Records · Evidence review

Cybercrime: evidence review of the Do and Practice pages

The working record behind the pages, published as written. Source file source/impact/cybercrime-2026-11-05.md. All records.

Review date: 2026-11-05 (fetches 20:54–22:40 EST). Pages reviewed: content/cybercrime-do.html, content/cybercrime-practice.html, content/cybercrime-learn.html; research file source/research/cybercrime.md. The site's purpose: help one person learn, do and practice something that reduces the problem. Isaac's brief: build from the best evidence about what one person can do, not from the essay's lists.

Nothing in the content pages was edited. Nothing was committed.

Grade keys

Source grades (every figure below carries one):

• primary: the issuer's own document (agency report, regulation text, vendor help page, nonprofit filing).
• research: peer-reviewed paper, preprint or working paper.
• charity's own figures: a nonprofit describing its own reach or results.
• news: journalism or trade press.
• industry projection: vendor survey, forecast or self-reported effect with no independent check.
• unread: seen only in a search-result summary; the page itself was not opened. Treat as ungraded.
• Vendor security studies of the vendor's own users (Google, Microsoft) are marked primary, self-study: real data, no independent check.

Action grades: strong (independent or large-scale outcome data), moderate (strong mechanism plus authoritative guidance or indirect outcome data), weak (plausible, thin or org-only data), none-but-plausible (no evidence found either way), contradicted (evidence against).

Limits of this instrument (read before trusting anything below)

• The session's web-search budget ran out twice (shared across all agents). After each exhaustion I could fetch only URLs I already knew. Items I could not search for are listed in §7, not guessed.
• Two of the three parallel research sweeps I launched failed to start (concurrency cap). I ran those sweeps myself. The third sweep (older adults, group formats, backfire) ran separately (126 tool uses) and its quotes are carried here as it observed them, marked "sweep". I re-fetched its two most load-bearing sources myself (Scheibe et al. 2014; Baillon et al. 2019) and both checked out; the "Exposed to Scams" PDF was re-read locally. The sweep found that one lead in my brief was wrong: there is no Burnes et al. 2017 prevention review in AJPH, only a prevalence meta-analysis.
• Sites that refused automated reads today (403 or bot wall): fcc.gov, bbb.org/scamtracker, transunion.com, hsgac.senate.gov (the Zelle report PDF), blumenthal.senate.gov, idtheftcenter.org, the Federal Register's HTML pages (its API worked). Four domains were briefly rate-limited by the fetch tool's safety check; each was retried once.
• PDFs (IC3 2025, DBIR 2026 executive summary, Ho et al. 2025, Lain et al. 2022, Meyer et al. 2023, BJS 2021, CISA mobile guidance) were downloaded and read with pdftotext locally; quotes come from that text. The FTC 2024 Data Book PDF's text layer was unreadable (glyph encoding); nothing was taken from it.
• "Operating" for a website means HTTP 200 on a fetch today, plus whatever the page said. It is not a statement about staffing or backlog.

---

A. The evidence behind each action the Do and Practice pages recommend

A1. Password manager (Do §1; Practice checklist)

What the page claims: a manager with unique generated passwords for email, bank, carrier; Apple Passwords / Google Password Manager / Bitwarden Free.

Evidence found today:

• Reuse is the mechanism the manager interrupts. Thomas et al. (Google, CCS 2017) studied "1.9 billion usernames and passwords exposed via data breaches", "12.4 million potential victims of phishing kits" and "788,000 potential victims of off-the-shelf keyloggers", and found "7–25% of exposed passwords match a victim's Google account". https://research.google/pubs/data-breaches-phishing-or-malware-understanding-the-risks-of-stolen-credentials/ (fetched 2026-11-05; research, Google authors).
• NIST SP 800-63B-4 (final, 31 July 2025): "Verifiers SHALL allow the use of password managers and autofill functionality"; verifiers "SHALL NOT impose other composition rules"; "Verifiers and CSPs SHALL NOT require subscribers to change passwords periodically". https://pages.nist.gov/800-63-4/sp800-63b.html and https://csrc.nist.gov/pubs/sp/800/63/b/4/final (fetched 2026-11-05; primary).
• CISA's Mobile Communications Best Practice Guidance (18 Dec 2024; page revised 13 Mar 2026): "Use a password manager to store all passwords", protect the vault with "a strong passphrase (i.e., long, unique, and random)". It names Apple Passwords, LastPass, 1Password, Google Password Manager, Dashlane, Keeper and Proton Pass. No evidence cited. https://www.cisa.gov/sites/default/files/2024-12/guidance-mobile-communications-best-practices.pdf (fetched 2026-11-05; primary).
• Whether managers improve passwords depends on how they are used. Lyastani et al. (USENIX Security 2018; 476 survey respondents, 170 browser-plugin users): "Whether this influence is beneficial or aggravating existing problems depends on the users' strategies". https://www.usenix.org/conference/usenixsecurity18/presentation/lyastani (fetched 2026-11-05; research). Pearman et al. (SOUPS 2019; 30 interviews) cite prior field data that "users of built-in, browser-based password managers more often use weak and reused passwords" than users of separate managers with generation on by default; built-in users "may be driven more by convenience". https://www.usenix.org/conference/soups2019/presentation/pearman (fetched 2026-11-05; research).
• A manager's autofill is also a phishing check. Ho et al. (IEEE S&P 2025) recommend "password managers that only work on correct domains" over training (below). Troy Hunt's own phish (25 Mar 2025): his manager did not autofill on the lookalike domain and he overrode the signal. https://www.troyhunt.com/a-sneaky-phish-just-grabbed-my-mailchimp-mailing-list/ (fetched 2026-11-05; primary, first-person).
• The risk side. Silver et al. (USENIX Security 2014) showed some autofill policies let "a remote network attacker" extract "multiple passwords from the user's password manager" without interaction. https://www.usenix.org/conference/usenixsecurity14/technical-sessions/presentation/silver (fetched 2026-11-05; research, 2014). LastPass: Krebs on Security (7 Mar 2025) reports a US Secret Service seizure complaint stating investigators had "probable cause to believe the same attackers" behind the password-manager breach "used a stolen password held in Victim 1's online password manager account" in a $150 million theft on 30 Jan 2024; LastPass said it has seen "no definitive proof". https://krebsonsecurity.com/2025/03/feds-link-150m-cyberheist-to-2022-lastpass-hacks/ (fetched 2026-11-05; news, quoting a court filing).
• No study was found that measured account compromise before and after people adopted a manager.

Grade: moderate. Mechanism strong, guidance unanimous (NIST, CISA, NCSC per the research file), no outcome trial. Page wording "Isn't a password manager one big target? Yes" is honest; add the Krebs/LastPass line as the concrete case.

