Recognizing scams: the four signs and the call-back habit
Learn the four signs of a scam and the payment rule, copy your bank's real number from your card, agree on a family code word, and practice hanging up.
- Start here: the essentials
- 1. The four signs and the payment rule
- 2. The call-back habit
- 3. The common scams, by the story they tell
- 4. Filtering junk calls and texts, and reporting them
- 5. Scams can happen to anyone
- 6. See it
- 7. Practice
- 8. Your setup
- 9. Check your work
- 10. Knowledge check and scenario
Start here Essentials
At minimum, learn four signs and one rule about payment, copy three phone numbers from your own cards and bills, agree on a code word, and turn on your phone's junk filter. Everything marked Go deeper can wait.
- Read the four signs and the payment rule (the four signs).
- Copy the phone numbers for your bank, your card and your phone company from your cards and statements onto the numbers sheet (numbers you already have).
- Agree on a family code word with the people who might call you in an emergency, and write on the sheet who knows it, not the word (a family code word).
- Say the hang-up line out loud once: "I'll call you back at the number I have" (the hang-up line).
- Turn on junk filtering for texts and calls on your phone (filtering junk calls and texts).
Minimum time: about 30 minutes. Done when: the numbers sheet lists the bank, card and phone company numbers copied from your own cards or statements, and the sheet notes who knows the code word (not the word).
1. The four signs and the payment rule Understand
A scam is a lie told to get your money, your personal information or access to your accounts or devices. Recovery, passwords and two-step sign-in make your accounts harder to break into. No setting stops a person on the phone from talking you into reading out a code, sending money or letting someone onto your computer. This chapter is about that.
Most scams this manual covers are imposter scams: the scammer pretends to be someone you would trust, such as your bank, a government agency, a well-known company or a relative. The stories change every year. The shape underneath changes much less, and that shape is what you can learn.
The four signs
The Federal Trade Commission (FTC) and the Social Security Administration (SSA) describe the same four signs. A scammer usually does all four (FTC, How To Avoid a Scam; SSA, Protect Yourself from Social Security Scams).
| Sign | What it can sound like | What you do |
|---|---|---|
| They pretend to be from an organization you know | "This is the fraud department at your bank." "This is Microsoft Support." "This is the Social Security Administration." | Do not take the name, the caller ID or the logo as proof. Contact the organization yourself. |
| They say there is a problem or a prize | Your account was hacked. Your computer is infected. You owe a toll. Your grandson is in jail. You won a sweepstakes. | Notice that the problem arrived with the call, the text or the pop-up. You did not go looking for it. |
| They pressure you to act now | "Within the hour." "Before the late fee." "Don't hang up or the case closes." "Don't tell anyone." | Slow down on purpose. A real problem will still be there after you hang up and call back. |
| They tell you how to pay | Gift cards, a wire transfer, cryptocurrency, a payment app, cash handed to a courier, gold, or a cryptocurrency machine at a store | Stop. This is the payment rule below. |
The FTC's advice that goes with the signs is short: do not share information in response to a request you did not expect; contact the company at a number or site you look up yourself; "Resist the pressure to act immediately"; and stop and talk to someone you trust (FTC, How To Avoid a Scam). SSA puts it in one word: "Pause."
The payment rule
The fourth sign is the most reliable one, because the ways scammers ask to be paid are the ways that are hardest to undo. The FTC says it plainly: "Anyone who insists that you can only pay that way is a scammer" (FTC, Phone Scams). The agencies repeat the rule for each payment method.
| If someone tells you to pay by | What the agency says | Source |
|---|---|---|
| Gift cards | "No real business or government agency will ever tell you to buy a gift card to pay them." | FTC, Avoiding and Reporting Gift Card Scams |
| Cryptocurrency | "Only scammers demand payment in cryptocurrency." | FTC, What To Know About Cryptocurrency and Scams |
| A cryptocurrency machine (kiosk) | No real police officer or government official will call to demand payment through one. | FBI public service announcement, May 15, 2026 |
| Prepaid cards, cryptocurrency or a courier, when the caller says they are police or government | Officials will not ask for payment this way. | FBI public service announcement, September 17, 2026 |
| Wire transfer, payment app, gift card or cryptocurrency, for any reason | Anyone who insists you can only pay that way is a scammer. | FTC, Phone Scams |
| Moving your money to a "safe" or "protected" account | That's a scam. The FTC will not tell you to move money to protect it. | FTC consumer alerts, March and July 2024; ReportFraud.ftc.gov |
A cryptocurrency kiosk, sometimes called a crypto ATM or Bitcoin ATM, is a machine in a store or gas station that turns cash into cryptocurrency and sends it to an address, often by scanning a QR code. The FBI describes scammers giving step-by-step instructions on the phone: take cash out of the bank, find a kiosk, scan the code (FBI, IC3 Cryptocurrency Kiosk Complaint Data By State). If you ever find yourself at a kiosk with someone on the phone telling you what to press, that is the moment to hang up.
