Good rule of thumb – assume it’s a scam. Anyone who contacts you, or any unusual encounter, assume it’s a scam and you will probably be right. Recently I was called on my cell phone by someone claiming to be from Venmo. They asked me to confirm if I had just made two fund transfers from my Venmo account, both in the several hundred dollar range. I had not. OK, they said, these were suspicious withdrawals and if I did not make them then someone has hacked my account. They then transferred me to someone from the bank that my Venmo account is linked to.

I instantly knew this was a scam for several reasons, but even just the overall tone and feel of the exchange had my spidey senses tingling. The person was just a bit too helpful and friendly. They reassured me multiple times that they will not ask for any personal identifying information. And there was the constant and building pressure that I needed to act immediately to secure my account, but not to worry, they would walk me through what I needed to do. I played along, to learn what the scam was. At what point was the sting coming?

Meanwhile, I went directly to my bank account on a separate device and could see there were no such withdrawals. When I pointed this out they said that was because the transactions were still pending (but I could stop them if I acted fast). Of course, my account would show pending transactions. When I pointed this out I got a complicated answer that didn’t quite make sense. They gave me a report number that would identify this event, and I could use that number when they transferred me to someone allegedly from my bank to get further details. Again, I was reassured that they would not ask me for any identifying information. It all sounded very official. The bank person confirmed (even though it still did not appear on my account) that there was an attempt to withdraw funds and sent me back to the Venmo person who would walk be through the remedy.

What I needed to do was open my Venmo account. Then I needed to hit the send button in order to send a report to Venmo. Ding, ding ding!. That was the sting. They wanted me to send money from my Venmo account to whatever account they tricked me into entering. “You mean the button that says ‘send money’, that’s the button you want me to press?” Yes, because that would “send” a report to their fraud department to resolve the issue. I know, it sounds stupid, but it only has to work a fraction of the time. I certainly have elderly and not tech savvy relatives who I could see falling for this. At this point I confronted the person with the fact that they were trying to scam me, but they remained friendly and did not drop the act, so eventually I just hung up.

Digital scammers like this are growing, and getting more sophisticated. By now you may have heard about the financial advice columnist who was scammed out of $50,000. Hearing the whole story at the end, knowing where it is all leading, does make it seem obvious. But you have to understand the panic that someone can feel when confronted with the possibility that their identify has been stolen or their life savings are at risk. That panic is then soothed by a comforting voice who will help you through this crisis. The FBI documented $10.2 billion in online fraud in 2022. This is big business.

We are now living in a world where everyone needs to know how to defend themselves from such scams. First, don’t assume you have to be stupid to fall for a scam. Con artists want you to think that – a false sense of security or invulnerability plays into their hands.

There are many articles detailing good internet hygiene to protect yourself, but frequent reminders are helpful, so here is my list. As I said up top – assume it’s a scam. Whenever anyone contacts me I assume it’s a scam until proven otherwise. That also means – do not call that number, do not click that link, do not give any information, do not do anything that someone who contacted you (by phone, text, e-mail, or even snail mail) asks you to do. In many cases you can just assume it’s a scam and comfortably ignore it. But if you have any doubt, then independently look up a contact number for the relevant institution and call them directly.

Do not be disarmed by a friendly voice. The primary vulnerability of your digital life is not some sophisticated computer hack, but a social hack – someone manipulating you, trying to get you to act impulsively or out of fear. They also know how to make people feel socially uncomfortable. If you push back, they will make it seem like you are being unreasonable, rude, or stupid for doing so. They will push whatever social and psychological buttons they can. This means you have to be prepared, you have to be armed with a defense against this manipulation. Perhaps the best defense is simply protocol. If you don’t want to be rude, then just say, “Sorry, I can’t do that.” Take the basic information and contact the relevant institution directly. Or – just hang up. Remember, they are trying to scam you. You own them nothing. Even if they are legit, it’s their fault for breaking protocol – they should not be asking you to do something risky.

When in doubt, ask someone you know. Don’t be pressured by the alleged need to act fast. Don’t be pressured into not telling anyone or contacting them directly. Always ask yourself – is there any possible way this could be a scam. If there is, then it’s probably is a scam.

It’s also important to know that anything can be spoofed. A scammer can make it seem like the call is coming from a legit organization, or someone you know. Now, with AI, it’s possible to fake someone’s voice. Standard protocol should always be, take the information, hang up, look up the number independently and contact them directly. Just assume, if they contacted you, it’s a scam. Nothing should reassure you that it isn’t.