll earn money; Some people believe them, they buy, the coin goes up, the scammer sell everything > this is called the pump and dump technique.

You can have a quick overview with this parody but real ICO: uetoken.com/

In the end, i'd say that ICO are not scam per se, but it is a very dangerous and risky way to invest (because if the team/product was really legitimate, why dont they raise with VC?!), and some are clearly just scam.