A2. Passkeys or two-step sign-in on email, bank, carrier (Do §2; Practice checklist)

• Google's 2019 study with NYU and UCSD (Google Security Blog, 17 May 2019): an SMS code to a recovery phone "helped block 100% of automated bots, 96% of bulk phishing attacks, and 76% of targeted attacks"; on-device prompts "helped prevent 100% of automated bots, 99% of bulk phishing attacks and 90% of targeted attacks"; "zero users that exclusively use security keys fell victim to targeted phishing during our investigation"; targeted attacks hit "just one in a million users"; knowledge-based challenges "can drop to as low as 10%". https://security.googleblog.com/2019/05/new-research-how-effective-is-basic.html (fetched 2026-11-05 via the mobile view; primary, self-study).
• The paper behind it, Doerfler et al. (WWW 2019): "over 350,000" real hijacking attempts; device-based challenges blocked over 94% of phishing-rooted attempts and 100% of automated attempts; knowledge-based as few as 10% and 73%; usability cost: 52% of 1.2M legitimate users failed a challenge, 97% got in eventually. https://research.google/pubs/evaluating-login-challenges-as-a-defense-against-account-takeover/ (fetched 2026-11-05; research, Google and NYU authors).
• Google, 8 Feb 2022 (Jen Fitzpatrick): "In 2021, we auto-enrolled over 150 million people in two-step verification (2SV)." "As a result of this effort, we have seen a 50% decrease in accounts being compromised." No baseline, period or method given. https://blog.google/technology/safety-security/safer-internet-day-2022 (fetched 2026-11-05; primary, self-study, no methodology).
• Microsoft, Meyer et al. (arXiv 2305.00945, 1 May 2023): Azure AD commercial accounts reviewed for suspicious activity "between April 22, 2022, and September 22, 2022", benchmark-multiplier method: "MFA reduces the risk of compromise by 99.22% across the entire population and by 98.56% in cases of leaked credentials"; "SMS was 40.8% less effective than Microsoft Authenticator"; Table 2 compromise rates in the reviewed set: Authenticator OTP 0.99%, Authenticator notifications 0.97%, SMS 1.66%. Commercial accounts only. https://arxiv.org/abs/2305.00945 (fetched 2026-11-05; research, Microsoft authors).
• Microsoft's popular "99.9%" line (Alex Weinert, 9 July 2019): "Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA" with no data attached. https://techcommunity.microsoft.com/t5/microsoft-entra-blog/your-pa-word-doesn-t-matter/ba-p/731984 (fetched 2026-11-05; primary, self-study, unsupported on the page). CISA's MFA page gives no number at all ("Users who enable MFA are significantly less likely to get hacked") and is marked archived. https://www.cisa.gov/MFA (fetched 2026-11-05; primary).
• Why SMS is weakest. NIST 800-63B-4 §3.1.3.3: "Use of the PSTN for out-of-band verification is restricted"; §3.2.5: authenticators with "manual entry of an authenticator output" (OTP, out-of-band) "SHALL NOT be considered phishing-resistant"; AAL2 verifiers "SHALL offer at least one phishing-resistant authentication option" (fetched 2026-11-05; primary). CISA mobile guidance: "Do not use SMS as a second factor"; "While authenticator codes are better than SMS, they are still vulnerable to phishing. Only FIDO authentication is phishing-resistant" (primary).
• Why "phishing-resistant" is not a slogan. Microsoft (12 July 2022): an adversary-in-the-middle campaign "attempted to target more than 10,000 organizations since September 2021"; the proxy steals the session cookie so "the attacker gets authenticated to a session on the user's behalf" despite MFA; fix is FIDO2. https://www.microsoft.com/en-us/security/blog/2022/07/12/from-cookie-theft-to-bec-attackers-use-aitm-phishing-sites-as-entry-point-to-further-financial-fraud/ (fetched 2026-11-05; primary, self-report). Troy Hunt (25 Mar 2025) entered his password and one-time code on mailchimp-sso.com; the OTP was relayed live; about 16,000 subscriber records were exported; "Mailchimp doesn't offer phishing-resistant 2FA"; "Today's phish could not have happened against this account, nor the other critical ones using a phishing resistant second factor" (primary, first-person).
• Passkey adoption and outcome figures from Google were not re-fetched: the 2024 blog URL returned 404 and search was exhausted. The Google passkey help page is already cited on the Do page (research file grade P).

Grade: strong for "turn on any second step on your email" (two independent vendor datasets, hundreds of thousands of real attacks, consistent direction). Moderate-to-strong for "prefer a passkey or security key": the mechanism is settled (NIST, CISA, Microsoft's AiTM data, Hunt), but no consumer-scale outcome study was fetched today. Contest kept: the two headline effect sizes (Google 50%, Microsoft 99.9%/99.22%) are vendor self-studies measuring different things on different populations; neither has an independent replication. Keep both on the page as vendor figures, not as "the" number.

A3. Lock your phone number (Do §3; Practice checklist)

• Princeton (Lee, Kaiser, Mayer, Narayanan; SOUPS 2020): "We found that all five carriers use insecure authentication challenges that can easily be subverted by attackers"; "We found 17 websites on which user accounts can be compromised based on a SIM swap alone"; nine were still vulnerable 60+ days after disclosure. The page also carries an FCC statement citing the study that "four out of five SIM swap attempts in the United States are successful". https://www.issms2fasecure.com/ (fetched 2026-11-05; research, 2020, prepaid carriers).
• FCC final rule "Protecting Consumers from SIM-Swap and Port-Out Fraud" (published 8 Dec 2023; "Effective January 8, 2024" except information-collection sections "delayed indefinitely" pending a later notice): carriers must use secure authentication before moving a number to a new device or carrier, notify customers immediately of SIM-change or port-out requests, and provide protective measures at no cost. https://www.federalregister.gov/api/v1/documents/2023-26338.json (fetched 2026-11-05; primary). The FCC's own press page returned 403.
• Scale. IC3 2025: SIM swap 971 complaints and $17,366,758 in 2025, against 982 and $25,983,946 in 2024 and 1,075 and $48,798,103 in 2023. Over-60s: 222 complaints, $6,741,791. https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf (fetched 2026-11-05; primary). Losses fell by about two-thirds over the two years the FCC rule has been in force; complaints barely moved. That is a correlation; nothing fetched today attributes it to carrier locks.
• No data was found on how many customers have a lock turned on, or on lock failure rates.

Grade: moderate. Strong mechanism, regulator-mandated, cheap; outcome data correlational only. In dollar terms SIM swap is a small category (0.08% of 2025 reported losses), so the action protects the second factor rather than being a top-five loss reducer in itself.

A4. Freeze your credit; IRS IP PIN (Do §4; Practice checklist)

• GAO-17-254 (30 Mar 2017): credit monitoring "helps detect new-account fraud" but "does not prevent such fraud or address existing-account fraud"; GAO describes "a low-cost credit freeze, which can prevent new-account fraud". https://www.gao.gov/products/gao-17-254 (fetched 2026-11-05; primary).
• How much identity theft a freeze can reach. BJS, Victims of Identity Theft 2021 (12 Oct 2023): 23,928,600 victims (9.1% of residents 16+); "For 76% of identity-theft victims in 2021, the most recent incident involved the misuse of only one type of existing account"; "Opened new account only" was 759,330 victims, 3.2% of victims; a further 14.0% had multiple types. Of the 7% of victims who contacted a credit bureau, 56% placed a freeze. https://bjs.ojp.gov/library/publications/victims-identity-theft-2021 and https://bjs.ojp.gov/document/vit21.pdf (fetched 2026-11-05; primary, national survey).
• The bureaus themselves. TransUnion disclosed on 28 Aug 2025 a breach of "more than 4.4 million customers' personal information" from a third-party application for US consumer support; a Texas filing listed "names, dates of birth, and Social Security numbers"; TransUnion said no credit information was accessed. https://techcrunch.com/2025/08/28/transunion-says-hackers-stole-4-4-million-customers-personal-information/ (fetched 2026-11-05; news). Experian: Krebs (11 Nov 2023) could re-create his own Experian account with personal data and a new email, no verification of the original; Experian said it uses "a multi-layered security approach". https://krebsonsecurity.com/2023/11/its-still-easy-for-anyone-to-become-you-at-experian/ (fetched 2026-11-05; news; outside the 24-month window, kept as background because the page sends readers to that account).
• IRS IP PIN: the IRS page is cited on the Do page (research file grade P, updated 2 Nov 2026). No TIGTA or Taxpayer Advocate figures on take-up or on identity-theft case delays could be fetched today (the Advocate's report landing page had no body text; search exhausted).
• No causal study of freezes on new-account fraud rates was found.

Grade: moderate for what a freeze does (stop new credit in your name), by mechanism and GAO; narrow in scope: new-account fraud is a few percent of identity theft, and a freeze does nothing for the 76% that is existing-account misuse. The page already says "It doesn't protect accounts you already have". Re-rank below the behavioural items (see B).

