Let’s do this.

Records · Verification table

Cybercrime pages: additions since the 5 Nov fresh read, verified 2026-11-06

The working record behind the pages, published as written. Source file source/verify/cybercrime-2026-11-06-additions.md. All records.

Scope. Every claim in a line added or changed in content/cybercrime.html, content/cybercrime-learn.html and content/cybercrime-practice.html between ee6f7b8 and HEAD (244a844), read from git diff ee6f7b8 HEAD -- …, that has no row in source/verify/cybercrime-2026-11-05.md. Lines whose claims already have a 5 Nov row are re-checked in §4 and not counted. The Do page is out of scope (another pass). The "With others" citations (Scheibe, Baillon, Reinheimer, Lain, the Postal Inspection Service mailing trial, FINRA 2015, the SEC page) were treated as unverified until each paper's own page was read.

Method. WebFetch first. PDFs were read from the saved file with pdftotext. Because WebFetch shortens quotes, raw copies were also taken with curl (browser user agent) and converted to text locally; every quote below is from that text unless marked "WebFetch". WebFetch reads began about 09:15 EST on 2026-11-06; the curl copies are stamped 09:27–09:32 EST; this table was started at 09:38 EST (from the clock). Nothing comes from memory or a search snippet; no web search was used.

Verdicts. CONFIRMED · CORRECTED (page reworded; fix given) · NOT IN SOURCE · NEWER DATA · UNREACHABLE (DNS/proxy/timeout) · BLOCKED (403/405/bot wall) · UNFETCHABLE (host says gone). Grades are the site's (primary, research, industry research, our arithmetic…); "—" means an internal check.

Fetch log (one line per URL):

---

1. Overview — content/cybercrime.html

#ClaimPageSource URLFetchExact quoteVerdictGradeFix applied
O7"Where this started: Averting the unspoken threat of cybercrime, an essay from 2025."Overview, last linehttps://medium.com/feed/@isaac.holze200Item title "Averting the Unspoken Threat of Cybercrime"; pubDate "Mon, 19 May 2025 14:42:43 GMT"; atom:updated "2026-03-01T13:59:32.703Z".CONFIRMED (first published 2025; Medium shows a later update on 1 March 2026, and the text covers events through October 2025)primarynone
O8"These pages are built from the sources, not the essay"Overview, last lineCLAUDE.mdlocal"his five Medium essays set the topics; the pages are built from the evidence, not from the essays"CONFIRMED (internal)—none
O9"its page lists what has changed since it was written"Overview, last linesite/cybercrime/essay/index.html, built from source/corrections.jsonlocal"Since this was written. The essay is as published. These figures have changed or were off; the Learn and Do pages use the corrected ones." Then the three cybercrime entries.CONFIRMED (internal)—none

