Scam Field Guide

The call comes at 6:40 in the morning, which is deliberate. People woken early are not at their sharpest, and an early call already feels like bad news before anyone speaks.

The voice is crying and the connection is poor, which covers any imperfection in a cloned voice. It says just enough to be identified, then hands off quickly to a second speaker who is calm, procedural and in control. That handover is the engine of the whole thing: the grandchild supplies the emotion, the attorney supplies the instructions.

The instruction is always the same shape. A sum, a deadline, and a method of payment that cannot be reversed. Running underneath it is the request that does the real work: please do not tell Mom.

It opens with an accusation rather than a request, which is what separates it from an ordinary sales call. Your number has been linked to something: a vehicle found at a border, an account used for laundering, a warrant. The details vary and none of them matter.

What matters is the emotional position it puts you in. You are not being sold anything. You are being investigated, and the call offers you a way to cooperate. People who would hang up on a salesman stay on the line for an investigator.

The caller ID shows a real agency number, because displayed numbers are trivially forged. Then comes the part that makes no sense but is delivered with total confidence: the way to protect your money from the investigation is to move it, into gift cards, into cryptocurrency, into a "secure federal account."

The email said she owed $400 for an antivirus renewal. It worked because she really was a customer of that company, so the charge was not implausible and the sender was not a stranger. There was no link to click. There was a phone number, and she called it.

To process the refund, he said, he needed to see her screen. She downloaded the remote access tool he directed her to. It did what she expected. It also installed a keylogger she knew nothing about.

He sent her to a web form and had her type in the amount from the email, along with her name and her bank account number, and then press submit. That form was the first thing he actually needed. Everything after it was theater, staged to get the rest.

He told her the file had gone to her bank. Then he said he had spotted a problem: the figure had been entered as $40,000. He had added the two zeros himself. He told her she had made the mistake.

She asked him to correct it. Too late, he said, the bank already had it. But there was one thing she could still do. If she logged into her bank account herself, she could ask them to stop the transfer. So she logged in, while he was watching her screen and recording every key she pressed. Then he hung up.

Her bank called her a short time later to ask whether she was moving a large sum of money. The transfer was already in progress. The $40,000 was what she had saved to buy a house.

Almost everyone is expecting a parcel. That is the entire premise. The message does not need to be targeted, because at any given moment a large share of the people receiving it will have something in transit.

The amount is what makes it work. Forty cents is too small to be worth the effort of a scam, so it reads as a genuine administrative annoyance rather than a threat. Nobody researches forty cents. They pay it and move on.

The payment page is a faithful copy of the carrier's, and it asks for the card number, the expiry, the security code and the billing address, which is everything needed to use the card elsewhere or to pass a verification call at your bank.

It opens as an obvious mistake. A message meant for someone else, an apology, a light remark. You reply once, out of politeness, and that reply is the only thing the sender was testing for.

What follows is not a scam for a long time. It is a friendship, or a courtship, conducted patiently over weeks and often months. There is no request for money, which is precisely what makes people dismiss the possibility that this is a fraud.

Money enters sideways. Never a request, always a mention: their own success, an uncle with access to something, a platform they are happy to show you out of curiosity. You are invited to look, not to invest.

The platform is a fabrication that looks entirely professional. The balance rises. Crucially, an early small withdrawal is honoured, because that one successful withdrawal converts a cautious test into a life savings deposit. The money only stops moving when you try to take out a large amount, and then there are taxes to pay first, and fees, and the balance you can see is a number on a page that was never real.

This one does not impersonate the problem. It impersonates the fix.

The message says your details were exposed in a security incident and that you should secure your account immediately. The claim costs the sender nothing to make and is almost always true in general terms, because essentially everyone has been caught in a real breach at some point. It does not need to be targeted. It only needs to be plausible, and the base rate does the rest.

Attackers also watch the news. After a genuine breach is reported, waves of these go out, so the real notification and the fake one arrive in the same week, worded alike, and both look urgent.

What makes it convert is that it hijacks the advice everyone has been given. Change your password. Verify your account. Check your credit. A person following that link is not being careless; they are being diligent, and the link harvests the exact credential it claims to be protecting.

In July 2020 attackers called Twitter employees claiming to be from the company's own IT department. The calls were not improvised. The callers had researched the job titles of Twitter staff and personal details about the employees they called, and they offered help with a genuine problem: since staff had started working from home, VPN trouble was common.