A5. Have I Been Pwned alerts (Do §5; Practice rhythm)

• The closest outcome study is of a similar tool. Thomas et al. (Google, USENIX Security 2019), Password Checkup extension: telemetry from nearly 670,000 users, 21 million logins; "1.5% of logins on the web" used breached credentials; "26% of warnings led users to migrate to a new password at least as strong as the original". https://research.google/pubs/protecting-accounts-from-credential-stuffing-with-password-breach-alerting/ (fetched 2026-11-05; research, Google authors).
• HIBP itself: no outcome study found. The service and its operator: Troy Hunt's Mailchimp list (about 16,000 addresses, "7,535" of them already unsubscribed) was exported via a phish on 25 Mar 2025 (primary, above). HIBP's breach data was not involved. haveibeenpwned.com returned 200 today.
• Mozilla Monitor does the same job ("We scan data breaches to see if your data has been leaked and give you steps to fix it"; monitoring "always free"); its page does not name its data source. https://monitor.mozilla.org/ (fetched 2026-11-05; primary).

Grade: moderate, low effort. One in four warnings changing behaviour is a real but partial effect.

A6. Backups (Do §6; Practice: restore one file a quarter)

• Household-level ransomware is small in the only national count. IC3 2025: ransomware 3,611 complaints, $32,320,105 adjusted losses (the report notes entities often report no loss amount, "creating an artificially low overall ransomware loss rate"); over-60s 358 complaints, $5,644,789 (primary).
• Organisation-level it is the main event. Verizon DBIR 2026 (executive summary; 31,000+ incidents, 22,000+ breaches, 145 countries): "Ransomware grew again to 48% of all breaches, up from 44%"; "69% of ransomware victims didn't pay"; median ransom "$139,875". https://www.verizon.com/business/resources/executivebriefs/dbir-2026-executive-summary.pdf (fetched 2026-11-05; industry report, vendor-compiled from contributors). Sophos, State of Ransomware 2026 (2,158 IT leaders, 17 countries, organisations of 100–5,000 staff): 56% of attacks succeeded in "encrypting data"; median ransom payment $769K. https://www.sophos.com/en-us/content/state-of-ransomware (fetched 2026-11-05; industry projection/survey). The backup-restore and root-cause percentages were not on the page.
• FTC's phishing guidance lists "Protect your data by backing it up" as one of four steps, no evidence cited. https://consumer.ftc.gov/articles/how-recognize-and-avoid-phishing-scams (fetched 2026-11-05; primary).

Grade: weak as a cybercrime-loss reducer for a household; strong by common sense against device loss and failure (not measured here). For the "If you run something small" section it is moderate: DBIR and Sophos describe the organisational threat it answers.

A7. Automatic updates (Do §7; Practice: click Relaunch)

• DBIR 2026: "Exploitation of vulnerabilities is now the most common initial access vector for breaches. It has risen to 31%", credential abuse "down to 13%"; only 26% of CISA-KEV vulnerabilities "were fully remediated by organizations in 2025"; median time to full resolution 43 days (industry report; organisations, not households).
• Google Threat Intelligence Group (29 Apr 2025): "75 zero-day vulnerabilities exploited in the wild in 2024", down from 98; end-user platforms 42 (56%); browsers fell 17 to 11 and mobile 17 to 9, attributed to vendor mitigations; of attributed cases "nearly 53%" were espionage (nation-states and commercial surveillance vendors), financially motivated groups "almost 15% (five vulnerabilities)". https://cloud.google.com/blog/topics/threat-intelligence/2024-zero-day-trends (fetched 2026-11-05; industry report).
• CISA mobile guidance: "Enable auto-update on mobile devices"; FTC: "setting software to update automatically" (primary; no evidence cited).

Grade: moderate. The mechanism is as strong as any on the page, the cost is near zero, and the organisational data is clear. The household-level attribution is thin: what reaches households in the IC3 data is overwhelmingly social engineering, not exploits, and zero-days against phones are mostly aimed at targeted individuals.

A8. Family safe word, and the three tells (Do §8; Practice drill)

• The FBI PSA I-120324-PSA (3 Dec 2024) says: "Create a secret word or phrase with your family to verify their identity" and "Verify the identity of the person calling you by hanging up the phone, researching the contact". It "cites no evidence, data, studies, or outcome statistics showing that these tips work". https://www.ic3.gov/PSA/2024/PSA241203 (fetched 2026-11-05; primary).
• The FTC's voice-clone alert (20 Mar 2023) says "Don't trust the voice", "Call the person who supposedly contacted you and verify the story. Use a phone number you know is theirs", and names wire, crypto and gift cards as warning signs. It does not mention a code word; code words appear only in reader comments. No evidence cited. https://consumer.ftc.gov/consumer-alerts/2023/03/scammers-use-ai-enhance-their-family-emergency-schemes (fetched 2026-11-05; primary).
• Scale of the specific scam: IC3 2025 says victims "claimed losses over $5 million in 2025 to distress scams" (voice-cloned loved one); AI-related complaints overall 22,364, $893,346,472 (primary). Impostor scams more broadly are where the money is: tech/customer support $2,134,675,818; government impersonation $797,943,193 (32,424 complaints); BEC $3,046,598,558 (primary).
• No trial or study of safe words was found. One mechanism caution (my inference, not a fetched finding): a word only works if the person under stress remembers to ask for it and refuses to supply it when the caller asks "what's our word?"; the call-back rule needs no memory and covers every impostor scam, not only family-emergency ones.
• Evidence that cues at the moment of contact help: Lain et al. (below) found warnings on suspicious emails cut clicks from 3,964 (no warning) to 1,427 (short) and 1,289 (detailed), p < 0.001 (research). That supports teaching the three tells as a recognisable pattern, not the safe word specifically.

• Forewarning trials, the closest test of "teach the pattern in advance":
• Scheibe, Notthoff, Menkin, Ross, Shadel, Deevy, Carstensen (2014, Basic and Applied Social Psychology): 895 previous mail-fraud victims from US Postal Inspection Service lists, randomised to a warning call about the same scam or a different scam, 2 or 4 weeks before a mock telemarketing pitch, or control; the mock pitch reached 511 (57.1%). Control: "the almost 50% unequivocal acceptance responses"; any warning cut unequivocal acceptance (χ²(1) = 10.46, p = .001). The warning about a different scam transferred (response pattern vs control p = .014 at 2 weeks, p = .018 at 4 weeks; the cut in unequivocal acceptance p = .064 at 2 weeks, p = .005 at 4 weeks). The same-scam warning worked at 2 weeks (p = .009) and not at 4 (p = .588): "The same scam warning, but not the different scam warning, lost effectiveness over time." Limits (authors'): verbal acceptance, not payment ("The proportion of respondents who would have actually authorized the relevant payment cannot be ascertained"); two scams; the warning call was conversational. https://pmc.ncbi.nlm.nih.gov/articles/PMC4199235 (fetched 2026-11-05, sweep and re-verified; research).
• USPIS mail RCT (DeLiema, Brannock, Preble, Langton 2024, Innovation in Aging abstract): known older mail-fraud victims randomised to one educational letter, the letter plus five "Fraud Fighter" mailings two weeks apart, or nothing; outcome was actual behaviour, return addresses on detained victim mail over four months: "the single letter condition reduced the rate of revictimization by 8.6% and the multiple mailing condition reduced the rate of revictimization by 22.4% over 4 months". Whether those are relative or absolute, and per-arm N, are not in the abstract; the NIJ final report (NCJ 308661) returned 404. https://pmc.ncbi.nlm.nih.gov/articles/PMC11689558 (fetched 2026-11-05 by the sweep; my re-check hit a CAPTCHA; research, abstract-level).
• Burke, Kieffer, Mottola, Perez-Arce (Feb 2021, FINRA Foundation/USC working paper; pre-registered): 2,000 Understanding America Study panellists, average age 54, randomised to video, text or control; outcome was stated willingness to invest in hypothetical fraudulent pitches. At baseline the interventions cut willingness by about 40% relative to control; at six months "Differences across conditions are not statistically significant", while "individuals who received a reminder three months prior expressed a significantly lower willingness to invest than individuals in control (5.2; p-value < 0.001)"; "Nearly all of the effects of the reminder intervention are concentrated on those with higher cognitive ability". https://gflec.org/wp-content/uploads/2021/04/Burke-Kieffer-Mottola-Perez-Arce-Can-Educational-Interventions-Reduce-Susceptibility-to-Financial-Fraud-CB2021.pdf (fetched 2026-11-05 by the sweep; research, working paper).
• Alberts, Espiritu, Castel (2026, Experimental Aging Research; RCT, lab email-classification task, younger and older adults): interventions did not improve detection; they made people more cautious (abstract only; N not available). (sweep; research.)
• Reading across them: telling someone about a scam in advance does reduce acceptance of a scam pitch, it transfers to scam types not mentioned, it has been shown on real mail-fraud revictimisation, and it fades within weeks to months unless repeated. None of it tests a safe word.