---

2. Learn — content/cybercrime-learn.html

#ClaimPageSource URLFetchExact quoteVerdictGradeFix applied
L33"approaching $1 trillion globally"Learn, Where the sources disagreehttps://www.csis.org/analysis/hidden-costs-cybercrime200"As the global losses from cybercrime approach $1 trillion, this report focuses on the costs of cybercrime that organizations may be less aware of, such as opportunity costs, downtime and damaged staff morale." Report: "Using the model developed for earlier reports, we estimate the monetary cost of cybercrime at around $945 billion, or just over 1% of global gross domestic product (GDP)."CONFIRMEDindustry researchnone
L34"(a 2020 industry survey of 1,500 organisations)", given as what the trillion-level figure isLearn, contestCSIS page; McAfee report (archive copy, see log)200; mcafee.com 403, archive 200Methodology: "McAfee commissioned independent technology market research specialist Vanson Bourne to undertake the research that this report is based on." "Between April and June 2020, the quantitative study was carried out, interviewing 1,500 IT and line of business decision makers." "Additionally, CSIS utilized a survey of open source material on losses accompanied by interviews with Government officials, and an estimate adjusted by national income levels using International Monetary Fund (IMF) income data to determine the cost of cybercrime." CSIS page: "This report is made possible by support from McAfee Corp."CORRECTED: the figure comes from CSIS's model of published loss data, not from the 1,500-person surveyindustry research→ "(a 2020 industry-funded estimate)"
L35s3 "CSIS and McAfee"Learn, source 3CSIS page200"The Center for Strategic and International Studies (CSIS), in partnership with McAfee, presents The Hidden Costs of Cybercrime". Authors: "James Andrew Lewis", "Zhanna L. Shank", "Eugenia Lostri".CONFIRMEDindustry researchnone
L36s3 title "The Hidden Costs of Cybercrime" and its linkLearn, source 3CSIS page200Page title and "presents The Hidden Costs of Cybercrime".CONFIRMEDindustry researchnone
L37s3 "9 December 2020"Learn, source 3CSIS page200"Published December 9, 2020". (The McAfee PDF's file date is 4 December 2020.)CONFIRMED—none
L38s3 "1,500 organisations surveyed"Learn, source 3CSIS page; report (archive)200 / 200CSIS: "After surveying 1,500 decisionmakers in government and businesses". Report: "In researching this report, we surveyed 1,500 companies." Methodology: "Respondents’ organizations have 1,000 or more employees".CONFIRMED as a count. Removed with L34, because next to the trillion figure it read as that figure's basisindustry researchremoved
L39s3 quoted words “approaching $1 trillion”Learn, source 3CSIS page200"As the global losses from cybercrime approach $1 trillion"CORRECTED (words in quotation marks must be the source's)industry research→ global losses “approach $1 trillion”
L40s3 grade "industry research"Learn, source 3CSIS page; report (archive)200 / 200"This report is made possible by support from McAfee Corp."; "McAfee commissioned independent technology market research specialist Vanson Bourne".CONFIRMED (a company-funded study; the site uses the label the same way for Anthropic's trial and UBS's report)industry researchnone

