Defensive Computing - Scam School

SCAM SCHOOL

When it comes to scams, the rule is Never Trust.

THE MOST IMPORTANT THINGS TO KNOW

When you get a text message, you have no idea who sent it. Act accordingly.
When you get an email message you have no idea who sent it.
1. The FROM address can be faked, so even if it appears legit, it may not be
2. If you don't understand the rules for Domain Names, you can be tricked into trusting a FROM address that belongs to bad guys. For more, see the Limits of Defense section in the topic on Domain Name Rules.
3. Even if the FROM address is legit, it does not mean that that person/company it identifies actually sent the message. If it is a person, for example, their email may have been hacked.
4. Again, act accordingly.
When you get a phone call, you have no idea who the caller is.
1. CallerID can be forged
2. The voice can be forged. Think you recognize the voice? Voices can be artificially generated, even based on a small sample of someone speaking. Voices can be obtained from public videos on YouTube or TikTok. Artificially generated voices have been good enough to fool a mother into thinking they were talking to one of their children. The best defense for this is to have a family code word. If you suspect something, ask the caller for the previously agreed upon code word (or phrase).
3. Again, act accordingly.
Information about you: Regardless of text vs. email vs. phone call, do not trust the message because it knows information about you. Companies leak data ALL THE TIME. Really, it is a very common thing.

COMMON ATTRIBUTES OF SCAMS

If someone is asking you to move money, transfer funds, stay on the phone, or keep the conversation secret, its a scam.
Any message that requires you to act quickly, is likely a scam. The power company is not turning off your electricity tomorrow morning. Scams pretend that you must act quickly so that you don't have time to take a breath and question things.
One-time security codes are numbers, typically 4 to 6 digits, that a company will send you as part of verifying your identity. Typically this happens after you have entered a userid and password. You may be sent the code by text message, by email, by a computer generated voice call or by a pop-up alert on your phone. Large financial companies such as Fidelity and Vanguard use one-time security codes ALL the time. If anyone asks for this code, it is a scam. Better financial companies will send you a warning about not sharing the code along with the code. Not all companies do this (looking at you TD Bank).
There is a problem with your account. Very popular scam. The defense is not to trust the notification, but instead verify it by directly contacting the company with the supposed problem account.
If anyone calls and asks for your Medicare, Social Security, or bank or credit card information, hang up.
Most everything involving cryptocurrency is a scam.
Payment: Bad guys typically expose the scam when it comes time to pay them. Payment with gift cards, cryptocurrency, prepaid debit cards, wire transfers, cash, MoneyGram or Western Union are pretty much guaranteed to be scams.
Messages that appear to be from the U.S. Postal Service, FedEx or UPS about a shipment issue, are likely scams.
If anyone calls and says they are from Apple, Google, Gmail or Microsoft, it is a scam. No one from Apple, Google or Microsoft will ever call you, out of the blue, for any reason.
Fake websites: No one is taught the rules for website names (technically Domain Names) in High School, so bad guys take advantage of this to create websites with names that look legit but are not. Copying the look and feel of the legitimate website is an easy thing for bad guys to do. Take Citibank for example, whose website is citi.com. The website citi.com.badguy.com is a scam. So too are secure-citi.com, citi.onlinebanking.com, citi25.com, payments.com/citi.com, citi.io, citi.biz, citi.me and citi.bank. But, whattheheck.citi.com would really be Citibank, if it existed. This is a big subject and there are details on the Domain Name Rules page of this site.
Fake social media accounts are just as much an issue as fake websites. For example, the Social Security Administration has 21 legit social media accounts vs. one website.
The majority of prompts, asking you to install software, are scams. As Brian Krebs says "If you didn't go looking for it, don't install it!"

