It starts on an ordinary Tuesday, somewhere between dinner and the dishes. Your phone buzzes with a text from your bank: a $499 charge at an electronics store two states away. Did you make this purchase? Reply YES or NO. You reply NO, because of course you do. Thirty seconds later the phone rings, and a calm, professional voice from the “fraud department” already knows your name, the last four digits of your card, and the exact charge. All he needs, he says, is the one-time code that just landed in your messages, so he can “stop the transaction before it clears.”
Read that code out, and the money is gone within the hour. Not because you were careless. The script is engineered to feel like help arriving at exactly the right moment. The voice is patient. The details check out. The only thing wrong with the whole scene is the one thing you can’t see: the caller is the fraud.
Stories like this aren’t rare, and they aren’t cheap. The Federal Trade Commission says consumers reported losing $12.5 billion to fraud in 2024, up 25 percent from the year before. The FBI’s Internet Crime Complaint Center (IC3) logged 859,532 complaints and $16.6 billion in reported losses the same year, with investment fraud alone accounting for roughly $6.6 billion. Behind every one of those numbers is someone who answered the phone, believed the text, or trusted the website — usually in under ten minutes.
The short answer: how to beware of scams
You don’t beat scams by memorizing every trick. You beat them by refusing to play at the scammer’s speed. Treat every unexpected request for money or information as unproven, verify it through a channel you found yourself, and never pay by gift card, cryptocurrency, wire transfer, or a payment app at someone else’s instruction. A real bank, agency, or business will survive your ten-minute check. A scam won’t.
The Federal Trade Commission boils nearly every scam down to four signs: the scammer pretends to be from an organization you know, announces a problem or a prize, pressures you to act immediately, and tells you to pay in one specific way. Costumes change. Those four moves don’t. The ten habits below are built around breaking each one.
Habit 1: Verify every surprise request on a second channel
This is the master habit, the one that makes the other nine easier. Any message that arrives uninvited — a call, text, email, or social media DM asking for money, codes, or account details — gets checked somewhere else before it gets anything from you.
Hang up. Then call the number printed on the back of your bank card, on your statement, or on the organization’s real website, which you type in yourself. CISA gives the same advice in its guidance on social engineering: if you’re unsure whether a request is legitimate, contact the company directly, and don’t use contact information supplied by the message itself. Caller ID is worthless here. Scammers can make any name and number appear on your screen, including your bank’s.
Ask one question when you get through: “Did you contact me?” Ninety-nine times out of a hundred, that ends it.
Habit 2: Take the ten-minute pause, every single time
Urgency is not a detail in a scam. Urgency is the scam. The threat to arrest you, freeze your account, cancel your delivery, or corrupt your computer exists for one reason: a person who stops to think is a person the script loses.
So build the pause into your routine. Any request that demands action “right now” automatically gets ten minutes — longer if money is involved. Set the phone down. Make tea. The FTC’s guidance is blunt: honest businesses give you time to decide, and anyone who pressures you to pay or hand over information on the spot is a scammer. The agency also suggests talking to someone you trust before acting, because saying the story out loud — “the bank needs me to read them a code” — often breaks the spell all by itself.
If a caller tells you not to hang up, hang up. That instruction alone tells you everything.
Habit 3: Refuse the payment methods scammers demand
Here’s the simplest filter in this entire guide. If someone who contacted you insists that you can only pay with a gift card, cryptocurrency, a wire transfer through a service like Western Union or MoneyGram, or a payment app — stop. Completely. It doesn’t matter what the story is: a tax bill, a bail payment, a computer repair, a lottery fee, a sweetheart overseas who needs help getting home.
The FTC is explicit on this point: never pay someone who insists on one of those methods. Scammers choose them because the money moves fast and comes back almost never. Gift card numbers read over the phone are cash. Crypto sent to a stranger’s wallet is gone. A legitimate creditor will take a check, a card, or a payment through your own bank’s bill pay — and will still be there tomorrow.
Habit 4: Never deposit a check and send money back
This one catches smart people, because the check looks real, your bank may even make the funds available, and the request sounds harmless: deposit this check for your new job, your prize, your mystery-shopping assignment, or the overpayment on something you sold — then send part of it back, or buy equipment with it, or forward it to a “supplier.”
Don’t. The FTC warns against exactly this arrangement. The check is fake, and when it bounces days later, your bank takes the full amount back out of your account — including whatever you already sent on. The money you forwarded was yours. There’s no version of a legitimate job or prize that starts with you moving someone else’s money around.
Habit 5: Treat surprise requests for personal information as hostile
Honest organizations won’t call, email, or text out of the blue to ask for your Social Security number, bank account number, card number, or login credentials. The FTC states this plainly, and it holds even when the message appears to come from a company you actually use.
That includes the one-time codes sent to your phone. Those codes exist to prove that the person logging in is you. The moment a caller, a “support agent,” or a chat window asks you to read one back or type it somewhere new, you’re not verifying your account — you’re handing over the keys. No real fraud department will ever ask. Ever.
Habit 6: Read the sender, the link, and the address before you click
Phishing messages survive on glances. Slow down for three specific checks, drawn from CISA’s list of common phishing indicators:
- The sender’s address. Lookalike domains swap or drop a character or two — “suppport” with a third p, a hyphen, the wrong ending. Your bank’s real domain is short and boring.
- The greeting. “Dear Valued Customer” from a company that has known your name for a decade is a tell. So are signatures with no real contact information.