---

3. Practice — content/cybercrime-practice.html

#ClaimPageSource URLFetchExact quoteVerdictGradeFix applied
P11Drill 2: "Over-60s lost $7.7 billion in 2025, almost all of it to fraud rather than hacking."Practice, drill 2https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf200"Crime Types Reported by 60+, continued", "Complainants 60+ Losses": "Investment $3,519,296,354"; "Tech/Customer Support $1,040,730,043"; "Confidence/Romance $584,032,745"; "Business Email Compromise $568,048,472"; "Government Impersonation $413,206,251"; "Personal Data Breach $324,470,413"; "Data Breach $48,555,751"; "SIM Swap $6,741,791"; "Ransomware $5,644,789"; "Malware $3,433,325"; "Botnet $945,812".CONFIRMED. Our arithmetic: the six intrusion-type rows total $389,791,881, 5.0% of $7.748 billion (5.2% of the $7,471,450,622 the rows add up to).primary; our arithmeticnone
P13Drill 2: "voice-clone 'distress' calls like this one took over $5 million", inside a passage about over-60sPractice, drill 2IC3 PDF, printed p. 40200"This type of scam also includes grandparent scams, or “distress” scams, in which voice cloning technology is used to mimic the sound of a loved one in distress. Victims claimed losses over $5 million in 2025 to distress scams." No age breakdown is given.CORRECTED (scope: all victims, not only over-60s)primary→ "…took over $5 million from victims of all ages."
P14"One reminder on the first of each month that opens this page. It holds no dates or figures, so it never goes out of date."Practice, after the rhythmtools/app.js (identical to site/app.js), lines 187–201local'DTSTART:' + y + pad(m) + '01T100000'; 'RRULE:FREQ=MONTHLY'; `var url = location.origin + (el.dataset.url \\location.pathname) with data-url="/cybercrime/practice/"; 'SUMMARY:' + icsText(title) with data-title="Let's do this: cybercrime"; 'DESCRIPTION:' + icsText('Open ' + url + ' and do what is due this month.')`CONFIRMED (internal; the file's DTSTART and DTSTAMP are its schedule, not its text)—none
P15"Warnings fade in one to six months." (cited to s4 only)Practice, With others 1https://pmc.ncbi.nlm.nih.gov/articles/PMC4199235 ; https://pmc.ncbi.nlm.nih.gov/articles/PMC11689558/200 / 200Scheibe: "for participants who had received the same scam warning, forewarning was only effective at the 2-week delay, but not at the 4-week delay. In contrast, forewarning was effective for both delays in the different scam condition." DeLiema: effect measured "over 4 months"; no fading reported. The six-month end is Reinheimer (s5), not s4.NOT IN SOURCE (as cited)research→ "Warnings can fade. In one trial, a phone warning about the exact scam had worn off by four weeks;"
P16"In the one randomised trial with a measured outcome"Practice, With others 1PMC11689558; PMC4199235200 / 200DeLiema: "We conducted a randomized control trial to evaluate the efficacy of a mailed intervention"; "This represents the first test of a simple, scalable, mailed intervention to reduce the incidence and cost of mass marketing fraud among older Americans." Scheibe, same footnote: "Participants were randomly assigned to one of five experimental groups".NOT IN SOURCE (the page's own s4 and s5 hold other randomised trials with measured outcomes)research→ "In another, …"
P17"five mailed warnings cut repeat victimisation by 22.4%, one letter by 8.6%"Practice, With others 1PMC11689558; NAPSA brief200 / 200"Treatment groups received either (1) a single letter from the US Postal Inspection Service (USPIS) … or (2) the same letter along with five additional “Fraud Fighter” awareness materials mailed two weeks apart." "Compared to the control (no intervention), the single letter condition reduced the rate of revictimization by 8.6% and the multiple mailing condition reduced the rate of revictimization by 22.4% over 4 months." Brief: "households that received the "Be a Fraud Fighter" counter-marketing materials experienced a 22% reduction in their risk of revictimization."CORRECTED (the 22.4% group got the letter plus five mailings; both figures confirmed)research→ "a letter plus five more mailings to older fraud victims cut repeat victimisation by 22.4% over four months; the letter alone cut it by 8.6%."
P18"a warning about one scam even reduced falling for a different one", placed inside the mailing-trial sentencePractice, With others 1PMC4199235200"Both warnings reduced unequivocal acceptance of the mock scam"; "the potential victim was simply asked to accept a package with information and an invoice for the fee"; "The proportion of respondents who would have actually authorized the relevant payment cannot be ascertained."CORRECTED (it is Scheibe's phone trial, not the mailing trial; the outcome was accepting a pitch, not losing money)research→ "a warning about a different scam still made people less likely to accept the pitch."
