How to notice the pressure a scam puts on you, check any caller on a line you control, refuse every payment and access trick, and lock your accounts so a stolen password is not enough.
Doctor's Note: A scam can hurt more than your bank balance. Fraud victims report anxiety, depression, shame and loss of trust [1]. If worry, poor sleep or low mood carry on for more than a couple of weeks, see your doctor. If you ever think about harming yourself, call your local emergency number now. In older adults, low scam awareness was linked to a higher later risk of memory problems and dementia [2], so if a parent suddenly starts falling for offers they once ignored, suggest a check-up with their doctor.
If money has already left your account, stop reading and call your bank now on the number on the back of your card, from a different phone if you can [3]. Then report it, for example: UK, Report Fraud at reportfraud.police.uk or 0300 123 2040; Canada, the Canadian Anti-Fraud Centre at 1-888-495-8501 or reportcyberandfraud.canada.ca; US, ReportFraud.ftc.gov. Elsewhere, contact your local police. The full first-hour plan has its own article, listed under Go further.
Step 1: Spot the Pressure: Urgency, Authority and Secrecy
WHY THIS MATTERS
In a randomized lab study, researchers split 231 adults, aged 30 to 40 and 65 to 85, into groups that were made excited with rigged wins, made frustrated with rigged losses, or kept calm [4]. Then everyone looked at misleading adverts that a consumer protection agency had flagged [4]. Both the excited and the frustrated groups said they were more likely to buy, with no difference between younger and older adults [4]. The adverts did not seem more believable to them; only the wish to buy went up [4]. Feelings change what you do before they change what you think.
Scammers create those feelings on purpose, using three levers. Europol lists a feeling of emergency, pressure, and a request for absolute confidentiality among the signs to know [3]. The FTC adds that scammers often pose as a government agency, a well-known business, or both [5]. Urgency stops you thinking, authority stops you questioning, and secrecy stops anyone else from warning you.
- Learn the three stop signs by name. Urgency: "act now", "your account closes today", a feeling of emergency [3]. Authority: "this is your bank", "the police", "the tax office" [5]. Secrecy: "don't tell your bank or your family" [3].
- Treat any one stop sign in a contact you did not expect as enough to pause. You do not need all three.
- Notice your body. A racing heart, a hot face or a rush of hope during a call about money means your feelings are high, which is the moment to hold off [4]. Breathe out slowly three times before you answer.
- Say this sentence out loud, every time: "A real request will wait while I check." Write it on a sticky note by your phone.
- Set one rule for money: no payment, transfer or code on the same call, chat or email where it was asked for. Decide only once your feelings have settled [4].
Within a week you can name the three stop signs, your pause sentence is by the phone, and you have one written rule: no money moves on the contact that asked for it.
Step 2: Hang Up and Call Back on a Number You Already Have
WHY THIS MATTERS
Caller ID is not proof. Fraudsters use apps that fake the caller's identity, so your screen shows the number of the company, office or person they pretend to be [3]. The number they give you, the link they send and the name on the screen are all under their control.
There is a second trap. Europol warns that some callers tell you to ring them back on an official line, then keep the connection open after you hang up, so the "official" voice you reach is still theirs [3]. The FBI and Europol give the same core advice: hang up, find the organization's number yourself, and dial it directly [6], using another phone if you were called [3]. Verification only works when you start the call.
- Tonight, save your bank's fraud number in your phone as "Bank FRAUD", copied from the back of your card or a paper statement [3]. Do the same for your phone carrier and anyone else who handles your money.
- When any unexpected call or message asks for money, codes or personal details, end it. Do not press a number, do not click the link, and do not call the number they give you [3].
- Use a short script so hanging up feels normal: "I don't deal with this on incoming calls. I'll call the bank myself." Then hang up, even mid-sentence.
- Call back on the saved number, from a different phone if you have one, because the scammer may still be on your line [3].
By the end of today your bank's real fraud number is saved, you have a one-line script for hanging up, and you know to call back from a different phone.
Step 3: Set a Family Code Word That Beats a Cloned Voice
WHY THIS MATTERS
The FBI warns that criminals make short audio clips of a loved one's voice to fake a crisis call, and use cloned voices to pose as account holders with banks [6]. They also make videos for real-time video chats with fake company bosses, police officers and other authority figures [6].
- Choose a code word tonight [6]. Pick something that has never been online: not a pet's name you have posted, not a birthday, not a school. A made-up pair works well, such as "blue kettle 47".
- Agree one rule with everyone: on any call, voice note or video asking for money or urgent help ("Mum, it's me, I've been arrested, I need money for a lawyer"), the caller must give the word. No word, no money.
- Ask for it calmly: "What's our word?" A real family member will understand. A scammer will dodge, get upset or say there is no time, which is a stop sign in itself.
- If the caller cannot give the word, hang up and call the family member on the number saved in your phone [6].
- Treat video the same way. A face on a screen can be fake [6]. If a "boss", "officer" or "official" on video asks for money or secrecy, hang up and call their organization on a number you found yourself [6].
By the end of tonight your household shares a code word that has never been written online, and everyone knows the rule: no word, no money.
Step 4: Refuse the Payment and Access Tricks
WHY THIS MATTERS
Even when a scammer gets your attention, they still need one of three things to take your money: your codes, a payment that is hard to reverse, or access to your device. India's central bank reminds people that banks and payment operators never ask for a password, PIN, OTP or CVV [7]. The FTC warns that anyone who says you can only pay by bank transfer, wire, crypto, a payment app or a gift card is probably a scammer [5]. Europol warns that a program a caller asks you to download can give them access to your device, your data and then your bank account [9].
Credit cards work differently from those channels. The FTC advises paying by credit card whenever possible, because it gives you the option to dispute charges [5].