The rule works because it does not depend on the story. A caller can know your name, your bank and the last four digits of your card. No caller can make gift cards a normal way to pay a bank or the government.
Caller ID, names and links can be faked
Spoofing is making a call, text or email show a name or number that is not the real sender's. The FTC says caller ID can be faked to show a government agency's real name or number (FTC, How To Avoid a Government Impersonation Scam). The FBI says scammers spoof real phone numbers, email addresses, employee names and credentials (FBI, Scammers Impersonating Law Enforcement and Government Officials). So a call that shows your bank's name and real number is not proof that your bank is calling. Frank's example in See it shows how that plays out.
The same applies to what a scammer knows. The FTC says government imposters may know your name or home address, and in IRS scams your Social Security number. Knowing details about you is not proof of who someone is. Details leak in data breaches, and some are public.
Good spelling and a familiar voice are not proof
People used to spot scam messages by their spelling. The FBI says criminals now use AI tools to fix the grammar and spelling errors that once gave them away, and to make fake profile photos, fake IDs and fake video calls (FBI, Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud). Voice cloning is using software to make a recording that sounds like a real person, built from a short sample of their voice. The FBI says criminals make short audio clips in a loved one's voice to ask for money in a crisis. The FTC says a scammer needs "a short audio clip" and a voice-cloning program, and that the clip may come from something posted online (FTC, Scammers use AI to enhance their family emergency schemes). The FTC gives no number of seconds.
So clean writing, a professional logo and a voice you recognize tell you nothing either way. The four signs and the call-back habit still work, because they test the request, not the polish. Checking what you read covers fake photos and videos in more depth.
The four signs describe how scams usually work. A scam can show none of them, and a real bank does sometimes call about real fraud. This manual's rule for both cases is the same: hang up and call back at a number you already have. We do not say whether any particular call, text or email is a scam. The organization, reached at a number you looked up yourself, can tell you.
2. The call-back habit
The call-back habit is our name for one rule that works whatever the story: when someone contacts you and asks for money, information, a code or access, you stop, end the contact, and reach the organization yourself at a number you already have. The FTC, the SSA and the FBI each give this advice in their own words (FTC, How To Avoid a Scam; SSA; FBI generative AI announcement). Our convention
It works because it moves the conversation to a line the scammer does not control. If the call was real, the organization has a record of the problem and you lose a few minutes. If it was not, the scammer loses you.
The hang-up line
Hanging up on someone who sounds official feels rude. A sentence ready in advance makes it easier. Ours is:
"I'll call you back at the number I have."
Then hang up. You do not need to explain, argue or wait for permission. The FBI says impersonators often try to keep you on the phone for the whole scam and tell you not to talk to family or your bank (FBI, September 17, 2026). A caller who will not let you hang up, or who says the problem gets worse if you do, has shown you the third sign. Our convention
Say the line out loud once now, even alone. Saying it once makes it easier to say under pressure. The same works for a text or an email: do not reply, and do not tap a link. For a pop-up on a computer, close the browser window. If it will not close, turn the computer off.
Numbers you already have
"A number you already have" means a number you got before the call, from a source the scammer did not give you:
- the back of your bank card or credit card;
- a paper statement or bill;
- the organization's website, with the address typed in yourself or opened from a bookmark you made earlier.
It does not mean the number in the text, the email, the pop-up or the voicemail, or the number the caller reads to you. It also does not mean a number from a search result you have not checked: the FTC says tech support scammers get their sites into search results and run their own ads (FTC, How To Spot, Avoid, and Report Tech Support Scams). Checking what you read shows how to tell an ad from a result.
The numbers sheet holds these numbers in this browser, and the check card holds them on paper by the phone. Copying them now, while nothing is wrong, means you are not searching for a number while someone is pressing you. The sheet has a column for where each number came from. That column is the point: a number is only as good as its source.
If you call back from the same phone, wait a minute first, or use a different phone if you have one. Our reason is simple caution: you want to be sure the first call has ended before you dial. Our convention
No real caller asks for your code
The sign-in codes from Two-step sign-in and passkeys are the other thing scammers want. The FTC says that no caller, including your bank's fraud department, will ask for your verification code, and calls that request "always a scam" (FTC, Got a call about fraud activity on your bank account?, July 8, 2024). Google says it does not ask for your password or codes by email, phone call or message (Getting back in). A code that arrives on your phone while someone on the line asks for it most likely means that person is trying to sign in to your account. Read it to no one. The same goes for a prompt that asks you to approve a sign-in you did not start. Our convention
Moving money to "protect" it
One story deserves its own rule. The caller says your account has been hacked, or your identity is tied to a crime, and the only way to protect your savings is to move them: to a "safe account," a "secure holding account," a "federal safety locker," into gold, or into cash for a courier to collect. The FTC's March 2024 alert has the rule in its title: "Never move your money to 'protect it.' That's a scam" (FTC, March 5, 2024). The FTC's reporting site says the FTC will never tell you to transfer money to protect it, withdraw cash or buy gold (ReportFraud.ftc.gov), and SSA lists moving money to a "protected" account as a red flag.
