Records · Verification table
Cybercrime Do page: source verification of the 6 November additions, 2026-11-06
The working record behind the pages, published as written. Source file source/verify/cybercrime-do-2026-11-06.md. All records.
Scope. Every claim in a line of content/cybercrime-do.html added or changed since ee6f7b8 (git diff ee6f7b8 HEAD) that has no row in source/verify/cybercrime-2026-11-05.md. That covers the evidence-review additions of 6 November (source/impact/cybercrime-2026-11-05.md): the Google 2019 figures, NIST SP 800-63B-4, Lain et al., the BJS shares, the TransUnion breach, Krebs on Experian, FINRA "Exposed to Scams", FINRA 2015, the DOJ elder fraud hotline, Regulation E, 7726, the $13.8 billion sum and the RAT's 3,900 cases. It also covers the help-now box and the languages line, checked against the quotes in source/impact/needs-2026-11-06.md. Lines already covered by a 5 November row are listed under "Covered", not re-counted.
Decision this feeds. Whether each new sentence stays, changes or goes. Who decides: the coordinator, then Isaac, from this table; the page edits below are already made, and nothing is committed.
Method. Every original was read on 2026-11-06 between 09:34 and 09:54 EST. HTML pages were fetched with curl (browser user agent) and converted to text; PDFs were saved and read with pdftotext. Quotes marked † come from WebFetch because curl was refused (consumer.ftc.gov answers curl with a script-only 404, monitor.mozilla.org with 406, finra.org and gao.gov with 403). WebFetch's copy is a tool's rendering, not checked byte for byte; where a † quote decides a verdict, two passes were run and agreed. Nothing below is from memory. Working copies: [local working file] (not kept in the repo).
Verdicts. CONFIRMED = the source's words support the page as written now. CORRECTED = the source says something different; the page was changed (old → new below). NOT IN SOURCE = the cited source does not say it; the page was changed unless the row says "kept". NEWER DATA, UNREACHABLE, BLOCKED, UNFETCHABLE: none today (every source refused to curl was read through WebFetch).
Grades (the About page's scale): primary · research (peer-reviewed) · industry research · news · our arithmetic.
Fetch log (6 Nov 2026)
| Source | How | Result |
|---|---|---|
| FBI IC3, 2025 Internet Crime Report PDF | curl, pdftotext | 200; 66 pp.; file created 2026-04-16 |
| Google Online Security Blog, 17 May 2019, and its infographic PNG | curl; image viewed | 200 |
| NIST SP 800-63B-4: CSRC record; pages.nist.gov text | curl | 200 both |
| Lain, Kostiainen, Čapkun: arXiv 2112.07498 record and PDF | curl, pdftotext | 200 both |
| BJS, Victims of Identity Theft, 2021: record page and vit21.pdf | curl, pdftotext | 200 both |
| TechCrunch, 28 Aug 2025 (TransUnion) | curl | 200 |
| Krebs on Security, 11 Nov 2023 (Experian) | curl | 200 |
| FINRA Foundation, Exposed to Scams PDF (the cited URL serves the PDF) | WebFetch saved the PDF; pdftotext | 200; 24 pp.; PDF title "Exposed To Scams: What Separates Victims From Non-Victims?" |
| FINRA Foundation, Non-Traditional Costs of Financial Fraud PDF | curl, pdftotext | 200; 38 pp. |
| DOJ OVC: providing-help-restoring-hope, about-hotline, faqs | curl | 200 all three |
| CFPB: Reg E §1005.6, §1005.2, §1005.3; EFT FAQs | curl | 200 all |
| FTC: What to do if you were scammed; How to recognize and avoid phishing scams; credit freezes article | curl 404 (script-only); WebFetch † | read |
| monitor.mozilla.org | curl 406 (twice, full browser headers); WebFetch † | read |
| Verizon KB 309293; AT&T 000102016 | curl | 200 both |
| Federal Register 2023-26338 (FCC SIM-swap rule; not cited on the page) | curl (API + full text) | 200 |
| FINRA Rule 4512; Regulatory Notice 22-05 (not cited on the page) | curl 403; WebFetch † | read |
| GAO-17-254 (not cited on the page; the review's source for the freeze) | curl 403; WebFetch † | read |
| Troy Hunt, 25 Mar 2025 (not cited; the review's source for the autofill line) | curl | 200 |
| complaint.ic3.gov (control for the needs file's reading) | curl | 200; <html lang="en">, no language option in the served markup |
| Web search, two queries, for refereed-journal versions of the two FINRA Foundation reports | WebSearch (summaries only) | none found |
A. The help-now box (checked against needs-2026-11-06.md, then the originals)
| # | Page text (before) | Source | Source words | Verdict | Grade |
|---|---|---|---|---|---|
| A1 | "stop replying, and don't pay" | needs A4.1; FTC "What to do if you were scammed" (June 2026) | Not among the needs file's quotes. WebFetch †, asked for any sentence about stopping, replying, responding or not paying: "NONE FOUND". | NOT IN SOURCE. Kept: an instruction, not a fact, and nothing read contradicts it; flagged so a later pass can source or reword it. | — |