Grade: safe word none-but-plausible (official recommendation, no evidence, small category). "Hang up and call back on a number you already have" plus "urgency, secrecy, irreversible payment" moderate: no trial of that exact rule, but the FTC and FBI both give it, it maps onto the top loss categories, warning-cue evidence (Lain) and forewarning trials (Scheibe; USPIS) are consistent with it, and the transfer finding supports teaching a general pattern rather than a scam-by-scam list. The decay findings argue for the Practice page's repetition, not against the Do page's lesson.

A9. If it already happened: bank first, then IC3, identitytheft.gov, ReportFraud (Do "If it already happened"; Practice drill)

• IC3 Recovery Asset Team 2025: "3,900 Incidents", "$1,163,919,846 Attempted Theft", "$679,013,183 Frozen", "58% Success Rate"; domestic 3,574 incidents and $507,042,623 frozen; international 326 incidents and $171,970,560 frozen. For victims 60+: 642 incidents, $65,367,648 reported loss, $32,865,655 frozen (50%), top types "Tech Support/ATO scams: 360", "BEC (BEC/Real Estate): 104", "Investment (Investment/Crypto): 64". Guidance: "If you discover a fraudulent transfer, time is of the essence. Immediately, contact your financial institution and request a recall of the funds"; "Regardless of the amount lost, file a complaint at www.ic3.gov." (primary). The RAT's 3,900 incidents are 0.4% of the year's 1,008,597 complaints; the Financial Fraud Kill Chain's eligibility thresholds were not fetched today.
• Regulation E (12 CFR 1005.6): "If the consumer notifies the financial institution within two business days after learning of the loss or theft", liability "shall not exceed the lesser of $50 or the amount of unauthorized transfers"; otherwise up to $500; unlimited for transfers that appear on a statement and are not reported within 60 days. https://www.consumerfinance.gov/rules-policy/regulations/1005/6/ (fetched 2026-11-05; primary). CFPB EFT FAQs (updated 15 Jan 2025): where account access information is obtained through fraudulent means, "the transfer is an unauthorized EFT under Regulation E" (Unauthorized EFTs Q4, Q5, Q6). The FAQs do not say that a payment the consumer was tricked into sending is unauthorised. https://www.consumerfinance.gov/compliance/compliance-resources/deposit-accounts-resources/electronic-fund-transfers/electronic-fund-transfers-faqs/ (fetched 2026-11-05; primary).
• What banks actually do on Zelle. Senate Permanent Subcommittee on Investigations majority staff report (23 July 2024), as reported by NBC Connecticut the same day: JPMorgan Chase, Bank of America and Wells Fargo "reimbursed 38 percent of customers who said they did not approve a transfer" and reimbursed "12 percent of cases where they reported fraud"; about $100 million of unauthorised transfers not reimbursed; Early Warning Services: 99.95% of transactions complete "without a fraud or scam complaint". https://www.nbcconnecticut.com/news/local/blumenthal-calls-for-crackdown-on-zelle-banks-over-fraud-concerns/3342959/ (fetched 2026-11-05; news). The report PDF and the Senate press release both returned 403 today. CFPB sued Early Warning and the three banks on 20 Dec 2024, then "filed a notice voluntarily dismissing the action against all defendants with prejudice"; "on March 5, 2025, the court dismissed the case with prejudice". https://www.consumerfinance.gov/about-us/newsroom/cfpb-sues-jpmorgan-chase-bank-of-america-and-wells-fargo-for-allowing-fraud-to-fester-on-zelle/ (fetched 2026-11-05; primary; the loss figure "$870 million over seven years" appeared only in a search summary and is unread). New York's Attorney General sued Early Warning on 13 Aug 2025 alleging more than $1 billion in consumer losses since 2017; EWS called it "nothing more than a copycat" of the dismissed CFPB case. https://www.bankingdive.com/news/ny-ag-letitia-james-sues-early-warning-services-zelle-fraud-cfpb/757583/ (fetched 2026-11-05; news). Status of the NY case today: not checked.
• The UK comparison, where reimbursement is mandatory. Payment Systems Regulator (8 Oct 2025): in the first nine months "£112 million was reimbursed to victims"; 126,000 claims, about 15% lower than a year earlier; 88% of the money lost and claimed back was returned, "significantly increased from 66% for the same period in 2023/24"; the PSR warns "It's not possible to make direct comparisons with data from before our policy". https://www.psr.org.uk/news-and-updates/latest-news/news/one-year-on-impact-of-app-reimbursement-on-victims/ (fetched 2026-11-05; primary). A July 2026 independent evaluation (Frontier Economics) appeared in search summaries claiming a £73m-a-year fall in in-scope scam losses and reimbursement by value rising from 54% to 65%: unread; it conflicts with the PSR's own 88% framing because it measures confirmed losses, not claimed losses. Contest kept.
• Reporting rates. BJS 2021: "About 7% of identity-theft victims in 2021 reported the incident to police, and 67% contacted a credit card company or bank"; 7% contacted a credit bureau; 1% contacted the FTC (primary). FTC: "The information you give helps fight scammers" (primary; no outcome data). The IC3 impersonation PSA (18 Apr 2025) warns that criminals now pose as IC3 staff offering to recover funds (more than 100 reports Dec 2023–Feb 2025) and states "The IC3 will never directly communicate with individuals via phone, email, social media, phone apps, or public forums." https://www.ic3.gov/PSA/2025/PSA250418 (fetched 2026-11-05; primary).

Grade: "call the bank the same day, before anything else" strong (statute sets the $50 cap at two business days; RAT data show recovery depends on speed). "Report to IC3" moderate for the individual (58% of a small, bank-to-bank subset is frozen; most consumer losses are gift cards and crypto, which the report says are hard to reverse) and moderate for the commons (it is the FBI's only aggregate instrument; reporting is at 1–7%). The page's own caveat, "Frozen isn't always returned", is right; add "3,900 cases" so the 58% is not read as a general recovery rate. The decisive variable is bank-side policy (US 38%/12% vs UK 88% by claimed value), which one person cannot change except by choosing payment method: card over push payment where possible (Reg E / card protections) and never gift cards or crypto.