P19"A simulated phish with a debrief cut password disclosure from 22% to 14%"Practice, With others 2https://journals.plos.org/plosone/article?id=10.1371/journal.pone.0224216200"The second treatment group ( Exp ) was sent a phishing email at time T = 1 and a short debriefing email explaining that the sent email was fake at the end of the same day." "The unconditional frequency of subjects filling in their password, as measured by Fill , was 22% in Control , and dropped to 16%, 14%, and 13% in Info , Exp , and ExpInfo respectively."CONFIRMEDresearchnone
P20"six weeks later"Practice, With others 2PLOS page200"All subjects of the four groups received a (second) phishing email forty days after the subjects in treatments Exp and ExpInfo had received a phishing email"CORRECTEDresearch→ "on a test phish 40 days later"
P21"across a 10,929-person ministry"Practice, With others 2PLOS page200"The subjects of this experiment were 10,929 employees of the Dutch Ministry of Economic Affairs, out of the 12,567 official employees of the Ministry."CORRECTEDresearch→ "Among 10,929 staff of a Dutch ministry"
P22"In a 15-month study of a large company"Practice, With others 2https://arxiv.org/abs/2112.07498200"Our experiment ran for 15 months during which time more than 14,000 study participants (employees of the company) received different simulated phishing emails in their normal working context."CONFIRMEDresearchnone
P23"routine training after a failed test did nothing"Practice, With others 2arXiv abstract and PDF200 / 200Abstract: "embedded training during simulated phishing exercises, as commonly deployed in the industry today, does not make employees more resilient to phishing, but instead it can have unexpected side effects that can make employees even more susceptible to phishing." PDF: "voluntary contextual training does not improve future phishing detection. Surprisingly, we observe that both click and dangerous actions rates are higher for participants that received contextual training"; "participants that clicked on two or more phishing emails were 647 without training, and 801 with training."CORRECTED ("did nothing" understates it)research→ "training shown after a failed test didn't help, and staff who got it clicked more."
P24"a warning plus a report button is what cut dangerous clicks"Practice, With others 2arXiv abstract and PDF200 / 200PDF: "both types of warnings greatly helped participants both in avoiding clicking on links in our simulated phishing emails and not falling for the phish by performing the dangerous action. Considering click rate, the group with no warnings clicked 3,964 times, compared to the lower 1,427 clicks for short and 1,289 clicks for long warnings". Abstract, on the button: "We also deployed a reporting button to the company's email client which allowed the participants to report suspicious emails they received"; "such crowd-sourcing allows fast detection of new phishing campaigns".NOT IN SOURCE for the button (the warnings' effect is confirmed)research→ "Warnings on suspicious emails cut clicks; a report button let staff flag new phishing fast."
P25"Most fraud victims never report, many from embarrassment."Practice, With others 3https://finrafoundation.org/sites/finrafoundation/files/non-traditional-costs-financial-fraud_0_0.pdf200"While over two-thirds of respondents (68 percent) told friends or family members about the incident, far fewer (35 percent) reported the incident to the authorities." Reasons, among those who did not report: "Wouldn't have made a difference 48%"; "Wanted to put it behind me 35%"; "Was embarrassed 29%"; "Didn't know where to turn 26%". Method: "a nationally distributed online survey of 600 self-reported fraud victims"; "The survey was conducted in August 2014"; scope: "financial and investment fraud in which the victim played an active role".CONFIRMED for the group surveyed (65% did not tell the authorities; embarrassment was the third reason given)researchnone
P26"Careful with church and club programmes. Affinity fraud spreads through trusted groups"Practice, With others 4https://www.sec.gov/investor/pubs/affinity.htmWebFetch 200; curl 403(WebFetch) "Affinity fraud refers to investment scams that prey upon members of identifiable groups, such as religious or ethnic communities, the elderly, or professional groups." "They often enlist respected community or religious leaders from within the group to spread the word about the scheme by convincing those people that a fraudulent investment is legitimate and worthwhile." "These scams exploit the trust and friendship that exist in groups of people who have something in common."CONFIRMED. "So a programme should say so rather than lean on trust" is the page's advice, not a source claim.primarynone
P27s4 "DeLiema, Brannock, Preble and Langton"Practice, source 4PMC11689558200"Marguerite DeLiema", "M Daniel Brannock", "Edward Preble", "Lynn Langton" (University of Minnesota; RTI International).CONFIRMEDresearchnone
P28s4 "the US Postal Inspection Service mailing trial"Practice, source 4PMC11689558200"a single letter from the US Postal Inspection Service (USPIS)"; "USPIS collected return addresses from detained victim mail for 4 months following the initial intervention mailing."CONFIRMEDresearchnone