| A2 | "If you already paid, call the company you paid through, your bank, card, gift-card company or payment app, at once and ask it to reverse the payment." | needs A4.1; FTC † | "Report it to the credit card issuer immediately." "Contact the gift card issuer immediately." "Report it to the payment app immediately." "Ask them to reverse the payment and refund your money." "But it's always worth asking the company you used to send the money if there's a way to get it back." | CONFIRMED | primary |
| A3 | "Over 60? The Justice Department's elder fraud hotline" | needs A4.4; OVC providing-help-restoring-hope | "This hotline is a free resource created by the U.S. Department of Justice (DOJ), Office for Victims of Crime for people to report fraud against anyone age 60 or older." About-hotline: "provides services to all adults ages 60 and older". | CORRECTED: "Over 60?" → "60 or older?" (a 60-year-old qualifies) | primary |
| A4 | "833-372-8311" | OVC, curl | "833–FRAUD–11" "or 833–372–8311" | CONFIRMED | primary |
| A5 | "answers weekdays 10am to 6pm Eastern" | OVC main page; OVC FAQ | "Monday–Friday, 10:00 a.m.–6:00 p.m. eastern time". FAQ: "…Monday through Friday, except some holidays." | CONFIRMED | primary |
| A6 | s31: "US Department of Justice, about the elder fraud hotline (hours and languages)", linked to /about-hotline | the three OVC pages, full HTML searched | /about-hotline contains neither "10:00" nor "Español" nor "Other languages". The hours and "English/Español/Other languages available" are on /providing-help-restoring-hope (the hours also on /faqs). | CORRECTED (URL of a source already cited): link → /providing-help-restoring-hope, text "National Elder Fraud Hotline page (hours and languages)" | primary |
B. The three steps
| # | Page text (before) | Source | Source words | Verdict | Grade |
|---|---|---|---|---|---|
| B1 | Step 1: "In Google's data, any second step blocked nearly all automated account takeovers" | Google blog, 17 May 2019; infographic "Account takeover prevention rates, by challenge type" | "an SMS code sent to a recovery phone number helped block 100% of automated bots, 96% of bulk phishing attacks, and 76% of targeted attacks. On-device prompts … helped prevent 100% of automated bots, 99% of bulk phishing attacks and 90% of targeted attacks." Infographic: security key 100/100/100; knowledge-based challenges 73–100% against bots. Google measured its own sign-in challenges, which it says give "a similar level of protection to 2-Step Verification". | CONFIRMED for the device-based steps the page means ("nearly all" understates 100%) | industry research |
| B2 | Step 1: "and not one security-key user was phished" | same | "zero users that exclusively use security keys fell victim to targeted phishing during our investigation"; infographic: security key 100% of bulk phishing and of targeted attacks | CONFIRMED | industry research |
| B3 | Step 1 label strong | impact §A2 | "Grade: strong for 'turn on any second step on your email'" (Google and Microsoft datasets; the page cites Google only) | CONFIRMED | — |
| B4 | Step 2: "It's the only habit that touches where the money goes" | IC3; impact §B, §C1 | No source says "only". The review's own §C1: a taken-over email account "is the launch point for … BEC lures", so step 1 also touches business-email losses. | NOT IN SOURCE. Fixed: "It's the habit that touches where most of the money goes" (66% by our arithmetic, B5) | — |
| B5 | Step 2: "investment, business-email and tech-support scams took $13.8 billion of the $20.9 billion" | IC3 p. 8, "By Complaint Loss" | "Investment $8,648,617,756"; "Business Email Compromise $3,046,598,558"; "Tech/Customer Support $2,134,675,818". Sum $13,829,892,132 = 66.2% of $20.877bn. The 24 crime-type rows sum to $20,071,612,353, under the total, so no sign that categories overlap. | CORRECTED (grade): the figure holds, but it is our sum and was shown under s1's "primary" only. s1 now adds the three figures and our arithmetic. | primary / our arithmetic |
| B6 | Step 2: "Warnings like this cut dangerous clicks by about two-thirds in one trial" | Lain et al., arXiv PDF | Warnings were banners "on top of suspicious emails" (short or detailed). "the group with no warnings clicked 3,964 times, compared to the lower 1,427 clicks for short and 1,289 clicks for long warnings"; "2,994 dangerous actions for no warnings, compared to 998 and 893". Groups "approximately of the same size: from 1,223 participants on the smaller to 1,231 participants on the larger" (12 groups, 4 per warning setting). Our arithmetic: clicks −64% and −67.5%; dangerous actions −66.7% and −70.2%. The paper's own words: "both types of warnings greatly helped participants". | CORRECTED: what was tested is banners on emails, not a rule like this; "dangerous clicks" mixes two measures. Now: "In one trial, warning banners on suspicious emails cut clicks by about two-thirds"; s23 gives the counts and labels "about two-thirds" our arithmetic | research / our arithmetic |