The FTC also warns that bank accounts have "different (and fewer)" protections than credit cards, and that if a scammer talks you into moving the money yourself, you won't be protected and probably won't get it back (FTC, July 8, 2024). That is why the rule comes before the money moves. When something goes wrong covers what to do and whom to ask if it already has.
A family code word
A family code word is a word or phrase agreed in advance among the people who might call each other in an emergency, so that a caller can prove who they are. The FBI's first tip in its AI fraud warning is "Create a secret word or phrase with your family to verify their identity" (FBI, December 3, 2024). The FTC suggests asking a question only the real person would know, and calling the person back at a number you know (FTC, Scammers Use Fake Emergencies To Steal Your Money).
How we suggest choosing and keeping one: Our convention
- Pick a word or short phrase that is not posted anywhere: not a pet's name you have shared online, not a street name, not a team.
- Agree on it in person, or on a call you placed to a number you know.
- Tell the people who might call you for help, and the people you might call.
- Do not write the word on the numbers sheet, in a text, in an email or on social media. The sheet has a field for who knows it, so you remember whom you told.
- If you think it has been shared beyond those people, choose a new one.
The code word is a second check, not the first one. If the caller does not know it, or the line goes quiet when you ask, hang up and call the person at their own number. If you can't reach them, the FTC suggests calling another family member or a friend of theirs.
3. The common scams, by the story they tell
This section walks through the stories you are most likely to meet, with the tell for each and what the agencies say to do. The scam types table has every type in one place, filterable by how the scam reaches you (call, text, email, pop-up, online), with where to report each. Use the table to look one up later. Read this section once now.
In every one, the four signs and the call-back habit are the response.
Government imposters
The caller says they are from the IRS, Social Security, Medicare, the FBI, the police, the courts or another agency. The story is often an accusation: your Social Security number is tied to a crime, you missed jury duty, there is a warrant. The FBI describes threats of arrest, prosecution or fines unless you pay, and fake officials on video calls (FBI, September 17, 2026).
What the agencies say about themselves:
- The IRS contacts you by mail if you owe taxes. Social Security will not threaten you or call to demand payment (FTC, How To Avoid a Government Impersonation Scam).
- SSA's July 29, 2026 alert says other companies and agencies have no way to transfer your phone call directly to SSA or its inspector general. A caller who offers to "transfer you to Social Security" is not doing that (SSA).
- SSA lists, among its red flags, threats to suspend your Social Security number, requests to "activate" a cost-of-living increase, demands for secrecy, and photos of badges (SSA).
- The FBI says law enforcement and government authorities do not call or text to demand any form of payment, and tells you to check web addresses: a scam site may end in .com where the real one ends in .gov (FBI, September 17, 2026).
What to do: hang up, then call the agency at a number you look up yourself. The FTC suggests checking your IRS online account if the call was about taxes. SSA's inspector general takes reports of Social Security imposters at oig.ssa.gov.
Bank and business imposters
The caller or text says it is your bank's fraud department, a card company, Amazon or another business you use. There is suspicious activity, a large charge, a locked account. The fix involves reading out a code, approving a sign-in, "confirming" your card number, or moving money. The FTC says bank impersonators led the business imposters people reported in 2025.
The rules from the call-back habit cover this one completely: no real caller asks for your code; never move money to protect it; hang up and call the number on your card or statement. If the bank really did spot fraud, the number on your card reaches the same fraud department. Ask your bank
Tech support and the "phantom hacker"
A warning fills the computer screen. It may be red, flash, beep and carry a Microsoft or Apple logo. It says the computer is infected or hacked and gives a number to call. Or a caller says they are from a tech company and have detected a problem. Either way, the person on the line asks you to install a program so they can connect to your computer. Remote access means someone else controlling your computer over the internet: they see your screen and can move the mouse and type.
The FTC says real security pop-ups never ask you to call a number, and legitimate tech companies do not call, email or text you about problems with your computer (FTC, How To Spot, Avoid, and Report Tech Support Scams). The FBI's tips say not to call a number in a pop-up, not to download software for someone who contacted you, and not to let them control your computer (FBI, "Phantom Hacker" Scams, September 29, 2023).
The FBI calls the longer version the phantom hacker scam, and describes it in three phases:
- The tech support imposter. A pop-up, call, text or email leads you to call a number. The scammer connects to the computer, runs a fake scan and asks you to open your bank accounts "to check for unauthorized charges." That shows them which account has the most money.
- The bank imposter. A second call, from someone who says they are your bank's fraud department, says a foreign hacker got into your accounts and you must move your money to a "safe" account, sometimes said to be at the Federal Reserve.
- The government imposter. A third caller, sometimes with a letter on what looks like government letterhead, says your money is still unsafe and must move again.