Employees were directed to a phishing site that looked identical to Twitter's VPN login page, on a similarly named domain, and asked to sign in during the call. Some did. The first account they took had no access to the internal tools staff use to act on user accounts. They used it to study Twitter's internal websites, then went after the employees who did.

What followed was visible to the entire world within minutes. High-profile verified accounts began posting an identical cryptocurrency message, including accounts belonging to major public figures and companies.

The starting point was an external contractor's password, likely bought on the dark web after malware on the contractor's personal device exposed it. On its own it was useless, because the account required a second factor on the contractor's phone.

So the attacker simply asked for it, repeatedly. Each login attempt sent an approval prompt to the contractor's phone, and at first each one was refused.

The attacker later told a security researcher what came next: a message to the contractor on WhatsApp, posing as Uber IT, saying the prompts would stop if one was accepted. The contractor accepted.

From there the attacker reached other employee accounts and, through them, G-Suite, Slack, an internal finance tool, and the dashboard where outside researchers report Uber's security bugs. Then the attacker announced the breach in a company-wide Slack channel.

In August 2023 employees at the software company Retool received text messages claiming to be from internal IT, describing a payroll problem tied to open enrollment. It was a pretext with a deadline attached to someone's own pay.

Almost everyone ignored it. One employee followed the link and signed in. The link read retool.okta.com.[oauthv2.app], the trick explained near the top of this guide: it starts with Retool's name, but the domain is oauthv2.app.

Then came a phone call. The caller claimed to be a member of the IT team and, Retool says, used a deepfake of a real employee's voice. The caller also knew the office floor plan, coworkers and internal processes. The employee grew more and more suspicious, and still gave up one more multi-factor code.

That code let the attacker add their own phone to the employee's account. The employee's authenticator app was syncing its codes to their Google account, a feature Google had just released, so once the attacker was into that account they had every code at once. From there the attacker reached Retool's VPN and its internal admin systems.

From 2013 through 2015, a Lithuanian man ran a scheme against two U.S. internet companies. He registered a company in Latvia under the exact name of an Asian computer hardware maker that both companies really did business with, in transactions worth millions of dollars, and opened bank accounts for it in Latvia and Cyprus.

Then came the emails. They were made to look as if they came from the real supplier's staff, and they told employees at both companies to send money they genuinely owed for real goods to the new accounts. Nothing was hacked. The bills were real. Only the bank account had changed, and the companies paid.

The money was moved on quickly, through banks in Latvia, Cyprus, Slovakia, Lithuania, Hungary and Hong Kong. To explain such large transfers to the banks, he supplied forged invoices, contracts and letters that appeared to be signed by the victim companies' own executives, complete with fake corporate stamps. In all, the companies sent over $120 million.

7:50 in the morning at a side entrance, during the narrow window when enough people are arriving that a queue forms but not enough that anyone is watching closely.

He is wearing a branded polo and carrying two coffee trays and a laptop bag. His badge is on a lanyard, visible, and twisted backwards, which reads as an accident rather than as concealment. That distinction is the whole design.

He catches your eye as you tap your card and makes the request in a way that assumes the answer. You hold the door. He thanks you by name, because your badge is facing forwards.

If he had slipped in behind you without your noticing, that would be tailgating. Because you held the door for him, it is piggybacking.

Once inside he has meeting rooms, unlocked machines, printer output trays, whiteboards and documents on desks. In authorized penetration tests this technique succeeds far more often than any technical intrusion attempted alongside it.

A message from the service desk says the company is migrating its multi-factor provider and everyone must re-enroll before Friday. There is no link in the email. There is a printed square, and an instruction to scan it with your phone camera. Phishing that hides its link in a QR code is called quishing.

The square is the entire trick, and it does exactly one thing an ordinary link does not: it hides its own address. You cannot hover over it, you cannot read it, and you cannot judge it before you act on it.

It also moves you. A link clicked on a company laptop passes through whatever filtering the organization has bought. A code scanned with your own phone does not. In one gesture you have stepped off the monitored, managed, protected device and onto the one in your pocket, where the browser has none of those defenses and the screen is too small to read a lookalike address anyway.

That is why the sign-in page that follows works. It is not that the page is better. It is that you are now looking at it somewhere nothing is watching.