| B7 | Step 2: "nobody has tested the rule itself" | impact §A8, §G | "No trial of the rule itself"; "Any trial of family safe words; any measurement of the call-back rule. (None exist that I could find…)" | CONFIRMED as an absence finding (a fetch can't prove a negative; same handling as 5 Nov row L19) | — |
| B8 | Step 2 label moderate | impact §A8, §B rank 2 | "'Hang up and call back on a number you already have' plus 'urgency, secrecy, irreversible payment' moderate" | CONFIRMED | — |
| B9 | Step 2: "5 minutes · $0" | the page | Step 2's detail is §8, labelled "2 min" (hang up and call back, the safe word, the three tells). §1–§8 add to 60 = "One hour" (5 Nov row D2); the overview's door says "Two minutes". | CORRECTED (our arithmetic): → "2 minutes · $0" | — |
| B10 | Step 3: "Two free switches" (AT&T lock; credit freeze) | AT&T 000102016; FTC/CFPB (rows D15, L21) | AT&T: "A free security feature, Wireless Account Lock is available through the AT&T app". Freeze: free by law (5 Nov). | CONFIRMED | primary |
| B11 | Step 3: "Two free switches" (Verizon's locks) | Verizon KB 309293 | The page states no price ("free", "no cost", "charge" absent; 4,336 characters of text). T-Mobile's page is unread (5 Nov D14). Not cited: the FCC rule of 8 Dec 2023 requires carriers to offer locks "at no cost", but 47 CFR 52.37(d) and 64.2010(h)(4) "are delayed indefinitely"; the later effective-date notice was not read. | NOT IN SOURCE for Verizon. Kept (nothing contradicts it; the site's "$0" rests on the same reading); see proposal 6 | primary (AT&T) |
| B12 | Step 3: "a freeze stops new accounts in your name" | FTC credit-freeze article (August 2025) † | "When a credit freeze is in place, nobody can open a new credit account in your name." | CONFIRMED | primary |
| B13 | Step 3: "SIM swaps were $17 million of the $20.9 billion" | IC3 p. 8 | "SIM Swap $17,366,758" (0.08% of losses) | CONFIRMED | primary |
| B14 | Step 3: "new-account fraud is about 3% of identity theft" | BJS 2021, Table 1 and appendix table 1 | Table 1 (most recent incident): "Opened new account only 759,330 … 3.2%". Appendix table 1 (any incident in the year): "Opened new account 1,605,650", of "Total 23,928,600". 1,605,650 / 23,928,600 = 6.7%. The 3.2% counts only victims with nothing else misused. | CORRECTED: → "about 7% of identity-theft victims had a new account opened in their name" (our arithmetic, labelled in s24) | primary / our arithmetic |
| B15 | Step 3 label moderate: small share of losses | impact §A3, §A4 | SIM lock "moderate … 0.08% of 2025 reported losses"; freeze "moderate … narrow in scope" | CONFIRMED | — |
C. Near you
| # | Page text | Source | Evidence | Verdict | Grade |
|---|---|---|---|---|---|
| C1 | "The code stays in your browser, like the ticks." | tools/app.js; vercel.json | The ZIP is stored with LS.set('ldt:zip', zip); app.js has no fetch(, XMLHttpRequest, sendBeacon or WebSocket; CSP connect-src 'none'. The panel adds: "A link that carries it goes to that organisation only." | CONFIRMED (our test) | — |
D. The detailed list
| # | Page text (before) | Source | Source words | Verdict | Grade |
|---|---|---|---|---|---|
| D1 | §1: "When it refuses to fill a page, the address is wrong: that's a phishing check you get for free." (no citation) | Troy Hunt, 25 Mar 2025 (the review's source, §A1) | "the thing that should have saved my bacon was the credentials not auto-filling from 1Password, so why didn't I stop there? Because that's not unusual. There are so many services where you've registered on one domain … then you legitimately log on to a different domain." | CORRECTED: a refusal doesn't prove the address is wrong. → "When it won't fill a page, stop and check the address: that's a phishing check you get for free." | primary (first-person) |
| D2 | §4: "It stops new accounts, which are about 3% of identity theft" | BJS, as B14 | as B14 | CORRECTED: → "It stops new accounts: in 2021, about 7% of identity-theft victims had one opened in their name." | primary / our arithmetic |
| D3 | §4: "most identity theft is misuse of accounts you already have" | BJS | "For 76% of identity-theft victims in 2021, the most recent incident involved the misuse of only one type of existing account". Appendix table 1: 21,518,450 (89.9%) "Misused at least one existing account". | CONFIRMED | primary |