Each call makes the last one seem more real. Knowing the pattern lets you recognize the second call as the second step of the first. The Harmons' example in See it stops at the second call. The FTC describes the same handoff to a fake official, and says a "federal safety locker" is not a real thing.
What to do: close the window or turn the computer off, and do not call the number. If you already let someone connect, When something goes wrong has the steps, starting with disconnecting the computer from the internet. Your computer and home Wi-Fi covers the computer's own built-in protection, which does not need a phone number.
Family emergencies and cloned voices
The phone rings and a voice you seem to know says, "It's me," and that they are in trouble: an accident, an arrest, a hospital, stranded abroad. Often a second person takes over, a "lawyer," "police officer" or "doctor," and explains the bail or the fee. They ask you to keep it secret, and to pay by wire, cryptocurrency, payment app or gift card (FTC, Scammers Use Fake Emergencies To Steal Your Money). The FBI also describes couriers sent to a home to collect the cash in person, in grandparent scams among others (FBI, Scammers Use Couriers to Collect Cash, June 15, 2026).
The FTC's advice is "Don't trust the voice." Hang up or say you will call back, and call the person at a number you know is theirs. If you can't reach them, call another family member or their friends (FTC, March 20, 2023). The code word gives you a faster check. Grace's example in See it shows the call-back working without anyone ever knowing whether the voice was cloned.
Romance scams
Someone you met online, on a dating app, social media or a game, becomes a close friend or a partner over weeks or months. They move the conversation off the app quickly. They say they can't meet in person: they are working abroad, on an oil rig, in the military or with an international organization. Then they need money, for a medical bill, a plane ticket, a visa fee, or they offer to help you "get started" in cryptocurrency (FTC, What To Know About Romance Scams). The FBI calls the fast flood of attention and praise "love bombing."
The FTC's rule: "Never send money or gifts to a sweetheart you haven't met in person." The FBI gives the same advice more broadly: do not send money, gift cards or cryptocurrency to people you have met only online or by phone. The FTC suggests talking to someone you trust, searching the person's stated job with the word "scammer," and running a reverse image search on their photo (Checking what you read shows how).
Investment and cryptocurrency offers
An offer to make money: a trading platform, a cryptocurrency "opportunity," a tip from a new online friend, a video of a famous investor recommending a platform. The FTC says promises of guaranteed profits are a sign of a scam, warns against mixing online dating with investment advice, and describes fake platforms that show growing balances and then block withdrawals or charge fees to withdraw (FTC, What To Know About Cryptocurrency and Scams). Fake celebrity endorsements are common. Investment scams had the largest reported losses of any type in 2025 at both the FTC and the FBI's Internet Crime Complaint Center (IC3).
The FBI suggests searching more than the platform's name before investing: search its web address and any details on its pages, and look for reviews or forums that call it a scam (FBI, June 15, 2026). Whether an investment suits you is a financial question for a licensed adviser you chose yourself; we give no investment advice. Ask a licensed adviser
Crypto kiosks and cash couriers in detail
The FBI reported more than 13,400 complaints in 2025 that involved cryptocurrency kiosks, with losses over $388 million, a 23 percent rise in complaints and 58 percent in losses from 2024. The FBI notes that those losses may include other payment types in the same complaints (FBI, May 15, 2026). Its tips: do not follow instructions from someone you have never met to scan a QR code and pay at a kiosk; if the kiosk company calls to say your payment looks like fraud, stop or cancel; keep every receipt; and report to local police and IC3 with the transaction ID, the wallet address and the kiosk's location.
The courier version works like this, as the FBI describes it: after someone has "invested" on a fake platform, they are told a bank transfer was flagged and cash must be picked up instead. The scammer gives a code, sometimes the serial number of a dollar bill, and a courier who shows it collects the cash at the door or in a public place. The platform then shows a matching "deposit." When the person tries to withdraw, they are told to pay "taxes and penalties," again in cash (FBI, June 15, 2026). The FBI's tip is not to give your address to, or agree to meet, a stranger to hand over cash or valuables.
Texts about tolls, deliveries and "wrong numbers"
Smishing is phishing by text message: a text that tries to get you to tap a link, reply or call. The FTC lists the common ones: fake fraud alerts from a bank or Amazon, a delivery problem with a "re-delivery fee," an unpaid toll, a job offer, and a "wrong number" text that turns into a friendly conversation (FTC, Is that unexpected text a scam?, April 16, 2025). The toll text's link may also ask for personal information such as your driver's license number (FTC, Got a text about unpaid tolls? It's probably a scam, January 17, 2025).
What the FTC says to do: do not reply and do not tap the link. Check with the company or toll agency at a number or site you know. Use your messaging app's report junk option, or forward the text to 7726 (the letters SPAM on a phone keypad), then delete it. A "wrong number" text is safest left unanswered. Ruth's example in See it walks through a toll text.