COMMON SCAMS

Get a message about an expensive thingy you purchased with a phone number to call? Don't call. The thing may be an Apple computer or an anti-virus program. Whatever. You did not buy it.
A picture is worth a thousand words, so here is a real-life example of this scam. A gmail user sends an email thanking the victim for the purchase of cryptocurrency and attaching a phony invoice. The attachment is an image, not a PDF file, which, I assume, is done to avoid detection. This is a particularly stupid scam as the body of the message is about a refund while the subject line is about a purchase. No matter, the point here is to get you to look at the false invoice and make a phone call to cancel the order that never existed.
You get a phone call that appears to come from your bank (remember that CallerID can be faked). The bad guy claims there are suspicious transactions on your account and offers to help secure it. The bad guys may know personal details about you, including information about your accounts, which makes it seem legit. If you are traveling to another country, the bad guys may know that too. When in doubt, call the phone number on the back of the credit card. On Instagram, user thetechchap confessed to falling for this. (added May 30, 2026)
Alert! Storage Full. Your account has reached its allocated capacity. This scam is likely after your credit card which you will be asked to provide to purchase whatever the scam says you ran out of. On the small chance a message like this is valid, logon to your Apple or Google account and check it.
If anyone wants remote access to your computer, run for the hills.
You get sent a paper check that the bad guys will say was in error. They ask you to deposit it and send them the money. The check is fake and the scam relies on the fact that the bad guys get your money before your bank realizes the check was fake.
April 23, 2026: There’s a New Phishing Scam: Fake Invitations by Steven Kurutz for the New York Times. The scam emails pretend to be from Paperless Post, Evite and Punchbowl. Sometimes clicking the link in the email appears to do nothing, but under the covers it has installed a virus. Other times, the link is functional but it opens a web page that asks for a password or other personal information. Jared Newman, who writes a tech newsletter, received one of these scam emails that pretended to be from eVite. The April 28, 2026 issue of the newsletter even has a screen shot. His was a poorly done scam as the email sender and link target were clearly not eVite. Defenses:
To verify a message from Paperless Post send it to phishing@paperlesspost.com
See Spotting fake Paperless Post emails and spam texts: How to know what’s real from Paperless Post
See Is that Evite real or a phishing scam? How to tell the difference from Evite.
If someone is trying to get you to transfer funds out of your bank, investment or retirement account "for your protection", it's a scam. This may start with a phone call where the callerid was spoofed to appear to be from your bank. A scammer will warn that your account has been hacked. Then they, or a phony supervisor, will walk you through a reversal procedure to secure your money. This just sends your money to the bad guys. To further appear legitimate, the bad guys may provide valid information about you or your account. No doubt, this information comes from one of the hundreds of data breaches that happen every day.
There are wolves in sheep's clothing. If you get a message, intended for someone else, from a very kind and polite person, it may be the first step in a pig butchering scam. The scammers will start off talking about small things and keep the conversation going and going. For months they will continue to engage with a victim. Eventually, they will become a friend, and then a trusted friend and, finally ... gimme money.

SOME EXAMPLE SCAMS

December 18, 2024: Brian Krebs wrote How to Lose a Fortune with Just One Bad Click about someone who lost control of their Gmail/Google account. In part, the victim was scammed by an email message sent from google.com. Normally this means the email came from Google, but, not here. The article references this December 2023 article by Graham Cluley: Google Forms Used in Call-Back Phishing Scam. Suffice it to say, that the Google Forms system can be abused by bad guys to send victims scam emails that really come from google.com. As I write this, it has been over a year and Google has not fixed this problem.
NEVER EVER share a one-time security code with anyone who calls you or texts you, even if they claim to be from your bank. The good news here is that more and more companies are now including a warning to this effect along with the temporary one-time security code. This is progress.
An interesting example of this was given in this Washington Post article: AI, huge hacks leave consumers facing a perfect storm of privacy perils by Joseph Menn (December 3, 2024). The almost-victim is a widely recognized privacy expert who came very close to being scammed himself. Google accounts have a recovery phone number for when your forget your password. A bad guy calling from a Google support number warned the almost-victim that someone might be trying to take over their email account by adding a new recovery phone number. At this point the almost-victim made two mistakes. One, they forgot that callerid is not trustworthy. Two, they forgot that there is no tech support for free services, such as Gmail. Maybe he let this slide because he was somewhat famous and thought he was special? Dunno. The scammer told the almost-victim their previous recovery phone number to prove the really worked for Google. But, between the lack of privacy in the US and data breaches, his phone number was widely available to bad guys. Trusting this, was the 3rd mistake by the almost-victim. The scammer said they created a ticket for the issue and needed to prove that the almost-victim was really the almost-victim. First, the bad guy sent the almost-victim an email. Eh. Then, the good stuff: The bad guy sent a code to the almost-victims phone to insure that he really had control of the correct recovery number. It was not until the scammer asked the almost-victim (again, an expert in this stuff) to read back this code that the light bulb went off in the almost-victims head. End of scam. There was always a tiny delay before the scammer spoke, so the thinking is that the voice was an AI-assisted translation from text to speech.

