A suspicious message does not need spelling mistakes or an unfamiliar logo to be dangerous. The most useful habit is to pause an unexpected request and verify it through a separate, trusted route. Prepare that habit before a caller creates pressure to act.
Focus on the request, not the apparent identity
The FTC scam guidance describes impersonation, invented problems or prizes, pressure and unusual payment demands. Treat an urgent instruction to pay, disclose information or install software as something to verify. Familiar names and displayed caller information are not enough to establish identity.
A message can include accurate personal details and still be deceptive. Do not use a recognizable voice, logo or account-related subject line as the only test. The question is whether you independently confirmed the request and the person or organization behind it.
Use a separate route to verify
- End the unexpected call or leave the message unanswered.
- Open the organization’s known app or use contact details from a trusted statement or card.
- For a family emergency, contact the relative or another trusted family member through an existing number.
- Explain what was requested without following the original caller’s instructions.
- Resume only when the actual organization or person confirms what is needed.
Avoid using a number, link or QR code supplied in the suspicious contact as the verification route. Searching hurriedly can also lead to an imitation support page. Keep important verified contacts available so a stressful request does not force a last-minute search.
Recognize common pressure situations
A caller may claim an account is under attack and instruct you to move money to a supposedly protected place. Another may describe a relative in danger and insist on secrecy. A message about a package, bill or prize may ask for a small payment before revealing a larger demand.
Treat those as situations to stop and verify, not scripts you must memorize. A genuine concern can be checked through the appropriate organization without accepting the unexpected contact’s payment instructions. Do not provide gift-card numbers or send cryptocurrency because an incoming caller insists it is necessary.
Protect passwords and verification codes
The FTC phishing resource explains how messages can lure people into disclosing account information. Open the service separately instead of signing in through an unexpected link. Do not send a password or read out a login code to someone who contacted you unexpectedly.
An authentication prompt should correspond to a login you initiated and understand. If it does not, do not approve it. A password manager and multifactor authentication can help, but they do not make every message safe or establish that an incoming request is genuine.
If you already responded, choose the right next action
The FTC response guide separates steps by what was shared or paid. Contact the bank, card issuer or payment provider promptly through a verified channel if money was sent. Ask about the transaction and recovery options; reimbursement is not guaranteed.
If account credentials were disclosed, use the provider’s official recovery or security process and change compromised or reused passwords. If computer access was granted, seek trusted technical help. Preserve relevant messages and payment records without sending more information to the suspicious contact.
Report fraud through ReportFraud.ftc.gov. For identity misuse, use IdentityTheft.gov for appropriate recovery guidance. Reporting does not itself reverse a payment or secure a compromised account.
Make asking for help easy
Agree a trusted contact whom the resident can call before acting on an unexpected request. Keep that conversation calm and practical. Blame or embarrassment can make it harder to ask early, when there may still be options to limit harm.
Illustrative example: a text says the bank account will close unless the resident signs in immediately. They open their usual bank app instead and contact the bank through its verified channel. That separate check resolves the request without testing whether the text’s link looks convincing.
Use the password-manager guide for account protection. Agree support roles with the family task planner, keeping account numbers, passwords and verification codes out of the shared plan.
Leave a Reply