A10. Protecting older relatives (Do: "Send this page to the person…"; Practice: run the drill with family)

• Scale from IC3 2025: complainants 60+ filed 201,266 complaints (a 37% increase) and lost $7.748 billion (a 59% increase); "$38,500 average loss"; "12,444 complainants lost more than $100K". Their biggest categories by loss: investment $3,519,296,354; tech/customer support $1,040,730,043 (21,333 complaints); confidence/romance $584,032,745; BEC $568,048,472; government impersonation $413,206,251; phishing/spoofing had the most complaints (48,064) but $77,020,936 in losses (primary).
• Mechanism evidence that a second person helps: the elder-fraud FFKC subset froze 50% of attempted losses when a bank was involved early (primary). The FTC's "Pass It On" campaign is built on peer sharing ("sharing what you know can help protect someone who you know from a scam") and cites no evaluation. https://consumer.ftc.gov/features/pass-it-on (fetched 2026-11-05; primary).
• Who is at risk, and why "just warn them" is not enough. DeLiema, Deevy, Lusardi, Mitchell (NBER WP 24803, 2018; a module in the 2016 Health and Retirement Study, N = 1,268, average age 68.2): five-year prevalence "Any fraudulent investment 4.91%", "Paid to receive a prize/lottery/award 4.33%", "Account used/attempted to be used without permission 29.53%"; "There were few risk factors consistently associated with such victimization in the older population"; "Neither financial literacy nor self-reported financial knowledge were consistently and significantly associated with any key outcome"; the authors suggest "unmeasured situational factors play a larger role, such as whether the respondent was alone when solicited or in a state of high emotional arousal". https://www.nber.org/papers/w24803.pdf (sweep; research, working paper). Burnes et al. (AJPH 2017; 12 studies, 41,711 people): one-year prevalence of financial fraud among older adults 5.4% (95% CI 3.2–7.6%); it is a prevalence meta-analysis and says nothing about which prevention works (sweep; research). Boyle et al. (Annals of Internal Medicine 2019; Rush Memory and Aging Project, 935 dementia-free older people, about six years' follow-up): each unit of lower scam awareness carried a hazard ratio of 1.56 (95% CI 1.21–2.01) for incident Alzheimer dementia, persisting after adjustment for global cognition; "Low scam awareness among older persons is a harbinger of adverse cognitive outcomes" (sweep; research). My inference, not the paper's: the people most at risk are the ones least able to take in and keep a warning, which is why the page should pair warnings with a second person and with structural blocks (2FA, freeze, bank alerts).
• Having someone to talk to. "Exposed to Scams: What Separates Victims from Non-Victims?" (BBB Institute, FINRA Investor Education Foundation, Stanford Center on Longevity; September 2019; 18 interviews and a survey of 1,408 people who had filed a report with BBB Scam Tracker; sample "skewed older, female, and college-educated"): 47% did not engage, 30% engaged but lost nothing, 23% lost money; "Respondents who had heard about the scam before were significantly less likely to lose money (9 percent versus 34 percent, p<.001)"; "Respondents were more likely to be victimized if they did not have anyone to discuss the offer with"; among those who engaged, 20% reported a third party intervened and "51 percent of people who reported a third-party intervention were able to avoid losing money"; by channel, social media exposure led to 91% engaging and 53% losing money, phone to 39% and 11%. https://finrafoundation.org/exposed-to-scams (sweep; PDF re-read locally; charity's own figures, cross-sectional, reporters only).
• A trained person at the bank. AARP BankSafe pilot (AARP press release, 17 Oct 2019; Virginia Tech Center for Gerontology evaluation; "More than 1,800 employees from nearly 500 bank and credit union branches in 11 states", six months): trained staff "stopped nearly $1 million ($900,915) from leaving consumer accounts. That was 16 times higher than what employees who didn't take the training saved consumers ($54,384)"; "More than four times the number of suspected incidents of financial exploitation were reported". No page states whether assignment was randomised or how "money saved" was measured. https://www.aarp.org/press/releases/2019-10-17-financial-exploitation-declines-banksafe-aarp.html and https://liberalarts.vt.edu/research-centers/center-for-gerontology/research-report-bank-safe.html (sweep; charity's own figures). FINRA's trusted-contact (Rule 4512) and temporary-hold (Rule 2165) rules: Regulatory Notices 19-27 and 22-05 give anecdotes ("$200,000", "$60,000 in a romance scam") and no counts; FINRA's "Protecting Senior Investors 2015–2020" reports its Securities Helpline for Seniors had "over 18,000 calls" by end-2019 and "assisted with the return of over $7 million to investors" (sweep; primary, output data). Implication for one person: ask the relative's bank or brokerage to add you as trusted contact; the mechanism is documented, its effect is not.
• Family tech support. Murthy, Bhat, Das, Kumar (CSCW 2021; 20 participants from eight households in Bangalore and Mysore, qualitative): "self-appointed family technology managers straddle the line between stewardship and paternalism"; one manager "blocked any calls from any unknown numbers" on his parents' phones; "paternalistic stewardship did not always help them gain experience or independence." https://par.nsf.gov/servlets/purl/10285009 (sweep; research, qualitative, one country). No trial of a family member as tech support or trusted contact was found.

Grade: moderate that a second person at the moment of the request reduces loss (FFKC elder data; the Exposed to Scams correlations; BankSafe's self-reported dollars all point the same way, none is randomised). Weak for any specific family routine (qualitative only), with a documented downside: control that removes the older person's agency. Design implication for the page: write the agreement as reciprocal ("either of us calls the other before any payment over $X") and name the trusted-contact option at the bank.

A11. "If you run something small" (Do)

• Microsoft security defaults page is cited on the Do page; the 99.2% figure it quotes traces to Meyer et al. 2023 above (research, Microsoft authors, commercial accounts). Grade strong for "MFA for everyone, admins first" in an organisation.
• "Confirm every payment change by phone": BEC $3,046,598,558 in 2025 (primary). No trial; the control is the universal one. Grade moderate.
• Backups and updates: DBIR 2026 (48% ransomware; 31% vulnerability exploitation; 26% of KEV fixed) and Sophos 2026. Grade moderate.
• Offboarding: no evidence fetched today; mechanism only. none-but-plausible.

A12. The Practice page's drill (seven scam-or-not messages, run quarterly with family)

• Lain, Kostiainen, Čapkun (IEEE S&P 2022; arXiv 2112.07498): 14,733 employees of one company, July 2019–October 2020; 32.10% clicked at least one simulated phish and 25.43% did a dangerous action; warnings on suspicious emails cut clicks from 3,964 to 1,427/1,289 and dangerous actions from 2,994 to 998/893; "detailed warnings are not more effective than short ones"; voluntary embedded training after a click did not help: participants who clicked two or more phishes were "647 without training, and 801 with training" (p < 0.001; dangerous actions 2,155 vs 2,730); "this particular way of delivering voluntary training does not work. Instead, such training method may cause unexpected and negative side effects". Crowd-sourced reporting: 4,260 participants reported at least one email, 18,476 reports in 15 months, "practical in large organizations". https://arxiv.org/abs/2112.07498 (fetched 2026-11-05; research).
• Ho et al. (IEEE S&P 2025): UC San Diego Health, "over 19,500 employees", eight months, ten campaigns, randomised control groups; "no significant relationship between whether users have recently completed cybersecurity awareness training and their likelihood of failing a phishing simulation"; embedded training "provides a statistically-significant reduction in average failure rate, but of only 2%"; lure click rates ranged 1.8–30.8%; "56% of users (11,077 out of 19,789) failed at least once" over eight months; "between 37–51% of all training sessions have no engagement at all"; conclusion: current anti-phishing training "unlikely to offer significant practical value", recommending "two-factor authentication" and "password managers that only work on correct domains". https://sysnet.ucsd.edu/~voelker/pubs/phishtrain-oakland25.pdf and https://today.ucsd.edu/story/cybersecurity-training-programs-dont-prevent-employees-from-falling-for-phishing-scams (fetched 2026-11-05; research; single health system).
• NCSC phishing guidance (reviewed 13 Feb 2024): "Phishing mitigations often place too much emphasis on users being able to spot phishing emails"; "No training package, including phishing simulations, can teach users to spot every phishing attempt"; "Users who fear reprisals will not report mistakes promptly, if at all"; "Phishing simulations also erode trust between employees and security". https://www.ncsc.gov.uk/guidance/phishing (fetched 2026-11-05; primary).
• DBIR 2026: in phishing simulations the median click rate for mobile-centric lures (voice, text) "is 40% higher than via email" (industry report).