- Never share a one-time code, PIN, password, CVV or card details with anyone, even someone who says they are your bank, your phone company or the police [7].
- Never pay by gift card, crypto, wire or payment app because someone contacted you and said you must [5]. A request to move your money to a "safe account" is a warning sign too [3].
- Pay by credit card where you can, so you can dispute a charge [5].
- Never install an app or give remote access to someone who contacted you. Hang up on any unexpected call claiming there is a problem with your computer, and download software only from official websites [9].
- Write your three nevers on a card and keep it by your phone or on the fridge: "Never share a code. Never pay by gift card, crypto or wire. Never give remote access."
- Add the "Talk" habit: before you pay anything a caller or new online contact asked for, check with one person you trust, even if you were told to keep it quiet [3]. Name that person now and tell them they are your "money check" person.
By the end of this step your three nevers are on a card by the phone, you have named your money check person, and you pay by credit card where you can.
Step 5: Turn On Two-Step Sign-In: Email First, Then Bank, Then Phone
WHY THIS MATTERS
In a large set of Microsoft accounts showing suspicious activity, two-step sign-in cut the risk of compromise by 99.22% overall, and by 98.56% even when the password had already leaked [8]. More than 99.99% of accounts with two-step sign-in stayed secure during the study period [8]. Authenticator apps did better than text-message codes, and both beat having nothing [8].
The order matters. The UK's National Cyber Security Centre explains that anyone who gets into your email can reset all your other account passwords [10], so email is the master key. Your bank holds the money. Your phone account matters because a criminal who moves your number to their own SIM can use it to get into accounts that use your phone number to check who you are [11].
Alerts are the last layer. Singapore's ScamShield advises lower transaction limits and transfer alerts at a low threshold, so any unauthorised payment can be reported as soon as possible, which improves the chance of recovery [12].
- Email (about 15 minutes). Give your email a strong password you use nowhere else [10]. Then turn on two-step sign-in in your email's security settings, choosing an authenticator app if offered [8].
- Bank (about 15 minutes). Turn on two-step sign-in in your bank's app or website. Make sure its password is different from your email's [11].
- Phone carrier account (about 10 minutes). Sign in to your mobile provider's account, set a unique password, and turn on any extra security it offers [11].
- Alerts (about 10 minutes). In your bank app, set alerts for every transaction and every new payee, with the alert threshold as low as it goes [12]. Lower your daily transfer limit to the most you would send on a normal day [12].
By the end of the evening your email, bank and phone account each need more than a password, your email password is used nowhere else, and your bank tells you about every payment and new payee.
Step 6: Keep a 7-Day Scam Log and Score Your Five Checks
WHY THIS MATTERS
The Stop, Check, Talk habit has to be ready on the night your feelings are high, because that is when judgment slips [4]. A short log shows you whether you are actually using it, and reporting attempts helps others: Europol advises contacting the police about fraud attempts even if you did not fall victim [3].
- For 7 days, log every unexpected call, text, email or message that asked for money, a code, a payment or personal details. One line each in your phone's notes: date, who they said they were, what they asked for, which stop sign, "checked: yes or no".
- On day 7, read the log. Aim for "checked: yes" on every line. If a line says "no", read the three stop signs again and say your sentence aloud.
- On day 21 and then once a month, score yourself on the Skill Check table below. Work on the lowest score first.
After three weeks you have a log with "checked: yes" on every line, and you know which skill needs the most work.
Skill Check
| Skill | Starting | Solid | Strong |
|---|---|---|---|
| Spot the pressure | I notice pressure only afterwards | I name the stop sign during the call | I say "A real request will wait while I check" every time |
| Call back | I sometimes use the number they give | I call back on a saved number | I call back from a different phone, every time |
| Code word | No word yet | Word agreed with close family | Everyone uses it on every emergency call |
| Refuse payment and access tricks | I am unsure about codes and gift cards | I never share codes or pay by gift card, crypto or wire | I also check with my money check person before any payment someone asked for |
| Lock accounts | Password only | Two-step sign-in on email | Email, bank and phone account locked, alerts on every payment and new payee |
Myths
"Only gullible or older people fall for scams." In the lab study, strong feelings raised the wish to buy equally in adults in their 30s and over 65 [4].
"My bank may ask me to read out a one-time code." Banks never ask for your OTP [7].
"I would know my own child's voice." Criminals can clone a loved one's voice from short clips [6]. Let the code word decide.
FAQ
Is it rude to hang up on someone who says they are from my bank? No. A real bank will not mind you calling back on its official number, and pressure not to hang up is a warning sign [3].
I gave a scammer a code a minute ago. What now? Call your bank now on the number on your card, from a different phone if you can [3], then follow the first-hour article under Go further.
Why does the caller keep telling me not to tell anyone? Because a request for absolute confidentiality is one of the signs of fraud [3]. Secrecy cuts you off from the people who would spot it.
Should I report a scam call even if I lost nothing? Yes. Europol advises reporting fraud attempts to the police even if you did not fall victim [3].
What to Do Next
- Tonight: save your bank's fraud number, agree your family code word, and put the three-nevers card by the phone.
- This week: spend one evening on Step 5, starting with your email.
- Next 21 days: keep the scam log from Step 6 and score yourself on the Skill Check.
Go Further
- How Scammers Trick Smart People: Hot Emotions, the Small First Yes and Sunk Costs goes deeper on why feelings override judgment.
- You've Been Scammed: What to Do in the First Hour has the full recovery plan: bank recall, closing the door, evidence and reporting.
- Lock Down Your Bank and Phone Against Hackers and SIM Swaps covers port-out PINs, passkeys and safe mobile banking.
- Lock Your Accounts: Passphrases, a Password Manager and Two-step Sign-in shows how to build passphrases, set up a password manager and keep backup codes.