P29s4 "Innovation in Aging, 2024 (abstract …)"Practice, source 4PMC11689558200"Innov Aging . 2024 Dec 31;8(Suppl 1):114. doi: 10.1093/geroni/igae098.0367"; title "A FRAUD AWARENESS MAIL CAMPAIGN SIGNIFICANTLY REDUCES RATES OF REVICTIMIZATION AMONG OLDER VICTIMS".CONFIRMEDresearchnone
P30s4 "summarised in a NAPSA brief" and its linkPractice, source 4https://napsa-now.org/wp-content/uploads/2025/02/R2P-Webinar-brief_Langton-and-DeLiema.pdf200"National Adult Protective Services Association (NAPSA)"; "Research to Practice Series"; "The effectiveness of a Fraud Fighter counter-messaging campaign to reduce repeat mail fraud victimization"; "Lynn Langton, RTI International; Marti DeLiema, University of Minnesota"; "a 22% reduction in their risk of revictimization".CONFIRMED (the brief gives only the 22% figure; 8.6% is in the abstract)researchnone
P31s4 grade "research, unread"Practice, source 4PMC11689558; NAPSA brief200 / 200Both read in full today (quotes above).CORRECTED (relabelled; "unread" was no longer true)research→ "research"
P32s4 "Scheibe et al., Forewarning reduces fraud susceptibility in vulnerable consumers, Basic and Applied Social Psychology, 2014" and its linkPractice, source 4https://pmc.ncbi.nlm.nih.gov/articles/PMC4199235200"Published in final edited form as: Basic Appl Soc Psych. 2014 May 19;36(3):272–279. doi: 10.1080/01973533.2014.903844". Authors (WebFetch): "Susanne Scheibe, Nanna Notthoff, Josephine Menkin, Lee Ross, Doug Shadel, Martha Deevy, Laura L Carstensen".CONFIRMEDresearchnone
P33s4 "(895 people)"Practice, source 4PMC4199235200"Participants ( N = 895) were drawn from US Postal Inspection Service lists of previous victims of mail fraud"; "Of the 895 eligible participants whom AARP volunteers had called initially, the telemarketer reached 511 (57.1%)".CONFIRMED (895 assigned; outcomes measured on the 511 reached)researchnone
P34s5 "Baillon et al., Informing, simulating experience, or both, PLOS ONE, 2019 (10,929 employees)"Practice, source 5PLOS page; Europe PMC API200 / 200"Citation: Baillon A, de Bruin J, Emirmahmutoglu A, van de Veer E, van Dijk B (2019) Informing, simulating experience, or both: A field experiment on phishing risks. PLoS ONE 14(12): e0224216"; "Published: December 18, 2019"; "10,929 employees". API record: PMC6919577, doi 10.1371/journal.pone.0224216.CONFIRMED (title shortened at the colon)researchnone
P35s5 link https://europepmc.org/article/PMC/PMC6919577Practice, source 5that URLWebFetch 403; curl 403, body "Just a moment..."—BLOCKED (bot challenge; the same article was read at PLOS and through Europe PMC's API)researchnone (proposal 5)
P36s5 "Reinheimer et al., An investigation of phishing awareness and education over time, SOUPS 2020 (effects gone by six months)" and its linkPractice, source 5https://www.usenix.org/conference/soups2020/presentation/reinheimer200 (page and PDF)Title "An investigation of phishing awareness and education over time: When and how to best remind users"; "booktitle = {Sixteenth Symposium on Usable Privacy and Security (SOUPS 2020)}"; "With overall 409 employees, we evaluated"; "We find a significantly improved performance of correctly identifying phishing and legitimate emails directly after and four months after the programme’s deployment. This was not the case anymore after six months, indicating that reminding users after half a year is recommended."CONFIRMED (title shortened at the colon)researchnone
P37s5 "Lain, Kostiainen and Čapkun, Phishing in organizations, 2022" and its linkPractice, source 5https://arxiv.org/abs/2112.07498200"Phishing in Organizations: Findings from a Large-Scale and Long-Term Study"; "Daniele Lain, Kari Kostiainen, Srdjan Capkun"; "[Submitted on 14 Dec 2021]"; "Comments: To appear in IEEE S&P 2022".CONFIRMED (2022 is the IEEE S&P year; the linked arXiv copy is dated 14 Dec 2021)researchnone
P38s6 "FINRA Investor Education Foundation, Non-traditional costs of financial fraud, 2015 (35% reported; 29% “was embarrassed”)" and its linkPractice, source 6FINRA PDF200"The Non-Traditional Costs of Financial Fraud"; "PREPARED FOR FINRA INVESTOR EDUCATION FOUNDATION BY APPLIED RESEARCH & CONSULTING LLC MARCH 2015"; "far fewer (35 percent) reported the incident to the authorities"; "Was embarrassed 29%" (base: those who did not report).CONFIRMED (the 29% is of non-reporters)researchnone
P39s6 FINRA grade "research"Practice, source 6FINRA PDF; content/about.html200; localHeader: "Research Report". Method: "Sample for the survey was provided by SSI (Survey Sampling International)." About page: "research is peer-reviewed work".CONFIRMED as the site uses the label (the Do page grades this report and "Exposed to Scams" the same way). It is not peer-reviewed, which strains the About definition: proposal 1.researchnone
P40s6 "SEC, Affinity fraud, read 5 Nov 2026", its link and gradePractice, source 6https://www.sec.gov/investor/pubs/affinity.htmWebFetch 200; curl 403(WebFetch) H1 "Affinity Fraud: How to Avoid Investment Scams That Target Group" [as rendered]; "Oct. 8, 2013"; "Last Reviewed or Updated: Oct. 9, 2013".CONFIRMED (re-read 6 Nov 2026; the 5 Nov read is recorded in source/impact/cybercrime-2026-11-05.md)primarynone

