Scam prevention is usually taught as a catalogue: the grandparent scam, the romance scam, the tech support scam, the job scam. Catalogues go stale. The structure underneath does not.
Almost every scam needs three things to work: contact you did not initiate, manufactured urgency, and a payment method that cannot be reversed. If your household learns to recognize that shape, the specific story does not matter.
The four rules worth memorizing
1. Nobody legitimate needs the money in the next ten minutes. Urgency is the tool that stops people thinking. Government agencies, banks, utilities and police do not demand immediate payment over the phone or threaten arrest.
2. Nobody legitimate asks for gift cards, wire transfers, crypto or a payment app. These are the irreversible channels. A request for any of them is the strongest single signal you are talking to a criminal.
3. Verify by calling back on a number you find yourself. Not the number in the message, not the number the caller gives. Look it up on the card, the statement, or the official website. Caller ID can be faked, and so can a voice.
4. Do not install software or grant screen access to someone who contacted you. That is the mechanism behind tech support and "bank security" scams: once they can see your screen, they watch you log in.
Make rule three a household norm rather than an individual skill. "I always hang up and call back, it is a family rule" is a socially easy way for anyone to exit a manipulative call without feeling rude.
What targets teenagers
Younger family members are targeted through the platforms they use rather than by phone:
- Fake job and money-mule offers promising payment for processing transfers or reshipping packages, which is a criminal offense even when the person did not understand the scheme.
- Marketplace and ticket scams, particularly for concerts and sneakers, that push payment off-platform to an app with no buyer protection.
- Gaming scams offering free currency or skins in exchange for account logins.
- Sextortion, where a stranger builds rapport, obtains an intimate image, and threatens to share it. This is the one that needs an explicit conversation.
The message for sextortion is specific and worth saying out loud: if this happens, you will not be in trouble at home, do not pay, stop replying, save the messages, and tell an adult. Paying does not end it. Reports can be made to the FBI at IC3.gov, and the NCMEC "Take It Down" service can help remove images of minors.
What targets older adults
- Impersonation calls claiming to be Social Security, Medicare, the IRS or a utility.
- Grandparent calls, now often using cloned audio, claiming an emergency and asking for secrecy.
- Tech support pop-ups warning of a virus and giving a number to call.
- Romance scams that build over months before money is requested, usually for travel or a medical emergency.
The counter is a shared plan agreed in advance, not vigilance in the moment. Consider a family code word for emergency calls, a standing agreement that any request for money gets a second opinion from a named relative, and bank alerts on large transfers. Some banks let a trusted contact be listed on an account for fraud concerns.
Household settings that reduce exposure
- Turn on automatic updates on phones, computers, routers and smart TVs.
- Use a password manager, and give every family member their own login.
- Turn on two-factor authentication everywhere, preferring an app over text messages.
- Enable spam and scam-call filtering with your mobile carrier, and register at DoNotCall.gov.
- Freeze the credit files of every adult in the household; it is free at each bureau.
- Check whether your state offers a free credit freeze for a child's file, which blocks the quietest form of family identity theft.
Talk about it before it happens
Scams work on isolation and shame. The single most protective thing a household can do is make it normal to say "I got a weird message, can you look at this?" without anyone being made to feel foolish.
If someone does lose money, act quickly: contact the bank or payment provider immediately, as some transfers can still be stopped; report at ReportFraud.ftc.gov; and report online crime at IC3.gov. If personal information was handed over, follow the steps in what to do after a data breach, and check for misuse using the signs in how to know if your identity has been stolen.
