Cybercrime · Practice
Keep it going.
The hour on the Do page closes the doors. This page keeps them closed: a drill that trains the three tells, a quarterly check that takes about twenty minutes, and the list of what you’ve done. Tick things here; the ticks stay on your device.
The drill: scam or not?
Seven messages. The three tells are urgency, secrecy, and a payment you can’t reverse; the one rule is never act through a link or number in the message itself. Decide, then open.1
Text: “USPS: your package is on hold. Pay the $0.30 redelivery fee within 24 hours: [link]”
Scam
Urgency, a tiny payment to capture your card, and a link. The amount is the tell: no carrier holds a parcel over thirty cents. Delete it. If you’re expecting a package, check on the carrier’s site by typing its address.
A call. Your grandson, crying: he’s been in an accident, he’s at the police station, he needs $2,000 in gift cards for bail, and please don’t tell his mother.
Scam, all three tells
Urgency, secrecy, gift cards. A cloned voice can sound exactly like him; it can’t know the family safe word. Ask for it. Then hang up and call him on the number you already have. Over-60s lost $7.7 billion in 2025, almost all of it to fraud rather than hacking. Investment and tech-support scams took the most; voice-clone “distress” calls like this one took over $5 million from victims of all ages.12
Email from your bank: “We noticed unusual activity. Verify your identity within 12 hours to avoid suspension: [Log in]”
Scam
Banks do send fraud alerts; they never need you to log in through an email link. Open the bank’s app or type its address, and look there. If nothing’s flagged, there was nothing. Report the email to the bank’s phishing address if it has one.
Text from your bank with a six-digit code, while you’re logging in on your laptop.
Fine, with one rule
You asked for it; use it. The rule: nobody, ever, needs you to read that code aloud or type it anywhere but the screen you’re logging into. A “bank employee” on the phone asking for the code is a thief trying to log in as you.
Email from your boss: “I’m in a meeting and can’t talk. Buy five $200 gift cards for client thank-yous and send me the codes. Keep it between us for now.”
Scam
Urgency, secrecy, irreversible payment, and “can’t talk” so you won’t call. Call your boss on a number you already have. Business email scams cost $3.05 billion in 2025; the rule that stops them is a phone call before any new payment.1
A full-screen pop-up: “Your Mac is infected! Do not shut down. Call Apple Support now: 1-800-…”
Scam
No operating system warns you with a phone number. Quit the browser (force-quit if you must); nothing is infected. If you called, you were going to be asked for remote access and a payment.
Message from a friend’s account: “omg is this you in this video?? [link]”
Scam
Their account was taken over and is phishing everyone they know; the link leads to a fake login that takes yours too. Don’t click. Tell them by another route, and send them the recovery steps.
Run it again in a few months. In a study of 409 employees, phishing training still worked four months on, and no longer showed at six.7
The rhythm
Today
- Agree the family safe word. Two minutes. Tell everyone who’d get the “Grandma, it’s me” call.
This week
- The hour. Email first.
Whenever
- You see Relaunch or Update: do it then. Most break-ins use holes that were already fixed.
- A breach notice arrives from Have I Been Pwned: change that one password, and anywhere you reused it.3
Every quarter
- Restore one file from your backup, to prove the backup works. Five minutes.
- Run the drill above with someone in your family. Ten minutes.
- Pull one free credit report at annualcreditreport.com and look for accounts you don’t recognise. Rotate the three bureaus.
Every year
- Check that two-step sign-in is still on for email, bank and phone carrier, and that your recovery phone and email are current.
- Remove apps and sites that still hold your card and that you no longer use.
One reminder on the first of each month that opens this page. It holds no dates or figures, so it never goes out of date.
With others
- Run the drill with someone, and again next quarter. moderate Warnings can fade. In one trial, a phone warning about the exact scam had worn off by four weeks; a warning about a different scam still made people less likely to accept the pitch. In another, a letter plus five more mailings to older fraud victims cut repeat victimisation by 22.4% over four months; the letter alone cut it by 8.6%.4
- At work: one fake phishing email with a debrief, not a course after every failure. moderate: short-lived Among 10,929 staff of a Dutch ministry, one simulated phish with a debrief cut password disclosure from 22% to 14% on a test phish 40 days later. In a 15-month study of a large company, training shown after a failed test didn’t help, and staff who got it clicked more. Warnings on suspicious emails cut clicks; a report button let staff flag new phishing fast.5
- Report, don’t just delete. Most fraud victims never report, many from embarrassment. Say out loud in your family or team that reporting is the normal thing.6
- Careful with church and club programmes. Affinity fraud spreads through trusted groups, so a programme should say so rather than lean on trust.6
Say it in thirty seconds
Your checklist: the eight doors, plus one
- Password manager, with email, bank and carrier passwords changed.
- Passkey or two-step sign-in on email, bank and carrier.
- Phone number locked at the carrier.
- Credit frozen at Equifax, Experian and TransUnion.
- Have I Been Pwned alerts on.
- Backups on, and one restore tested.
- Automatic updates on everywhere.
- Family safe word agreed.
- Sent the Do page to the person in my family most likely to get the call.
Sources
- FBI Internet Crime Complaint Center, 2025 Internet Crime Report, April 2026; FBI, public service announcement on AI-enabled fraud, 3 December 2024. primary
- FTC, Scammers use AI to enhance their family emergency schemes, 20 March 2023. primary
- Have I Been Pwned FAQs, checked 5 Nov 2026. primary
- DeLiema, Brannock, Preble and Langton, the US Postal Inspection Service mailing trial, Innovation in Aging, 2024 (abstract; abstract; summarised in a NAPSA brief) research; Scheibe et al., Forewarning reduces fraud susceptibility in vulnerable consumers, Basic and Applied Social Psychology, 2014 (895 people) research.
- Baillon et al., Informing, simulating experience, or both, PLOS ONE, 2019 (10,929 employees) research; Reinheimer et al., An investigation of phishing awareness and education over time, SOUPS 2020 (effects gone by six months) research; Lain, Kostiainen and Čapkun, Phishing in organizations, 2022 research.
- FINRA Investor Education Foundation, Non-traditional costs of financial fraud, 2015 (35% reported; 29% “was embarrassed”) research; SEC, Affinity fraud, read 5 Nov 2026 primary.
- Reinheimer, Aldag, Mayer and others, An investigation of phishing awareness and education over time: when and how to best remind users, SOUPS 2020, read 6 Nov 2026 research
The scam scripts in the drill are composites of patterns the FBI and FTC describe, not real messages.
Contest a fact, suggest something, or tell us what’s broken
If someone is in danger right now, don’t use this form. Call your local emergency number (911 in the US). For trafficking: 1-888-373-7888, or text 233733.
No name, no account. Your note goes into the site’s private records, nothing about your browser or connection is stored with it, and the email box is the only way we’d know who you are. The weekly review reads every note, re-reads the original source, and fixes the page if it should. A contested fact and its outcome are listed on Contested, in the review’s words, never yours.
No tracking on any link.Ticks stay on this device.Facts checked 5–6 Nov 2026.What changedContested