Scam-Proof Your Life

Scams mutate daily, but the underlying plays are stable enough to memorize. Learn the play, and the thousandth variant looks like the first:

And the universal constant across every channel: the payment method is the confession. Gift cards, wire transfers, crypto, cash in the mail, payment apps to strangers — scammers demand these because they're irreversible. No government agency, utility, or legitimate business settles debts in Apple gift cards. That single fact, fully absorbed, defeats entire categories of fraud.

Scammers target the edges of the age curve, and the defense for both is the same: conversations held before the crisis, because mid-crisis is the scammer's home field.

For elders: the big three are the grandparent scam (a panicked "grandchild" needs bail — now supercharged by AI voice cloning), tech-support fraud (a popup or cold call, remote access, then 'refund' theater that drains accounts), and romance scams. Countermeasures worth setting up this week: a family code word that any emergency money request must produce; the ironclad rule hang up and call back on a number you already have; and — this one matters most — an explicit promise that falling for something means help, never ridicule. Shame is the scammer's retention tool: embarrassed victims stay quiet, stay unhelped, and land on "sucker lists" that are resold for repeat targeting.

For kids and teens: the sharpest current threat is sextortion — criminals posing as peers online coax an image, then extort. The FBI has issued repeated warnings, particularly about financially motivated schemes targeting teenage boys, and the outcomes have included tragedies. The defense is a specific promise, delivered verbatim and early: if anything like this ever happens, you will not be in trouble — come to me, we'll handle it together, and it is never hopeless. Beyond that: gaming chats and DMs from strangers bearing gifts or moving conversations to private apps are the standard grooming and scam on-ramps; teach the pattern, not just the rule.

Companies you trusted will lose your data; that's a base rate, not a maybe. What separates annoyance from catastrophe is your response sequence:

1. Scope it. Check your email addresses at Have I Been Pwned to see which breaches include you and what leaked — passwords, phone numbers, addresses, or worse.
2. Rotate the blast zone. Change the breached site's password immediately — and anywhere else that password or its cousins lived. (If you've done module two, that's one site, and this step takes ninety seconds. This is the payoff.)
3. Tighten the doors. Confirm MFA is on for the breached account and your email. Attackers work breach lists fast while credentials are fresh.
4. If identity data leaked — SSN, birth date, address — freeze your credit. A credit freeze blocks new accounts from being opened in your name, and since a 2018 federal law (passed in the wake of the 2017 Equifax breach that exposed data on roughly 147 million people), freezing and unfreezing is free at all three US bureaus: Equifax, Experian, and TransUnion. It takes about fifteen minutes total online, you can thaw it temporarily whenever you legitimately apply for credit, and for most people there is no good reason not to have one permanently in place. It is the single most underused defense in personal security.
5. Watch the aftermath. Breach victims get targeted with follow-up phishing that references the breach itself ("as you know, your account was compromised..."). Data from the breach makes these eerily credible. Same rules apply: no links from unexpected messages; go to the site directly.

Fifteen minutes of response, correctly sequenced, converts most breaches into a non-event.

Locked out, or seeing activity that isn't yours? Move in this order — the order matters:

1. Run the recovery flow now. Every major platform has a dedicated compromised-account path (search the provider's name plus "account recovery" — from the official site only; "account recovery help" ads and DMs are a scam genre of their own). Speed matters because the attacker's first move is changing recovery details to lock you out properly.
2. Evict the squatter. Once in: change the password, then find "sign out all other sessions." Until you do that, the attacker's logged-in session may happily survive your password change.
3. Check the traps — especially in email. The classic persistence trick: a quiet forwarding rule or filter that copies your mail (hello, password resets) to the attacker indefinitely. Check forwarding, filters, connected apps, app passwords, and recovery addresses — attackers plant their own to re-enter later.
4. Chase the blast radius. What could this account reset or access? If it's your email, assume every linked account is exposed; rotate the important ones.
5. Warn your people. The attacker likely messaged your contacts — "I'm stranded, can you wire me money" and malicious links perform beautifully when they come from a real friend's real account. A quick heads-up breaks that chain, and it's the step embarrassment most often skips.

Victims skip reporting because it feels pointless or humiliating. Both instincts are wrong, and the first one can cost you the money.

Speed has a literal payoff. If money moved by wire or bank transfer, call your bank immediately and say the word "fraud" — banks can attempt recalls, and the earlier the attempt, the better the odds. In the US, the FBI's Internet Crime Complaint Center (IC3) runs a Recovery Asset Team that works with banks through what it calls the Financial Fraud Kill Chain to freeze fraudulent transfers; its own annual reports show the majority of funds are frozen in cases reported quickly, with success rates dropping sharply as hours pass. Card payments can be disputed; gift cards are a longer shot, but report the card numbers to the issuer anyway — sometimes unspent balances get frozen.

Where to file (US):

• IC3 (ic3.gov) — internet-enabled crime of any size. Reports feed investigations and takedowns; your data point helps even when your case alone wouldn't.
• FTC (reportfraud.ftc.gov) — all fraud; and if identity theft is involved, identitytheft.gov generates a personal recovery plan plus the official reports banks and bureaus expect.
• Your local police — a report number is often required by banks and insurers, even when no investigation follows.

And say it out loud to someone you trust. Fraud thrives on silence — silence keeps victims off guard lists and on sucker lists, keeps families unwarned, and keeps the same play working down the street. Reporting isn't an admission of foolishness. It's the moment you switch from target to sensor.