| D4 | §4: "which a freeze doesn't touch" (cited to s24, BJS) | FTC (Aug 2025) †; GAO-17-254 † | FTC: "nobody can open a new credit account in your name." GAO: a credit freeze "can prevent new-account fraud by restricting access to the consumers' credit report." Neither states the existing-account limit in words, and BJS doesn't discuss freezes. | CONFIRMED by mechanism (a freeze works on the credit report, which existing-account misuse doesn't need) | primary |
| D5 | §4: "Register your own account at each bureau while you're there, so nobody else can" | Krebs, 11 Nov 2023 (s25) | "identity thieves simply re-registered the accounts using a different email address. Sixteen months later, Experian clearly has not addressed this gaping lack of security. I know that because my account at Experian was recently hacked". Experian then "will send a message to the old email address". Equifax and TransUnion "will ask you to enter a code sent to the email address or phone number on file before any changes can be made." | CORRECTED: holding an account didn't stop a takeover at Experian. → "so you hear about any change to it: … and Experian has let strangers re-register over existing accounts" | news |
| D6 | §4: "TransUnion itself was breached in August 2025" | TechCrunch, 28 Aug 2025 (s25) | "TransUnion attributed the July 28 breach to unauthorized access of a third-party application"; disclosed in a Maine filing "on Thursday" (28 Aug). | CORRECTED: → "breached in July 2025" | news |
| D7 | §5: "Mozilla Monitor, which does the same job" | monitor.mozilla.org † | "We scan data breaches to see if your data has been leaked and give you steps to fix it." "We'll continuously monitor and send you alerts for any new breaches". "data breach monitoring protection is always free." No shutdown notice. | CONFIRMED (matches the 5 Nov read in impact §A5) | primary (own description) |
| D8 | §6: "ransomware is rare: 3,611 complaints in all of 2025" | IC3 pp. 7, 14 | "Ransomware 3,611"; "In 2025, the IC3 received more than 3,600 complaints reporting ransomware, with losses exceeding $32 million." | CONFIRMED | primary |
| D9 | §6: "A lost, stolen or dead phone is the common disaster" (cited to s1) | IC3; impact §A6 | IC3 doesn't count device loss; the review: "strong by common sense against device loss and failure (not measured here)". | NOT IN SOURCE. Fixed: → "A lost, stolen or dead phone is only a disaster when there's no second copy."; the citation now sits on the ransomware figure | — |
| D10 | §8 label moderate on hang up, call back | impact §A8 | as B8 | CONFIRMED | — |
| D11 | §8: "The FBI suggests it; nobody has measured it." | FBI PSA (row D30); impact §A8 | PSA "cites no evidence, data, studies, or outcome statistics showing that these tips work"; "No trial or study of safe words was found." | CONFIRMED as an absence finding | primary |
| D12 | §8 label none but plausible on the safe word | impact §A8 | "Grade: safe word none-but-plausible" | CONFIRMED | — |
E. One older relative (§9)
| # | Page text (before) | Source | Source words | Verdict | Grade |
|---|---|---|---|---|---|
| E1 | "about $38,500 each on average" | IC3 p. 44 | "$38,500 Average Loss" ($7.748bn / 201,266 = $38,496) | CONFIRMED | primary |
| E2 | "and the thing that most often stops a loss is someone to talk to at the moment of the pitch" | Exposed to Scams, Sept 2019 | "Respondents were more likely to be victimized if they did not have anyone to discuss the offer with." It also finds "Respondents who had heard about the scam before were significantly less likely to lose money (9 percent versus 34 percent, p<.001)". It ranks nothing as what "most often" stops a loss. | NOT IN SOURCE. Fixed: the clause is removed; the lede now says "Be the person they talk an offer over with, and make it mutual…" (an instruction), and the finding moves to E5 | — |
| E3 | Label moderate: correlational | impact §A10, §C3 | "A person to talk to at the moment of the pitch: correlational and consistent … moderate (correlational)" | CONFIRMED | — |
| E4 | "In a 1,408-person study" | Exposed to Scams | "In this survey of 1,408 Americans and Canadians who were targeted and reported a scam"; "we received 1,408 eligible responses" | CONFIRMED | — |