- The link’s true destination. On a computer, hover before you click. On a phone, long-press to preview. If the destination doesn’t match the company named in the message, close it.
Unexpected attachments get the same treatment: don’t open them, even when the invoice, resume, or shipping notice looks routine. And when in doubt, go around the message entirely — open the company’s app or type its address yourself, and check your account there.
Habit 7: Check the website before you pay it anything
A polished storefront proves nothing. Fake shops copy real product photos, invent reviews, and run ads that vanish by the weekend. Before money changes hands with any site you don’t already know, run it through a proper check: how old the domain is, whether the business details hold up, whether the prices make sense, and whether anyone outside the site itself vouches for it.
Our step-by-step walkthrough, how to check if a website is legit, goes through the full routine in about ten minutes. For a fast first pass, WarnScams also runs a free Domain Checker that flags the warning signs — brand-new registrations, lookalike names, missing business details — before you reach the checkout page. Thirty seconds of checking beats thirty days of disputing charges.
Habit 8: Lock your accounts with unique passwords and two-factor authentication
Prevention isn’t only about spotting lies; it’s about making one mistake survivable. If a scammer does get a password, unique passwords mean they get exactly one account, not your email, your bank, and your shopping history in a single afternoon. A password manager makes this painless, and it beats the sticky-note method by a wide margin.
Then turn on two-factor authentication everywhere it exists, and prefer an authenticator app or a hardware key over text-message codes — CISA counts phishing-resistant sign-in methods among the strongest protections an individual can switch on, precisely because codes delivered by text can be intercepted or talked out of you (see Habit 5). Our guide to securing your phone and online accounts walks through the setup account by account. Do your email account first. Whoever controls your email can reset everything else.
Habit 9: Let unknown calls go to voicemail, and filter your texts
You can’t be talked into a scam you never engaged with. The FTC recommends blocking unwanted calls and filtering unwanted texts, and the mechanics are already in your pocket: every major carrier and phone maker offers spam filtering, most of it free.
A working rule: if a number isn’t in your contacts and the matter is real, they will leave a message, and you can call back on a number you trust (Habit 1 again). Answering live puts you inside the script, where the pressure tactics work best. Family members can adopt a code word, too — a word a scammer pleading for emergency money would never know. It sounds old-fashioned. It works against voice clones and panicked grandchildren alike.
Habit 10: Keep software updated, and talk about scams out loud
Updates close the holes that malicious links and attachments exploit, and both CISA and the FTC treat current software as basic hygiene rather than optional polish. Turn on automatic updates for your phone, browser, and operating system, and let them run.
The talking matters as much as the patching. Scams thrive on embarrassment and silence; victims routinely delay reporting because they’re ashamed, and that delay is what makes recovery harder. Mention the fake delivery text at dinner. Debrief the weird call with your parents before a scammer makes the same call and reaches them first. Every person who has heard the script described once is measurably harder to fool with it.
The “Before You Pay” checklist: five questions
Tape this to the fridge, or copy it into your notes app. Before sending money to anyone you don’t already know and trust, ask:
- Did this request arrive uninvited? If a call, text, email, or DM started this, assume it needs proof, not payment.
- Have I verified it on a channel I found myself? A number from my card, my statement, or the official app — never one from the message.
- Am I being rushed? Deadlines measured in minutes are a sales technique, not a banking procedure.
- How am I being asked to pay? Gift card, crypto, wire, or payment app at someone’s instruction means the answer is no.
- Have I told another human? If saying the story out loud sounds strange, that’s your answer.
One wrong answer is enough to stop. All five take less time than the transfer would.
If you already slipped
It happens to careful people every day, and speed matters more than pride. If money moved, call the company you sent it through — your bank, the wire service, the gift card issuer, the crypto exchange — immediately and ask whether the transfer can be reversed or frozen. If account details or passwords changed hands, change the passwords, starting with email, and contact your bank so it can watch or close compromised accounts, as CISA advises.
Then work through what to do in the first 24 hours after a scam, step by step. After that, report it. A fast report sometimes helps investigators freeze funds, and it always helps the next person: file with the FTC at ReportFraud.ftc.gov, with the FBI’s IC3 at ic3.gov, and with your local or national authority — our guide to reporting online fraud by country lists the right channel for where you live.
Sources
- Federal Trade Commission, “How To Avoid a Scam” (the four signs of a scam, and the payment methods to refuse): https://consumer.ftc.gov/articles/how-avoid-scam
- Federal Trade Commission, “New FTC Data Show a Big Jump in Reported Losses to Fraud to $12.5 Billion in 2024” (press release, March 2025): https://www.ftc.gov/news-events/news/press-releases/2025/03/new-ftc-data-show-big-jump-reported-losses-fraud-125-billion-2024
- FBI Internet Crime Complaint Center (IC3), 2024 Internet Crime Report (859,532 complaints; $16.6 billion in reported losses): https://www.ic3.gov/AnnualReport/Reports/2024_IC3Report.pdf
- Cybersecurity and Infrastructure Security Agency (CISA), “Avoiding Social Engineering and Phishing Attacks”: https://www.cisa.gov/news-events/news/avoiding-social-engineering-and-phishing-attacks
- Federal Trade Commission, ReportFraud.ftc.gov (report scams and fraud): https://reportfraud.ftc.gov
Last reviewed: November 2026
This article is for education only and is not financial or legal advice.