• The nearest tests of a drill like this one. Baillon, de Bruin, Emirmahmutoglu, van de Veer, van Dijk (PLOS ONE 2019): Dutch Ministry of Economic Affairs, 10,929 of 12,567 employees randomised in 184 units to Control (2,723), Info (infographics, 2,740), Exp (one simulated phish with a debrief, 2,724) or both (2,742); on a test phish 40 days later, password disclosure was "22% in Control, and dropped to 16%, 14%, and 13% in Info, Exp, and ExpInfo respectively" (average marginal effects on disclosure −0.056, p<0.01; −0.078 and −0.087, p<0.001); "Combining both interventions did not have a larger impact." Limits: unit-level randomisation, a leaked notice may have contaminated two arms, passwords could not be verified. https://www.ebi.ac.uk/europepmc/webservices/rest/PMC6919577/fullTextXML (fetched 2026-11-05, sweep and re-verified; research). Reinheimer et al. (SOUPS 2020; 409 employees of a German public administration): effect present at four months, "not the case anymore after six months"; "measures based on videos and interactive examples perform best". https://www.usenix.org/conference/soups2020/presentation/reinheimer (sweep; research). Gordon et al. (JAMA Network Open 2019; six US health systems, 95 campaigns, 2,971,945 simulated emails): median click rate 16.7%; institutions that had run more campaigns had lower odds of clicks (adjusted OR 0.335, 95% CI 0.282–0.398 for more than ten campaigns), observational (sweep; research).
• Forewarning trials in §A8 (Scheibe 2014: transfer across scam types, fade by four weeks for the same-scam warning; USPIS: five mailings 22.4% vs one letter 8.6%; Burke 2021: gone at six months without a reminder).

Grade: weak-to-moderate. A one-off exposure with a debrief and a forewarning conversation both show short-lived effects in field experiments; routine embedded training after failure does not (Lain, Ho); every study that measured duration found decay between one and six months. Not contradicted: the drill is voluntary, non-punitive and teaches a pattern (the three tells) rather than an email-spotting skill. The Practice page's quarterly cadence is close to what the decay data support; "run it with someone" matches the Exposed to Scams finding that people with someone to talk to lost less. What the trials also support is building in the cues and the reporting habit (A8, C1).

A13. Civic ask: State and Local Cybersecurity Grant Program (Do)

Not re-checked today (search exhausted). The page's source is StateScoop (1 Sep 2026; news). Status after that date is unknown; the item is on the stale list. StateScoop is a Scoop News Group brand (inferred from its footer; https://statescoop.com/about/, fetched 2026-11-05).

---

B. The highest-impact things one person can do, ranked

Decision context: one adult, no special position, a few hours a month, a modest budget; the aim is to cut their own and their household's cybercrime losses, and to reduce the problem for others. Criteria fixed before ranking: (1) size of the loss category the action touches in the 2025 IC3 data, (2) strength of the evidence that the action changes the outcome, (3) cost in minutes and dollars, (4) whether it also helps others.

Then, in order: lock your phone number (moderate; protects rank 1's weakest fallback; small loss category), breach alerts (moderate; 26% of warnings change a password), automatic updates (moderate; near-zero cost), credit freeze (moderate but narrow: new-account fraud is 3.2% of identity-theft victims), backups (weak for cybercrime loss; keep one line, move the rest to the small-org section), family safe word (none-but-plausible; keep as a two-minute add-on under the call-back rule), the civic ask (weak, status stale).

Drop, keep, re-rank (what I would change on the pages):

• Promote the call-back rule and the three tells from a sub-bullet of Do §8 to a step of its own, second in "The whole thing". Reason: it is the only action that reaches the categories where most money is lost, and the current page frames it only as a voice-clone response.
• Keep Do §1–§2 as the opening; add "put 2FA on the manager itself" into §1 (NCSC already cited). Reason: strong evidence; nothing to change but emphasis.
• Re-rank Do §3 (phone lock) below the call-back step and keep it; reason: strong mechanism, small loss category, the FCC now requires carriers to offer it free.
• Re-rank Do §4 (credit freeze) to after breach alerts and rewrite the lede: "stops new credit in your name, which is a few percent of identity theft; it does nothing for your existing accounts". Keep it, because it is free and GAO-endorsed for what it does. Add that two of the three bureaus had account-security problems (TransUnion 2025 breach; Experian re-registration 2023) so the reader should create and protect their own bureau accounts.
• Re-rank Do §6 (backups) to one line for individuals ("a lost phone is the common case") and keep the full treatment in "If you run something small". Reason: household ransomware is 3,611 complaints and $32m in a $20.9bn year.
• Re-rank Do §8: lead with "hang up, call back" (FTC and FBI), then offer the safe word as an optional extra with "the FBI suggests it; nobody has measured whether it works". Reason: no evidence; the FTC does not recommend it; it depends on memory under stress.
• Rewrite the RAT sentence to carry the denominator: "froze $679 million of $1.16 billion across 3,900 bank-to-bank cases".
• Add to "If it already happened": the two-business-day rule and the $50/$500 tiers (statutory, strong), and a line that payments you authorised to a scammer are not covered by that rule and that Zelle disputes were reimbursed at 38% (unauthorised) and 12% (fraud) by the three biggest banks in the Senate report.
• Add to the Practice page: "report, don't just delete" (7726; mail-app report button) with the Lain finding that employee reports caught new campaigns; and a note that drills are for pattern recognition, that two large trials found simulated-phish training alone did little, that the effect of any warning fades in one to six months (Scheibe, Burke, Reinheimer), which is why the drill repeats quarterly and is run with someone, and that nobody should feel stupid for clicking (NCSC; 56% of a hospital's staff clicked within eight months).
• Rewrite the older-relative items (Do notice; Practice "Today" and "Every quarter") as a reciprocal agreement rather than oversight, and add "ask their bank or brokerage to list you as a trusted contact". Reason: the only qualitative study of family tech support found control that removed the older person's agency (Murthy 2021); FINRA's trusted-contact mechanism exists even though its effect is unmeasured.
• Add for anyone who is a likely target (public role, journalist, activist, large crypto holdings): CISA's mobile guidance list, including Google Advanced Protection and disabling SMS fallback once a passkey is enrolled.
• Mark stale: the SLCGP civic ask (last source 1 Sep 2026); the Windows 10 ESU date; Microsoft's SMS phase-out (its page still gives no date, fetched today).
• Drop nothing outright. Every current action has at least a plausible mechanism and is cheap. The errors on the page are of emphasis and of implied certainty, not of direction.

---

C. Communal impact, harm and backfire, and doing it with others

C1. Who benefits from each kept action, and how much

• 2FA/passkeys on email: the account holder first; then everyone in their contacts, because a taken-over account is the launch point for the "is this you in this video" and BEC lures on the Practice page (mechanism; Lain's warnings data; IC3 BEC $3.05bn). Also the bank's fraud desk and the RAT, since account-takeover cases "can contain upwards of 50 or more transactions to different recipient accounts at multiple banks happening simultaneously" (IC3, primary).
• Call-back rule: the household; the older relative; and, if the attempt is reported, everyone downstream. No measurement of spillover found.
• Reporting: the only measured communal channel. IC3 "now average[s] almost 3,000 complaints per day" and the RAT process is triggered by complaints (primary). In Lain's company, employee reports let the security team detect new campaigns quickly (research). The FTC says reports "help fight scammers" (primary, no measurement). Reporting is rare: BJS 7% police, 1% FTC (primary).
• Credit freeze: the individual only; no spillover.
• Updates and backups: the individual; updates also remove a device from botnets (mechanism only; not measured today).