Phishing emails
Phishing is a message, usually an email, that pretends to come from a company you know to get you to click a link, open an attachment or type in a password or card number. The FTC lists the usual stories: suspicious sign-in activity, an account on hold, a payment problem, an invoice you do not recognize, a request to confirm your details, a government refund, a free coupon (FTC, How To Recognize and Avoid Phishing Scams). It says legitimate companies won't email or text a link to update your payment information.
The FTC's first question is a good one: do I have an account with this sender? If not, delete the message. If so, go to the company the usual way, by typing its address or opening its app, not through the link. The password manager from Passwords helps here too: it fills a password only on the real site. To report a phishing email, forward it to reportphishing@apwg.org, an anti-phishing group the FTC names, and report it at ReportFraud.ftc.gov.
Prizes, fake checks, jobs and tasks
- Prizes. Real sweepstakes are free and decided by chance. Being asked to pay "taxes," "shipping and handling" or a fee to collect means a scam. As the FTC puts it, "If you have to pay to get the prize, it's not a prize" (FTC, Phone Scams; FTC, Fake Prize, Sweepstakes, and Lottery Scams).
- Fake checks. Someone sends a check, for a prize, a job or an overpayment, and asks you to send part of it back. A bank must make deposited money available quickly, but a fake check can take weeks to discover, and then you repay the bank. The FTC says the money showing in your account does not mean the check is good, and not to use money from a check to buy gift cards or crypto or to wire money (FTC, How To Spot, Avoid, and Report Fake Check Scams).
- Jobs. The FTC says a job reshipping packages is not a real job, and that honest employers do not ask you to pay to get a job (FTC, Job Scams).
- Tasks. A task scam is a "job" of rating products or "boosting" apps online that pays a small amount at first and then asks you to deposit money, usually cryptocurrency, to unlock your earnings. Never pay to get paid (FTC, How to spot and avoid task scams, August 14, 2025).
Task scams step by step, and gift card refunds
The FTC's August 2025 alert describes the task scam's pattern. The first message is unexpected, on WhatsApp, Telegram, a text or social media. The work is called "optimization" or "product boosting." The early payouts are small, usually $5 to $20, and real enough to build trust. Then the app says you must deposit money, usually cryptocurrency, to unlock a bigger balance or the next set of tasks. The FTC also says not to trust anyone who offers to pay you to rate or like things online.
If you already paid with a gift card, the FTC says to contact the card's issuer right away, no matter how long ago it happened, ask for a refund, keep the card and the receipt, and report to the FTC (FTC, Avoiding and Reporting Gift Card Scams). The FTC's page lists issuers' phone numbers. Use the number printed on the back of the card or on the issuer's own website, typed in yourself, and check it against the FTC's list. The page's tells are worth knowing too: the caller says which card and which store, sends you to several stores, stays on the line while you buy, and asks for the card number and PIN or a photo of the card.
4. Filtering junk calls and texts, and reporting them
The FTC's advice includes blocking unwanted calls and filtering texts (FTC, How To Avoid a Scam). Your phone has both built in. Junk filtering means letting the phone set aside calls and texts from numbers you have not saved, or that the phone company flags as likely spam, so they do not ring or show up with your other messages. It cuts down how often a scammer reaches you. It does not decide what is a scam, and some real calls will be filtered too, so check the filtered folder or voicemail now and then. Product-specific
Our default: turn on the spam filters on both calls and texts, and screen unknown callers if your phone offers it, so a real caller can still reach you after saying who they are. If calls you need, such as a doctor's office, start going to voicemail, check voicemail daily or save those numbers as contacts. Preference
iPhone and iPad
Texts from unknown senders (iPhone, iOS 27; iPad uses the same steps for this part):
- Open the Messages app.
- In the conversation list, tap the menu button at the top of the screen.
- Tap Manage Filtering.
- Turn on Screen Unknown Senders.
- Optional: tap Allow Notifications and turn on the kinds you want to see right away, such as verification codes.
In short: Messages > menu button > Manage Filtering > Screen Unknown Senders.
Texts from senders you have not saved then go to a separate Unknown Senders folder, with no notification. Apple's guide notes that filtering does not apply to a sender you have replied to three or more times, so block or report those (Apple, Screen and filter text messages on iPhone; for iPad, Apple, Screen and filter texts on iPad). To move a real sender out of the folder, open the message and tap Mark as Known, or add them to Contacts.
Calls from unknown and spam numbers:
- Open the Settings app.
- Tap Apps.
- Tap Phone.
- Under screening unknown numbers, choose Ask Reason for Calling. The iPhone answers, asks the caller's name and reason, then rings and shows you the answer. (The other two choices: Silence sends unsaved numbers straight to voicemail, and the first choice in the list turns screening off.)
- On the same screen, turn on Spam. Calls your phone company identifies as potential spam or fraud are silenced, sent to voicemail and moved to a Spam list.
In short: Settings > Apps > Phone > Ask Reason for Calling; Spam on.