| E5 | "half of the times a third person stepped in, the loss was averted" | Exposed to Scams, "Intervention By Organizations — The Role Of Structural Protections" | "Among those who engaged with the scam, 20 percent reported that an organization, company, or agency intervened or tried to intervene to stop the scam. People described interventions by bank tellers and employees of wire transfer services … The survey results show that 51 percent of people who reported a third-party intervention were able to avoid losing money." The family finding is: "Among respondents who engaged, those who chose not to discuss the solicitation with anyone while it was happening were significantly more likely to lose money". | CORRECTED (misattributed: the 51% is about banks and shops, not relatives). → "Of 1,408 people who reported a scam, those who engaged and told no one at the time lost money more often." | industry research |
| E6 | "Ask their bank or brokerage to add a trusted contact: someone it may call if a transaction looks wrong." (no citation) | FINRA Rule 4512 .06 †; Regulatory Notice 22-05 † | A firm "is authorized to contact the trusted contact person" and disclose account information "to address possible financial exploitation", or to confirm contact details, health status or a guardian. 22-05: "A trusted contact does not have authority to transact business in an account". | CONFIRMED for brokerages. Banks: not covered by FINRA; no bank source read. | primary |
| E7 | "National Elder Fraud Hotline, 833-372-8311 (US Department of Justice)" | OVC | as A3, A4 | CONFIRMED | primary |
| E8 | "It assigns a case manager" | OVC | "You will be assigned a case manager, who will remain your point of contact." | CONFIRMED | primary |
| E9 | "and warns that scammers impersonate it too" | OVC | "We have received reports of a scam in which scammers are claiming to be from the National Elder Fraud Hotline and threatening to file suits against the phone call recipient." | CONFIRMED | primary |
| E10 | "a third of victims never report" | FINRA 2015, p. 11 | "While over two-thirds of respondents (68 percent) told friends or family members about the incident, far fewer (35 percent) reported the incident to the authorities." | CORRECTED: a third did report; about two-thirds didn't. | industry research |
| E11 | "mostly from embarrassment" | FINRA 2015, p. 12 | "Among those who did not report it, the most common reason mentioned was that it 'wouldn't have made a difference.'" Reasons: "Wouldn't have made a difference 48%"; "Wanted to put it behind me 35%"; "Was embarrassed 29%". Self-blame, p. 4: "Just under half (47 percent) blame themselves for being defrauded". | CORRECTED: embarrassment is the third reason. E10 + E11 → "in one survey of fraud victims, only about a third reported it to the authorities, and nearly half blamed themselves." | industry research |
F. If it already happened
| # | Page text (before) | Source | Source words | Verdict | Grade |
|---|---|---|---|---|---|
| F1 | "For a transfer you didn't authorise, federal rules cap your loss at $50 if you report within two business days" | Reg E §1005.6(b)(1) and comment 6(b)(3)-2 | "If the consumer notifies the financial institution within two business days after learning of the loss or theft of the access device, the consumer's liability shall not exceed the lesser of $50 or the amount of unauthorized transfers". Without an access device: "If the consumer notifies the institution within 60 days of the transmittal of the periodic statement that shows the unauthorized transfer, the consumer has no liability." §1005.3(c)(3) excludes "Any transfer of funds through Fedwire or through a similar wire transfer system". | CORRECTED (minor; $50 holds as an upper bound): → "For an electronic transfer you didn't authorise, federal rules cap your loss at $50 if you report it within two business days of finding out." (the regulation's own scope word; the clock starts when you learn of it) | primary |
| F2 | "a payment you were tricked into sending yourself is outside that rule" | Reg E §1005.2(m), quoted in the CFPB FAQ | "An unauthorized EFT is an EFT from a consumer's account initiated by a person other than the consumer without actual authority to initiate the transfer". FAQ Q5: when a third party tricks you into sharing login details and then moves the money, "the transfer is an unauthorized EFT under Regulation E". | CONFIRMED | primary |
| F3 | "and banks often refuse to refund it" | Reg E; CFPB FAQs (s29) | Neither says anything about how often banks refund. (The review's figures for that, 38% and 12% on Zelle, came from NBC Connecticut on a Senate report, which the page doesn't cite.) | NOT IN SOURCE. Fixed: removed. Now "A payment you were tricked into sending yourself isn't covered by that rule." | — |
| F4 | "across about 3,900 cases out of a million complaints" | IC3 pp. 4, 17 | "3,900 Incidents"; "1,008,597 complaints" (0.39%) | CONFIRMED | primary |