C2. Harm and backfire evidence

• Training that makes people worse or no better: Lain et al. (801 repeat clickers with training vs 647 without, p < 0.001); Ho et al. (2% absolute effect; 37–51% of training sessions closed without engagement; 56% failed at least once in eight months). NCSC: simulations "erode trust", and "punishing people for clicking on emails you've sent starts to resemble entrapment". Implication for the site: the drill must stay voluntary and blame-free, and must never be used by an organisation as a test with consequences.
• Shame and non-reporting: BJS 2021 shows the reporting floor (7% police; FTC 1.3% in Table 9; 10% "severely distressed"; the most common reason for not reporting to police was that it "was handled in another way, such as by the victim, a financial institution, or another organization (57%)"). FINRA Investor Education Foundation, "Non-Traditional Costs of Financial Fraud" (March 2015; online panel of 600 self-reported victims, August 2014, non-probability): "While over two-thirds of respondents (68 percent) told friends or family members about the incident, far fewer (35 percent) reported the incident to the authorities"; reasons for not reporting: "Wouldn't have made a difference 48%; Wanted to put it behind me 35%; Was embarrassed 29%; Didn't know where to turn 26%"; "Just under half (47 percent) blame themselves"; "Nearly two-thirds (65 percent) report experiencing at least one type of non-financial cost to a serious degree". https://finrafoundation.org/sites/finrafoundation/files/non-traditional-costs-financial-fraud_0_0.pdf (sweep; charity's own figures). Exposed to Scams (2019): between 36% and 43% of respondents "believe that victims of fraud are gullible", the authors linking stigma to low reporting (sweep; charity's own figures). NCSC: "Users who fear reprisals will not report mistakes promptly, if at all." The IC3 impersonation PSA documents a direct harm of reporting culture: criminals posing as IC3 to "revictimize those who have already lost money". No study measuring whether awareness training itself increases victim-blaming was reached (Cross 2015 and Button et al. are paywalled).
• Over-reliance on SMS codes: NIST restricts PSTN out-of-band; Princeton found all five carriers tested had subvertible authentication and 17 sites fell to a SIM swap alone; Hunt's OTP was relayed in real time; Microsoft's AiTM campaign hit 10,000+ organisations. The page's current line, "Text-message codes are the weakest kind… Google still says any two-step sign-in beats none", is exactly right by the Google and Microsoft data (SMS still blocked 76% of targeted attacks; SMS 1.66% vs app 0.99% compromise in Microsoft's reviewed set). CISA adds the trap the page misses: after enrolling a passkey, "disable SMS for each account", because enrolment "does not automatically unenroll the account's SMS. This can create a weak, exploitable fallback mechanism".
• Warnings that don't transfer or fade: transfer held (Scheibe 2014: a warning about a different scam reduced acceptance of the test scam, p = .005 at four weeks). Fade is the consistent finding: same-scam warning gone by four weeks (Scheibe); single-dose video/text effects "disappear almost entirely after six months" (Burke 2021); workplace effect present at four months, gone at six (Reinheimer 2020); five mailings beat one letter, 22.4% vs 8.6% (USPIS RCT). Boyle 2019 adds the structural limit: low scam awareness is itself a prodromal sign of cognitive decline, so the people most at risk are least able to retain a warning (research; the implication is mine).
• Password manager as single point of failure: LastPass 2022 and the 2024–25 thefts linked in a federal seizure complaint (Krebs; LastPass disputes the link). Mitigation is on the page (long passphrase; 2FA on the manager).
• Credit bureaus as a weak link: TransUnion 2025 breach (4.4m; SSNs per Texas filing); Experian account re-registration (2023). A freeze remains worth placing; the reader should also hold their own account at each bureau so a hijack is noticed.

C3. Doing it with others: which group formats have evidence

Workplace:

• Routine simulated phishing plus embedded training after a failure: two large field studies find little or no benefit and one finds a negative side effect (Lain 2022; Ho 2025). contradicted as a stand-alone measure.
• A one-off simulated phish with a debrief, or an infographic campaign: password disclosure 22% → 14% / 16% forty days later in a 10,929-person ministry (Baillon 2019); effects gone by six months without a reminder (Reinheimer 2020). moderate, short-lived.
• Warnings on suspicious messages and a one-click report button, with the reports acted on: effective in a 14,733-person company (Lain 2022), and endorsed by NCSC. moderate.
• MFA for everyone, admins first: Microsoft's commercial-account study (99.22%); Google's 2SV auto-enrol (50%, self-reported). strong.
• A written "call before you pay" rule for payment changes: no trial; BEC is the mechanism it addresses ($3.05bn). moderate by mechanism.
• Bank-staff training to spot exploitation: AARP BankSafe pilot, 1,800 staff, self-reported 16× more money stopped; method not published. weak-to-moderate (charity's own figures).

Family, peer and community formats (from the sweep unless marked):

• Repeated mailed warnings to known victims: the only randomised trial with a behavioural outcome; five mailings cut revictimisation 22.4%, one letter 8.6%, over four months (USPIS/DeLiema 2024). moderate (abstract-level; effect-size definition unclear). The household version is the Practice page's rhythm: repeat, don't lecture once.
• A person to talk to at the moment of the pitch: correlational and consistent (Exposed to Scams 2019: no one to discuss with → more loss; 51% of third-party interventions averted loss; NBER 2018: being alone when solicited is the authors' suspected factor). moderate (correlational).
• Family "tech manager" routines: one qualitative study (Murthy 2021, 20 people, India) finds help that shades into paternalism and reduces the older person's agency; no outcome data. weak; design matters.
• Peer champions: CyberGuardians (Nicholson et al., CHI 2021; 14 guardians in their 50s–70s, eight-month pilot in north-east England): qualitative benefits, "informal methods" built awareness, guardians as role models; no behaviour or loss measure available (the full paper returned 403 on three hosts). https://researchportal.northumbria.ac.uk/en/publications/training-and-embedding-cybersecurity-guardians-in-older-communiti/ (sweep; research, qualitative). none-but-plausible.
• Senior Medicare Patrol (HHS OIG, 2024 performance data, issued 12 June 2025): 54 projects, "5,643 active team members", "22,752 group outreach and education events", "283,724 individual interactions", "$35,115,211 in expected Medicare recoveries"; the 2023 figure of $111,277,683 was almost entirely one restitution order; OIG notes the projects "are unable to track the potentially substantial savings derived from a sentinel effect". https://oig.hhs.gov/reports/all/2025/2024-performance-data-for-the-senior-medicare-patrol-projects (sweep; primary, output data, not a trial). Shows the group-workshop format runs at national scale; its effect on individual loss is unmeasured.
• Friends Against Scams (UK National Trading Standards): a 2021 impact survey of 150 participants reporting knowledge and confidence gains and a "£59 in savings … for every Friend" claim with no method; unread (site 403). none-but-plausible.
• CFPB Elder Fraud Prevention and Response Networks (May 2019 report): convenings in five states; the outcomes section is anecdotes, no counts. https://files.consumerfinance.gov/f/documents/cfpb_OA-networks_report.pdf (sweep; primary, descriptive). none-but-plausible.
• AARP Fraud Watch Network Helpline (AARP Research, Nov 2024; phone survey of 300 callers, retrospective self-ratings): embarrassment 50% → 33%, anger 75% → 38%, "80% took actionable steps". https://www.aarp.org/pri/topics/work-finances-retirement/fraud-consumer-protection/aarp-fraud-watch-network-helpline-victim-support/ (sweep; charity's own figures). Evidence of emotional support, not of loss reduction; no evaluation of AARP workshops found.
• Library and digital-skills classes: Seaton et al. (JMIR Aging 2023; 270 adults 50+ at baseline, 145 at follow-up, pre-post): device proficiency rose, confidence in avoiding scams "unchanged"; Ferguson et al. (Aging & Mental Health 2024; 20 low-income older adults): no significant change (sweep; research). OATS/Senior Planet evaluation pages carry no scam outcomes. weak.
• Congregations: no programme evaluation found. The SEC's affinity-fraud alert (8 Oct 2013) warns that fraudsters "often enlist respected community or religious leaders from within the group", with cases of $4m, "almost $6 million from nearly 80 evangelical Christian investors" and $135m; FINRA 2015: 5% of victims met the fraud "Through a social setting such as a place of worship or school", 18% "Through a friend or family member". https://www.sec.gov/investor/pubs/affinity.htm (sweep; primary). none-but-plausible for prevention; the group is also an attack surface.
• Neighbourhood groups: nothing found.
• Reference points fetched by me: the FTC's Pass It On is built on peer sharing and cites no evaluation (primary); the DOJ National Elder Fraud Hotline assigns a case manager and reports that scammers now impersonate its staff (primary, https://ovc.ojp.gov/program/stop-elder-fraud/providing-help-restoring-hope, fetched 2026-11-05); the AARP helpline (877-908-3360, Mon–Fri 8–8 ET) offers "guidance and support for your situation, not investigation or case recovery" (https://www.aarp.org/money/scams-fraud/helpline/, fetched 2026-11-05).