These are the iOS 27 names (Apple, Screen and block calls on iPhone). Older guides say "Settings > Phone > Silence Unknown Callers," which was the single switch before. If your screen shows that switch, your iPhone is on an older version; Your phone and tablet covers updating it. To block one number: in the Phone app, open Recents, tap the number, then tap Block Caller.
Android phone
These steps are for Google's Phone and Messages apps, which Pixel phones use. Other makers' apps and menus differ; Samsung's own apps have their own settings. Product-specific
Calls:
- Open the Phone app.
- Tap More options (three dots), then tap Settings.
- Tap Caller ID and spam.
- Check that See caller ID & spam is on. It is on by default.
- Optional: turn on Filter spam calls, so spam calls do not ring. They still appear in your call history.
In short: Phone > More options > Settings > Caller ID and spam.
Google notes that phones with automatic Call Screen have no Filter spam calls switch; blocking spam is one of the Call Screen options instead (Google, Use caller ID & spam protection). If a call shows "Suspected spam caller" or "Spam," the call might be spam. To report one: in the Phone app, tap the call, then tap Block or Report spam.
Texts:
- Open the Messages app.
- At the top right, tap your profile picture or initials.
- Tap Messages settings.
- Tap Protection & Safety.
- Tap Spam protection, and check that Enable spam protection is on.
In short: Messages > profile picture > Messages settings > Protection & Safety > Spam protection.
Google says the setting appears only where the device supports it (Google, How Google protects your privacy with spam detection). When a message carries a spam or scam warning, tap Report spam. Reporting also blocks the sender and moves the conversation to Spam & blocked.
Windows, Mac and Chromebook
Computers do not get phone calls or texts in the usual way, so there is no junk call setting to turn on here. On a computer, the scam usually arrives as a pop-up or an email. The rules are the ones above: a real security warning does not give you a number to call, and an email link is not the way to your bank. Your computer and home Wi-Fi covers the computer's built-in protection. If your email app has a report spam or report phishing option, use it on phishing messages. Product-specific
Reporting
Reporting a scam you did not lose money to is optional and takes a minute. It helps the agencies and phone companies see patterns. The FTC shares reports with more than 2,000 law enforcers, and says it can't resolve individual reports (ReportFraud.ftc.gov).
- A scam text: forward it to 7726, or use your app's report option, then delete it (FTC, How to Recognize and Report Spam Text Messages).
- A phishing email: forward it to reportphishing@apwg.org.
- Any scam call, text or email: report it at ReportFraud.ftc.gov, the FTC's reporting site, or by phone at 1-877-382-4357.
- A scam that happened online, especially one that took money: the FBI's Internet Crime Complaint Center (ic3.gov).
If money or information has already left your hands, reporting is not the first step. The first call is to your bank or card company at the number on the card. The quick start and When something goes wrong have the order.
5. Scams can happen to anyone
AARP's Fraud Watch Network says "Scams can happen to anyone" (AARP Fraud Watch Network). The FTC says scammers succeed when people are distracted or stressed, and that the only person at fault is the scammer (FTC, If someone you care about paid a scammer). SSA's page says "Criminal behavior is not your fault."
This matters for two practical reasons. The FDIC and CFPB's Money Smart guide names embarrassment and shame as reasons people do not report, and speed matters when money has moved (When something goes wrong). And the call-back habit only works if it is used every time, including on the days you feel sure. It is for everyone, including the person who sets up the family's phones.
Talking with someone who was targeted
If someone tells you about a scam call, or about money they sent, the FTC suggests four things: lead with kindness and concern, not criticism; let them tell the story their way; tell them the scammer is at fault; and work out the next steps together, such as whether personal information was involved and whether they want to report (FTC, April 10, 2024). The FTC notes that telling the story takes courage. When something goes wrong has more on helping after a loss.
Free help to check a message
If you are not sure about a call, text or email and want to talk it through, the AARP Fraud Watch Network Helpline takes calls at 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. Eastern time. You can call to report a scam, to get help deciding whether something is a scam, or after you or someone you know was scammed. The helpline says it offers guidance and support, "not investigation or case recovery." Its page offers translation on the call. For the organization a message claims to be from, the call-back habit is still the check: only that organization, at a number you looked up, can tell you whether the message is theirs.
The size of the problem, and what each figure counts
You will see large totals for what scams cost. Each comes from a count of reports to one agency, and the counts are not the same thing.
| Figure | Who counted | What it counts |
|---|---|---|
| $20.877 billion; 1,008,597 complaints | FBI Internet Crime Complaint Center, 2025 annual report | Losses people reported to IC3 for internet-enabled crime in calendar 2025. The report calls its statistics "an assessment taken at a point in time," and each complaint is filed under one crime type. |
| $15.9 billion; 3 million fraud reports | FTC, Consumer Sentinel, in testimony to Congress on March 25, 2026 | Losses people reported to the FTC and its data partners for fraud in 2025, of any kind, online or not. |
| $31.3 billion to $195.9 billion | FTC estimate for 2024, in its December 2025 report to Congress | An adjusted estimate of all fraud losses, reported or not, under two methods. The FTC says these carry "considerable" uncertainty. |
Each of the first two counts only what was reported to that agency, and neither report says how many losses appear in both, so we do not add them. Most fraud goes unreported: the FTC's December 2025 report cites one study in which only 4.8 percent of fraud victims reported to a government agency or the Better Business Bureau. The real total is larger than any reported figure, by an amount no one knows. Sources: FBI, 2025 IC3 Annual Report (PDF); FTC, prepared statement to the Joint Economic Committee (PDF); FTC, December 2025 report to Congress (PDF).