| F5 | "forward it to 7726 (it spells SPAM)" | FTC phishing article (September 2022) † | "If you got a phishing text message, forward it to SPAM (7726)." | CONFIRMED | primary |
| F6 | "so your carrier can block the sender" | same † (two passes) | "'carrier,' 'wireless,' 'provider,' 'block,' and 'phone company' do not appear in the page." The line sits under "How To Report Phishing". | NOT IN SOURCE. Fixed: → "to report it" | — |
| F7 | "then delete it" | same † | "report the message and then delete it" | CONFIRMED | primary |
G. The languages line (checked against needs-2026-11-06.md §B)
| # | Page text | Source | Source words | Verdict | Grade |
|---|---|---|---|---|---|
| G1 | "ReportFraud has a full Spanish site" | needs A4.3 (headless Chrome, 6 Nov) | "ReporteFraude.ftc.gov es el sitio web del gobierno para reportar estafas, fraudes, y malas prácticas comerciales." | CONFIRMED | primary |
| G2 | "the elder fraud hotline answers in English, Spanish and other languages" | needs A4.4; OVC, curl today | "English/Español/Other languages available" | CONFIRMED | primary |
| G3 | "the FBI's IC3 complaint form is in English only" | needs A4.5; complaint.ic3.gov, curl today | needs: "The complaint form is in English with no language option." Today: <html lang="en">; no language selector in the served markup. | CONFIRMED (absence, as the needs file grades it) | primary |
H. Source entries
| # | Entry (before) | Source | Source words | Verdict | Grade |
|---|---|---|---|---|---|
| H1 | s22 Google: title, "May 2019", parenthetical (SMS 100/96/76; security keys all three) | Google blog | Title "New research: How effective is basic account hygiene at preventing hijacking"; "May 17, 2019"; "Posted by Kurt Thomas and Angelika Moscicki"; figures as B1, B2 | CONFIRMED | industry research |
| H2 | s22 Google grade industry research | same | A vendor's study of its own users with NYU and UCSD researchers; the peer-reviewed paper (Doerfler et al., WWW 2019) is not the cited item | CONFIRMED | — |
| H3 | s22 NIST: "SP 800-63B-4, July 2025 (one-time codes are not phishing-resistant)" | CSRC; pages.nist.gov | "Date Published: July 2025"; "07/31/25: SP 800-63B-4 (Final)". "OTP authentication is not phishing-resistant." "Authenticators that involve the manual entry of an authenticator output (e.g., out-of-band and OTP authenticators) SHALL NOT be considered phishing-resistant" | CONFIRMED | primary |
| H4 | s23: "Lain, Kostiainen and Čapkun … 2022" | arXiv record | Authors "Lain, Daniele; Kostiainen, Kari; Capkun, Srdjan"; title "Phishing in Organizations: Findings from a Large-Scale and Long-Term Study"; "To appear in IEEE S&P 2022"; submitted 14 Dec 2021; 14,733 participants | CONFIRMED; venue added | research |
| H5 | s23: "(warnings cut dangerous actions by about two-thirds…)" | Lain PDF | Counts only (B6); "two-thirds" is not the paper's figure | CORRECTED (grade): counts given; "about two-thirds" labelled our arithmetic | our arithmetic |
| H6 | s23: "embedded training after a failed test did not help" | Lain PDF | "both click and dangerous actions rates are higher for participants that received contextual training … for clicks, 3,087 versus 3,593; for dangerous actions, 2,155 versus 2,730." "this particular way of delivering voluntary training does not work. Instead, such training method may cause unexpected and negative side effects, such as increased susceptibility to phishing." | CORRECTED (understated): → "voluntary training after a failed test didn't help, and clicks were higher with it" | research |
| H7 | s23 grade research | arXiv record | IEEE S&P is a refereed venue | CONFIRMED | — |
| H8 | s24: title, publisher | BJS record | "Victims of Identity Theft, 2021"; "Erika Harrell, PhD, BJS Statistician; Alexandra Thompson, BJS Statistician"; "Date Published: October 12, 2023" | CONFIRMED; date added | primary |
| H9 | s24: "(new-account-only fraud 3.2% of victims; existing-account misuse 76%)" | BJS Table 1 | As B14, D3: true as stated, but it left out the any-new-account count the page needed | CONFIRMED; rewritten to carry 1.6 of 23.9 million and the our arithmetic label | primary |
| H10 | s25 TechCrunch: title, "28 August 2025" | TechCrunch | "TransUnion says hackers stole 4.4 million customers' personal information"; "5:04 AM PDT · August 28, 2025" | CONFIRMED | news |
| H11 | s25 Krebs: "on Experian account re-registration, November 2023" | Krebs | Title "It's Still Easy for Anyone to Become You at Experian"; "November 11, 2023" | CONFIRMED | news |
| H12 | s26: "FINRA Investor Education Foundation, BBB Institute and Stanford Center on Longevity … Exposed to Scams: what separates victims from non-victims?, 2019" | Exposed to Scams PDF | Cover "SEPTEMBER 2019"; authors from Stanford Center on Longevity, the FTC (writing for herself), FINRA Foundation, IABBB and BBB Institute; "the FINRA Foundation for funding the research" | CONFIRMED; month added | — |