---

4. Changed lines already covered by a 5 Nov row (re-checked, not counted)

---

5. Summary by verdict

Counted rows: 3 (Overview) + 8 (Learn) + 29 (Practice) = 40.

VerdictCountRows
CONFIRMED27O7–O9, L33, L35–L38, L40, P11, P14, P19, P22, P25–P30, P32–P34, P36–P40
CORRECTED9L34, L39, P13, P17, P18, P20, P21, P23, P31
NOT IN SOURCE3P15, P16, P24
BLOCKED1P35 (Europe PMC link; paper read at PLOS)
NEWER DATA, UNREACHABLE, UNFETCHABLE0—

Weakest links after the fixes: the SEC wording (read only through WebFetch, since sec.gov refuses curl); the McAfee report's method (read from a Wayback Machine copy, because mcafee.com refuses automated reads); the mailing trial (a conference abstract, and its NIJ final report still returns 404, so per-group numbers are unread; the brief's "reduction in their risk" suggests the percentages are relative); FINRA 2015 (an online panel of 600 self-reported victims, not peer-reviewed).

What would overturn these: a full paper or the NIJ report showing different per-group results for the mailing trial; a CSIS or McAfee correction to the $945 billion model; an IC3 erratum to the over-60 table. All readings are as of 6 Nov 2026. The IC3 figures go stale with the 2026 report (expected around April 2027; source/stale.tsv).

---

6. Proposals (outside this pass's files, or left unchanged on purpose)

  1. FINRA grade, Practice s6 and Do s26/s28: the About page says "research is peer-reviewed work". FINRA's 2015 report and "Exposed to Scams" are commissioned survey reports. Either relabel both pages together (primary, with "online survey of 600 self-reported victims, not peer-reviewed"), or widen the About definition. Left as research here so the two pages stay consistent.
  2. Do s23 (Lain): "warnings cut dangerous actions by about two-thirds" is our arithmetic on group totals (2,994 vs 998 and 893). It holds only if the warning groups were similar in size; label it "our arithmetic" or check the group sizes in the paper.
  3. Learn s7 (StateScoop, 1 Sep 2026) is now cited nowhere on the Learn page. Remove it, or cite it again if the grant sentence returns.
  4. Learn contest, "the biggest numbers rest on surveys where a few unverified answers dominate the total" (5 Nov row L24): the trillion-level figure is now described as a model and the $10.5 trillion as a projection. The sentence still holds for their inputs; consider "rest on surveys and models".
  5. Practice s5 (Baillon): point the link at https://doi.org/10.1371/journal.pone.0224216 (doi.org is already an allowed host). Europe PMC's article page serves a bot challenge, so the weekly link check cannot confirm it.
  6. Practice s4: the 8.6% figure appears only in the abstract (https://pmc.ncbi.nlm.nih.gov/articles/PMC11689558/), which the page names but does not link. Linking it needs a decision (no new links in this pass; the host is already used on the page).
  7. Practice, "With others" 1: the six-month fade (Reinheimer) now appears only in source 5's note. If the item should say it, add a source-5 marker to that item.
  8. checked: on the Learn and Practice pages still reads 5 Nov 2026. The additions were checked 6 Nov 2026.
  9. Visual, seen at 390 px: the Copy button covers the end of the first line of the "Say it in thirty seconds" prompt ("…that hits a house[Copy]"). This predates this pass (tools/app.js / site/style.css).
  10. The essay feed shows the Medium post updated on 1 March 2026. The essay page says "The essay is as published"; the box could note that update.
Contest a fact, suggest something, or tell us what’s broken

If someone is in danger right now, don’t use this form. Call your local emergency number (911 in the US). For trafficking: 1-888-373-7888, or text 233733.

What is it?

No name, no account. Your note goes into the site’s private records, nothing about your browser or connection is stored with it, and the email box is the only way we’d know who you are. The weekly review reads every note, re-reads the original source, and fixes the page if it should. A contested fact and its outcome are listed on Contested, in the review’s words, never yours.

No tracking on any link.Ticks stay on this device.What changedContested