Two other figures from the same reports describe the kinds of loss this chapter teaches against. The FBI's recovery team froze $679 million of $1.164 billion in attempted theft in cases reported in time, a 58 percent success rate (IC3, 2025). Both agencies list investment scams as the largest reported loss for 2025. The FTC's Consumer Sentinel Data Book for 2025 was not yet published when we checked on 2026-10-19; this table will be updated when it is.
6. See it See it
Four fictional examples, one for each common way a scam arrives. Names, places, banks, numbers and messages are invented. The platforms (iPhone, Gmail, Windows, Zelle) are real because the steps are real.
Ruth's toll text. Ruth Alvarez, who has an iPhone 13 and a Gmail address and lives in Tucson, gets a text one Tuesday morning. It says she has an unpaid toll, a late fee will be added after today, and she can pay at a link. The sender is a number she does not have saved.
Known: the text names a toll agency, says there is a problem, sets a deadline of today, and asks for payment through a link. That is all four signs. Ruth does not remember owing a toll.
Assumed: Ruth assumes the text is not from the agency, because of the four signs. That is an assumption until she checks.
Open: what the text wants, and whether she owes anything. Only the toll agency, reached at a number on its own site, can settle that.
Ruth does not tap the link or reply. She forwards the text to 7726 and deletes it. On her phone she searches for the toll agency's name, skips the results marked Sponsored, opens the agency's own site and calls the number listed there. The agency tells her there is no unpaid toll in her name (fictional). Then, with her granddaughter Maya on speakerphone, she turns on Screen Unknown Senders in Messages and Ask Reason for Calling and Spam under Settings > Apps > Phone. Under these assumptions the text was a scam; the agency's answer is what settled it, not the four signs.
Grace's call and the code word. Grace Okafor lives alone, has an iPad and an iCloud address, and sets things up with her daughter Denise on Saturdays. One afternoon her phone rings. A young man's voice says "Grandma, it's me," that he is in jail after a car accident, and that he is embarrassed. A man who says he is a lawyer takes the phone: bail is set, it must be paid today in gift cards, and Grace is not to tell the family.
Known: the caller claimed to be a relative, described an emergency, pressed for payment today, asked for gift cards and asked for secrecy.
Assumed: Denise assumes the number the family has for Grace's grandson is current. That is her assumption, and it holds when he answers.
Open: whether the voice was cloned. There is no way to know, and it does not matter: the call-back settled the question either way.
Grace says, "I'll call you back," and hangs up. She calls Denise first, as they agreed. Denise calls Grace's grandson at the number the family has for him. He is at work and fine (fictional). That Saturday, Grace, Denise and Denise's brother Tom agree on a code word in person. On Grace's numbers sheet, the code word field reads "Grace, Denise, Tom." The word itself is written nowhere. They also turn on Screen Unknown Senders in Messages on Grace's iPad.
The Harmons' pop-up. Walt and June Harmon share a Windows 10 laptop and one AOL address. A red warning fills the laptop screen, says the computer is infected, and gives a number for "Microsoft Support." Walt calls. The man asks him to install a program and connects to the laptop. He shows Walt a scan full of warnings and sells him a $299 "security plan," paid by credit card. A day later a second call says the Harmons' bank accounts are at risk and they need to move their savings to "a protected account." June hangs up.
Known: the pop-up gave a number to call, which real security warnings do not do. The man connected to the laptop and took a card payment. The second call asked them to move savings to protect them. That is the second phase of the FBI's phantom hacker pattern.
Assumed: the Harmons assume the second call came from the same people as the first. The pattern matches; they have no way to confirm it.
Open: whether the remote session installed anything. That is settled by a full scan with Windows Security and, if they are unsure, a trusted repair shop (When something goes wrong).
The scammer built the pop-up to look like Microsoft and to create panic, and the second call was built on the first. June's hang-up came from the payment rule: moving money to protect it is a scam. Walt calls the card company that day at the number on the back of the card and reports the $299. The card company reverses it (fictional). They run Windows Security, change the AOL password from June's iPad, and turn on two-step sign-in. Nothing else is lost.
Frank's bank call. Frank Tran, who has an iPhone, a MacBook and an account at Golden Valley Bank, gets a call that shows Golden Valley Bank's real name and number. The caller says his account has been hacked and walks him through sending $2,400 by Zelle to "a secure holding account" to protect it. The next morning the "fraud department" calls back and asks for more. Frank hangs up and calls the number on the back of his bank card.