SCAM TESTERS

Free Service to detect scam emails. This free email scam detector gives you the protection Gmail and Outlook don't by JR Raphael for Fast Company. August 9, 2025. Quoting: "Snitcher Space does just one thing and does it impressively well: It analyzes any email you send it, on the spot, and tells you if it seems likely to be a scam - along with exactly what red flags (if any) led to that verdict . . . It's an incredibly useful resource for identifying fishy emails and instantly confirming that something isn't what it seems - and, in all likelihood, is out to try to scam you in some way . . . just forward [an email] to the address scan@snitcher.space."
Send anything suspicious to Scamwise.com. Emails can be forwarded to submit@scamwise.com. They have instructions for all other types of data. Heck, you can even take a photo of a letter you got in the mail and send them the photo. They scan for common scam signals and give you an opinion also with an explanation of the reasons for the decision. See also this 3 minute video by Rich DeMuro: Is it a scam? (April 2026)

DEFENSE

If you ever think there might be an issue with your bank or credit card, DO NOT call the number in the text message or email message or the whatever. For a credit card, only call the phone number on the card. The safest place to get a bank phone number is from a bank statement.
Searching online for a customer service phone number, is likely to lead you to bad guys. They love to trick Search Engines to attract victims who have not seen this page.
In the US, phone calls from/to area code 833 are more suspicious than other area codes.
The person contacting you knows so much about you that they must be legitimate. No. No. No. As a result of far-too-many data breaches, and the total lack of privacy legislation in the US, the bad guys know a lot about you. This has been true for a long time, but it is getting worse. See AI, huge hacks leave consumers facing a perfect storm of privacy perils by Joseph Menn for the Washington Post (last update Dec 3, 2024). Quoting: "Hackers are using artificial intelligence to mine unprecedented troves of personal information dumped online in the past year, along with unregulated commercial databases, to trick American consumers and even sophisticated professionals into giving up control of bank and corporate accounts."
Too many ads are scams. See the page here on Web Browsers for information about installing the uBlock Origin ad-blocking browser extension.
Amazon customers can benefit from information Amazon has published about identifying scams. More on this on the Amazon page.
Here's an easy one: Never Buy Tickets on Social Media - It's Nearly Always a Scam by Joe Keeley for How To Geek. December 6, 2024.

FYI

Seniors in the US should review this advice from the Social Security Administration: Protect Yourself from Scams. There is actual good advice here.
Official agents of the U.S. government do not message you on Facebook, WhatsApp or any other social media or messaging app. Likewise, they don't call on the phone. If you think you are being contacted by the U.S. government the best thing to do is to contact the agency directly.
Good, but undated, advice from American Express How To Detect Scams and Prevent Fraud. However, they nag you to install their mobile app. There is no need for this, and I don't think it is a good idea to have financial apps on a phone that can be lost or stolen.
New scams are always being invented. To keep up, the Federal Trade Commission issues consumer alerts about scams that you can get for free. If you are an AARP member, you can get their biweekly Watchdog Alerts newsletter about the latest scams.

HELP FROM A DRUG STORE

The use of gift cards in scams has been so common that, any time you are asked to pay for something with a gift card, we have to assume, it's a scam

Here we see a drug store that fought back against these scams.

AARP has much more on Gift Card Payment Scams

And, again top

Act accordingly.