Which group formats have evidence of working, in order: (1) repeated forewarning to people already known to be targets (RCT, behavioural outcome); (2) a one-off simulated exposure with a debrief in a workplace, plus warnings and a report button (field experiments); (3) training the people who sit between the victim and the money, bank staff (non-randomised, self-reported dollars); (4) making sure there is someone to talk to when the pitch arrives (correlational, consistent across two independent datasets). Formats with reach but no outcome evidence: Senior Medicare Patrol workshops, Friends Against Scams, peer champions, helplines, library classes, response networks. Formats with no evidence and a documented risk: congregation-based programmes (affinity fraud), and family routines that take over rather than back up.

---

D. Every organisation and vendor the pages link to or name

Operating = HTTP 200 today plus page content, unless stated. "24 months" = Nov 2024–Nov 2026.

---

E. Where the sources disagree (contest kept)

• How much 2FA helps: Google 2022 "50% decrease" (auto-enrolled consumers; no method) vs Microsoft 2023 "99.22%" (commercial accounts under suspicious-activity review; benchmark-multiplier) vs Google 2019 per-attack-type rates (76–100%). Different populations, different denominators. Use the per-attack-type rates on the page; cite the other two as vendor claims.
• Whether phishing training works: Lain 2022 and Ho 2025 (large field trials: no or negative effect of embedded training) vs the training industry's position (not fetched) vs Lain's own finding that warnings and reporting do work. The site's drill sits closer to "forewarning" than to "embedded training", and the forewarning trials (Scheibe 2014; USPIS RCT; Baillon 2019) do show short-lived effects that transfer across scam types; the two literatures are about different interventions and both are kept.
• Zelle reimbursement: Senate PSI via NBC (38% unauthorised, 12% fraud) vs Early Warning (99.95% of transactions with no complaint). Both can be true; they measure different things.
• UK mandatory reimbursement: PSR 88% of claimed money returned (nine months) vs the July 2026 evaluation's 65% of confirmed losses by value (unread). Keep both with their definitions.
• Is a password manager a risk: LastPass thefts (Krebs/federal complaint) vs LastPass's denial vs NIST/CISA/NCSC endorsement of managers. The page's framing (manager vs reuse) holds.
• SIM-swap losses fell 2023→2025: the FCC rule took effect Jan 2024; the IC3 series is consistent with an effect and proves nothing.

---

F. Sources (all fetched 2026-11-05 unless marked unread)

HTTP-only checks (curl, 2026-11-05): reportfraud.ftc.gov 200; identitytheft.gov 200; ic3.gov 200; senate.gov 200; irs.gov IP PIN 200; ncsc.gov.uk 200; cisecurity.org/ms-isac 200; haveibeenpwned.com 200; cisa.gov 200; experian.com freeze 200 (redirect); equifax.com freeze 200; verizon.com KB 200; att.com article 200; t-mobile.com SIM protection 200 (redirects to account-fraud page); passwords.google.com 200; account.live.com proofs 200 (login); bitwarden.com 200; lastpass.com 200; fightcybercrime.org 200; cybermonitoringcentre.com 200; statescoop.com 200; transunion.com freeze 403; bbb.org/scamtracker 403; idtheftcenter.org 403; monitor.mozilla.org 406 to curl (200 to the fetch tool).

---

G. Could not verify today, and what goes stale first

Could not verify (say so on the page or leave off):

• Any trial of family safe words; any measurement of the call-back rule. (None exist that I could find; the first is probably unfindable, the second may exist in the older-adult literature: see the sweep.)
• Google's passkey adoption and outcome figures (blog URL 404; search exhausted).
• The RAT/FFKC eligibility thresholds (amount and time window).
• CISA's 2025–26 workforce and budget changes; FTC staffing cuts; whether Consumer Sentinel publication continues on schedule; IRS identity-theft case delays; AARP controversies; Cyber Monitoring Centre's funders; BBB Scam Tracker's funding; status of the New York v. Early Warning case; SLCGP status after 1 Sep 2026; whether the Cybersecurity Information Sharing Act was extended past 30 Sep 2026.
• Bitwarden's April 2026 CLI incident (unread summaries only).
• The Senate PSI report's own text (403); figures are from NBC Connecticut.
• T-Mobile's current tap path (site redirects; content not read).
• From the older-adult sweep, could not open: the NIJ final report of the USPIS mail RCT (NCJ 308661, 404), so per-arm N and whether 8.6%/22.4% are relative or absolute are unknown; Scheibe 2014's per-condition percentages (figure image only); the CyberGuardians full paper (403 on three hosts); Friends Against Scams and RAND RR1510 (403); Cross 2015 and Button et al. (paywalled); Tribune Publishing 2020 and West Midlands Trains 2021 phishing-test coverage (hosts blocked); NCSC's blog "The trouble with phishing" (removed); FINRA Rule 4512/2165 usage counts (none published in the notices fetched); AARP's victim-impact study; Cyber-Seniors; any congregation-programme evaluation; the CFPB 2016 networks report.
• The brief's lead "Burnes et al. 2017 prevention systematic review" does not exist; the 2017 AJPH paper is a prevalence meta-analysis.

Staleness, fastest first:

• Vendor menu paths (already flagged in the research file).
• Microsoft SMS phase-out and Google's SMS→QR rollout: both undated.
• Legal statuses: Trump v. Slaughter merits; NY v. Early Warning; CISA 2015 Act after 30 Sep 2026; SLCGP.
• IC3 2026 report (expected Apr 2027); PSR data (quarterly); DBIR 2027 (May 2027).
• Bitwarden audit list (annual) and any incident disclosures.

Corrections, 2026-11-06

From the re-verification of 6 November (source/verify/cybercrime-do-2026-11-06.md): new-account fraud is about 7% of identity-theft victims (BJS appendix table 1: 1,605,650 of 23,928,600); 3.2% is 'opened new account only'. The 51% in Exposed to Scams is about an organisation, company or agency intervening (bank tellers, wire-service staff), not a relative or friend. The call-back rule is not 'the only' action touching where money goes; email two-step also blocks a route into business-email fraud. Both FINRA Foundation reports are industry research (an issue brief and a consultancy report; no journal version found), not charity's own figures.

No tracking on any link.Ticks stay on this device.What changedContested