Known: the caller ID showed the bank's real number, which can be spoofed. The caller asked him to move money to protect it. Frank sent the payment himself, using his own banking app. The bank tells him that, because he sent it himself, it is reviewing the payment as a scam claim rather than an unauthorized transfer.
Assumed: on the first call, Frank assumed the caller was his bank because the caller ID showed its number. That is the assumption the scammer built the call on.
Open: whether the bank returns the $2,400, which the bank settles (When something goes wrong); and whether the caller had his details from a data breach, which is unknown and does not change the steps.
The scammer's script used the bank's real number and the word "protect" so that sending money felt like the safe choice. The second call was the scammer's mistake: it gave Frank a moment to call his bank himself. Frank reports at ReportFraud.ftc.gov and ic3.gov, turns on Verizon Number Lock (Two-step sign-in and passkeys) and freezes his credit (Money and identity). This manual does not predict whether the money comes back.
Free pages that show each scam in the agencies' own words:
- FTC, How To Avoid a Scam: the four signs and what to do, on one page.
- FBI, "Phantom Hacker" Scams: the three-phase scam the Harmons met part of.
- FTC, Scammers Use Fake Emergencies To Steal Your Money: the family emergency call and how to check it.
- Scam types table (this manual): every type with its tell and where to report it.
7. Practice Practice
Minimum: three numbers copied from your own cards and bills onto the numbers sheet, a code word agreed with one person and their name written down, the hang-up line said aloud once, and junk filtering on. Time: about 30 minutes. Materials: your bank card, your credit card, a recent bill from your phone company (paper or the company's site typed in yourself), your phone, the numbers sheet, and the check card printed, if you have a printer. The numbers sheet is essential on a first pass.
- Open the numbers sheet. The bank, card and phone company rows are there and blank on purpose.
- Turn your bank card over. Find the customer service number on the back. Type it in the bank row, and under "Where I got it" choose Back of my card.
- Do the same for your credit card. If you have more than one, add a row for each card you use.
- Find your phone company's number on a paper bill, or on its website with the address typed in yourself. Type it in the phone company row and choose where you got it.
- Copy the three numbers onto the check card, if you printed it, and keep it by the phone or in your wallet.
- Choose a code word with one person. Agree on it in person or on a call you placed. Then open the code word field on the numbers sheet and write who knows it. Do not write the word.
- Say the hang-up line out loud: "I'll call you back at the number I have."
- Turn on junk filtering on your phone, using the steps for your device in filtering junk calls and texts, or the steps in the box under Your setup.
- Open the scam types table once and read the rows for the scams that reach you most, by call, text or email (scam types table).
Practice the hang-up with someone you trust. Ask them to call you and play a "bank fraud department" or a "grandchild in trouble," with pressure. Say the hang-up line, end the call, and dial the number from your numbers sheet. Then switch roles. It takes ten minutes and makes the real moment easier. Then tell the other people who might call you in an emergency about the code word, and add their names to the code word field.
8. Your setup Your setup
The box below reads your devices, money accounts and whose setup this is. It shows the junk filtering steps for your phone and which scam types to read first.
9. Check your work Check your work
Criteria
- Can you name the four signs without looking, and the payment methods that mean a scam?
- Does the numbers sheet list your bank, card and phone company numbers, each copied from a card, a statement or a site you typed in yourself, with the source marked?
- Does the code word field say who knows the word, and is the word itself written nowhere?
- Have you said the hang-up line out loud at least once?
- Is junk filtering on for both calls and texts on your phone?
Worked example
Ruth's numbers sheet (fictional) has three rows: Saguaro Federal Credit Union, from her monthly statement; her credit card company, from the back of the card; and her phone company, from her paper bill. Each has its source marked. The code word field reads "Maya." Her filtering is on, and she checked it with Maya on the phone. That meets the criteria. It does not mean Ruth will recognize every scam. It means that when the next call or text comes, she has the numbers to check it against, and a person who can prove who she is.
Common mistakes
- Copying a number from a text, an email or a search ad. The source column on the sheet is the check. Every number should come from a card, a statement or a site you typed in.
- Writing the code word down. The sheet and its printout list your accounts. Keep the word in your head and with the people who know it.
- Calling the number the caller gives you. The number on the card is the only call-back number that counts.
- Treating a familiar voice, a real caller ID or perfect spelling as proof. Each can be faked.
- Waiting to report until you are sure. If money moved, call the bank first and sort out the details later (When something goes wrong).
- Blaming yourself or someone else. The scammer is at fault, and shame slows down the calls that matter.
What is still unresolved
This chapter does not settle whether any particular message is a scam. The organization it claims to be from settles that, at a number you looked up yourself. It does not settle whether money already sent comes back; the bank or card company decides, and When something goes wrong covers what to ask. It does not cover checking a surprising post, ad, photo or video before you share or act on it; Checking what you read does. And it does not freeze your credit or set bank alerts; Money and identity does.