| H13 | s26: "(1,408 people; 51% of third-party interventions averted the loss)" | same | As E5: the 51% is for interventions by "an organization, company, or agency" | CORRECTED: note now says "when a bank, wire service or other company stepped in, 51% avoided the loss", and gives the discuss-with-no-one finding | industry research |
| H14 | s26 grade research | About page; the PDF; web search | About: "research is peer-reviewed work". The PDF calls itself an "issue brief" published by the foundations; no journal version found. | CORRECTED: → industry research | — |
| H15 | s27: OVC page, "read 5 Nov 2026" | OVC | Re-read today: number, case manager, impersonation warning as E7–E9 | CONFIRMED; read date → 6 Nov 2026 | primary |
| H16 | s28: "FINRA Investor Education Foundation, Non-traditional costs of financial fraud, 2015" | FINRA 2015 PDF | "PREPARED FOR FINRA INVESTOR EDUCATION FOUNDATION BY APPLIED RESEARCH & CONSULTING LLC MARCH 2015"; "an online survey of 600 self-reported fraud victims" | CONFIRMED; month, author firm and sample added | — |
| H17 | s28: "(35% reported; 29% 'was embarrassed'; 47% blamed themselves)" | same | As E10, E11. The 29% is of non-reporters. | CONFIRMED; note now says the 29% and 48% are among those who didn't report | industry research |
| H18 | s28 grade research | same | A commissioned "Research Report" by a consulting firm; no journal version found | CORRECTED: → industry research | — |
| H19 | s29: CFPB Reg E §1005.6 and EFT FAQs, "read 5 Nov 2026" | CFPB | Both 200 today; FAQ entries "Updated December 13, 2021", "June 4, 2021", "January 15, 2025" | CONFIRMED; read date → 6 Nov 2026 | primary |
| H20 | s30: FTC phishing article, "read 5 Nov 2026" | FTC † | Page dated "September 2022" | CONFIRMED; "September 2022, read 6 Nov 2026 through a fetch tool" | primary |
| H21 | s31: FTC "What to do if you were scammed (read through a fetch tool; the site refuses scripts)" | FTC † | Dated "June 2026"; curl gets a script-only 404 today | CONFIRMED | primary |
Covered by a 5 November row (not re-counted)
Password Checkup path (D5); Google 2-Step path (D7); Verizon "Edit profile and settings" (D12a); TransUnion number via the CFPB list (D18); Windows 10 ESU wording (D29b); the FBI safe-word PSA (D30); "Don't trust the voice" (D31); wire, crypto, gift cards (D32); "$679 million of the $1.16 billion" (D33); identitytheft.gov "pre-filled letters" (D34); Entra ID date (D36b); 2SV on the manager itself (D41); the House renewal citation (D47b); "Free credit freezes are here" date (D49); "a thief who takes your number gets them too" (D11); $20.9 billion (D1); over-60s $7.7 billion (L7, D39).
Not counted (no factual claim, or the page's own choice): the meta description's "ranked by evidence" (see proposal 5); "That is most of the protection"; "so do these after the two above"; "Make it mutual, not supervision"; the $500 threshold; "urgency, secrecy" as tells (framing, as on 5 Nov).
Arithmetic
- $8,648,617,756 + $3,046,598,558 + $2,134,675,818 = $13,829,892,132 = 66.2% of $20.877bn. Holds; now labelled.
- 1,605,650 / 23,928,600 = 6.7% → "about 7%". The page's "about 3%" failed.
- Lain: 3,964 → 1,427 (−64.0%), 1,289 (−67.5%); 2,994 → 998 (−66.7%), 893 (−70.2%); groups near-equal. "About two-thirds" holds; now labelled.
- $7.748bn / 201,266 = $38,496 → IC3's "$38,500". Holds.
- 3,900 / 1,008,597 = 0.39%. Holds ("about 3,900 cases out of a million complaints").
- §1–§8: 10 + 15 + 5 + 15 + 3 + 5 + 5 + 2 = 60 = "One hour". Step 2's "5 minutes" against §8's "2 min" failed; now 2. The three steps add to 25 + 2 + 20 = 47 minutes. §9 (10 min) follows the "Done?" box, outside the hour.
Summary by verdict
76 counted rows: A 6, B 15, C 1, D 12, E 11, F 7, G 3, H 21.
| Verdict | Count | Rows |
|---|---|---|
| CONFIRMED | 50 | all others |
| CORRECTED | 19 | A3, A6, B5, B6, B9, B14, D1, D2, D5, D6, E5, E10, E11, F1, H5, H6, H13, H14, H18 |
| NOT IN SOURCE | 7 | A1 (kept), B4, B11 (kept), D9, E2, F3, F6 |
| NEWER DATA | 0 | — |
| UNREACHABLE | 0 | — |
| BLOCKED | 0 | curl refusals at consumer.ftc.gov, monitor.mozilla.org, finra.org and gao.gov were read through WebFetch † |
| UNFETCHABLE | 0 | — |
Weakest links now on the page, by grade: the two FINRA Foundation surveys (industry research; one is 600 self-selected online respondents, the other people who chose to report to BBB); the Google figures (a vendor's study of its own users, 2019); Krebs (news, 2023, on Experian as it was then); and every † quote, which is a fetch tool's copy because the site refuses scripts.
What would overturn the corrections: a BJS table giving new-account fraud as 3% of all victims on the any-incident basis; a passage in Exposed to Scams tying the 51% to friends or family; a FINRA 2015 table where embarrassment leads the reasons; an Experian statement, after November 2023, that existing accounts can no longer be re-registered (that would make D5's second clause stale, not wrong for its date); a TransUnion or TechCrunch correction dating the intrusion to August.
Proposals for other files (not done; outside this page)
source/impact/cybercrime-2026-11-05.md§A4 and §B ("new-account fraud is 3.2% of identity-theft victims"): 3.2% is new-account only, on the most-recent-incident basis. Any new account in the year: 1,605,650 of 23,928,600, 6.7% (BJS appendix table 1). The same slip produced B14 and D2.- Same file §A10, §B rank 4 and §C3 ("51% of third-party interventions averted loss", filed under "a person to talk to"): in the report the 51% is for interventions by "an organization, company, or agency" (bank tellers, wire-service staff). It supports bank-side intervention, not a relative. The relative finding is the "discuss with anyone while it was happening" one.
- Same file: both FINRA Foundation reports are graded "charity's own figures"; neither is an organisation reporting on itself, and neither is peer-reviewed. Suggest
industry research. §B rank 2 says the call-back rule "is the only action that reaches the categories where most money is lost", while §C1 says email 2FA removes a BEC launch point; keep both views or drop "only". content/about.html:industry researchappears on ten grade spans site-wide (09:58 EST, with other agents' edits in the working tree) andtools/audit.pyaccepts it, but the About page doesn't define it. One sentence would do: "industry research is a study by a company or an industry body that hasn't been peer-reviewed."- The meta description's "ranked by evidence": the review's ranked table puts the older relative (rank 4) and fast reporting (rank 5) above the phone lock and the freeze, which the page makes step 3. The page follows the review's "re-rank" bullets instead. Isaac decides which order the description means.
- "Two free switches" and "$0" for Verizon: cite a Verizon price statement, or the FCC rule (Federal Register 2023-26338) once the effective-date notice for 47 CFR 52.37(d) and 64.2010(h)(4) has been read.
checked: 5 Nov 2026: every claim on the page has now been read on 5 or 6 Nov. Whether the footer moves to 6 Nov is a site-wide call (every Do page carries 5 Nov).- Regulation E excludes wire transfers (§1005.3(c)(3)). The "Money left your account" item could say wires aren't covered. That is a new claim, so it wasn't added.
tools/audit.py: the sentence splitter doesn't break after a closing quote (.”), so a quoted rule, an evidence label and the next sentence count as one sentence (52 words flagged during this pass, fixed by shortening the page's sentence). Splitting on[.!?][”’]?\s+would fix it.source/impact/needs-2026-11-06.mdA4.4: add that /about-hotline carries neither the hours nor the languages, so pages cite /providing-help-restoring-hope for them.source/stale.tsv: add a re-check of Krebs's Experian finding (dated 11 Nov 2023) and of the FCC lock sections' effective date.CHANGELOG.md: a reader-facing line for these corrections, if the coordinator wants one.content/cybercrime.html(being edited by another agent): the Do door lists "a family safe word" but not the call-back rule, which is now step 2.
When this goes stale
- Hotline hours and languages, and the FTC pages, change without notice: re-read at the monthly menu-path check (stale.tsv row, 2026-12-05).
- The IC3 figures last until the 2026 report (expected April 2027; stale.tsv row 2027-04-30).
- Krebs's Experian finding is dated 11 Nov 2023 and is the newest read; re-check before the next cybercrime rotation.
- The FCC lock sections' effective date (B11) was not read; it decides whether "free" has a federal source for every carrier.
Contest a fact, suggest something, or tell us what’s broken
If someone is in danger right now, don’t use this form. Call your local emergency number (911 in the US). For trafficking: 1-888-373-7888, or text 233733.
No name, no account. Your note goes into the site’s private records, nothing about your browser or connection is stored with it, and the email box is the only way we’d know who you are. The weekly review reads every note, re-reads the original source, and fixes the page if it should. A contested fact and its outcome are listed on Contested, in the review’s words, never yours.
No tracking on any link.Ticks stay on this device.What changedContested