Defending it

Nine lessons of this course have been about building something: a picture of where your money goes, a budget, a way out of debt, an understanding of growth, a fund, a grip on what tax takes, a wrapper, a policy, a house. This one is about keeping it, because all of that can be taken in an afternoon by somebody who calls you on the phone.

Two things before we start, and the first one matters more than anything else in the lesson.

Being scammed is not a failure of intelligence. It's tempting to believe otherwise, because believing otherwise is comforting: if only careless people get caught, and I'm not careless, I'm safe. The evidence says something different. In 2024 people in the US reported losing more than $12.5 billion to fraud, up 25% in a year.¹ Read that the way lesson 1 taught you to: the number of reports barely moved, at 2.6 million, and what changed was the share of reports involving an actual loss, which went from 27% to 38%. So the rise is mostly people getting caught more often rather than more attempts being made. And all of it is a floor rather than a total, because most fraud is never reported at all. These are not amateur operations, and they are not aimed at fools. They're aimed at people doing something ordinary, on a day when they're busy.

Where this applies. The credit bureaus, the freeze rules, the recovery sites and the payment protections in this lesson are US ones. The structure of a con is not, and neither is the rule about payment methods; the names of the rails change and their reversibility does not.

Who actually gets scammed, since almost everyone has this wrong

Ask most people who's most at risk and they'll say older people. The FTC keeps the national count, and its own summary is blunt: "Many people think scams mostly affect older adults. But reports to the FTC's Consumer Sentinel tell a different story: anyone can be scammed."²

Two figures, and you need both of them or you'll believe something false.

Younger adults report losing money more often. In the FTC's analysis of this question, using 2021 reports, adults aged 18 to 59 were 34% more likely than adults 60 and over to report losing money to a scam.

Older adults lose much more when it happens. Median individual losses in the same data run $500 for ages 18 to 59, $520 for 60 to 69, $800 for 70 to 79, and $1,500 for 80 and over, and by the FTC's 2025 figures the median for people 80 and over had passed $1,600. At the top end the pattern is sharper still: losses of $10,000 or more to business and government imposter scams were more than twice as likely to be reported by older adults, and losses over $100,000 three times as likely.³

And a third figure that belongs with the other two. Older adults were also much more likely than people aged 18 to 59 to report a scam they had spotted and avoided losing anything to. Whatever is going on in the loss figures, it isn't that older people are worse at recognising a con.

Take only the first figure and you'll conclude age doesn't matter, and stop worrying about your parents. Take only the second and you'll reproduce the myth, and stop worrying about yourself. The true picture is that everybody is a target, the young lose more often, the old lose more when it happens, and the old spot more of them coming.

The three things every scam has to do

The variants change every month, which is why memorising a list of current scams is a losing game. The structure doesn't change, because it can't: to take your money, a stranger has to get through three gates, and if any one of them fails, they get nothing.

Gate one is contact. They have to reach you and give you a reason to stay on the line: a suspicious charge, a package, a warrant, a job, a match, a tip about a coin. The reason is chosen to make you feel something, usually alarm or hope.

Gate two is pressure, and it has two halves that always travel together. Urgency, so you act before you think. And isolation, so nobody else can look at it. Watch for the second one, because it's the more distinctive: real institutions do not tell you to keep a call secret from your family, and they don't stay on the line while you drive to the bank. The instruction to tell nobody is the single most reliable sign in this entire lesson.

Gate three is payment, and it's the one this lesson spends the most time on, because it's where the whole thing becomes irreversible and because it's the gate you can close with a rule rather than a judgement.

The payment rail is the strongest signal you have

The rule below is what makes this work on a bad day, and it's a rule rather than an intuition on purpose.

Some ways of paying can be reversed. Others are gone the second you press send. Criminals know exactly which is which, and they choose accordingly. So the question "what are they asking me to pay with?" tells you more than "does this story sound plausible?", because a good story is cheap to write and an irreversible rail is the whole business model.

That is a ranking rather than a measurement, and it is deliberately not drawn as a chart, because nobody publishes a percentage for how much of each rail comes back.

What the FTC says about each, in short.⁴ A credit card carries federal protection against unauthorised use, and the money was never yours to begin with, so the dispute happens before you're out of pocket. A debit card carries protection too, and it comes with a clock, which is the part worth memorising: report an unauthorised transfer within two business days and your liability is capped at $50, report it after that but within 60 days and the cap is $500, and after 60 days you can be responsible for everything taken after that point.⁶ A payment app depends entirely on that app's own policy. For a wire or bank transfer the advice is to report it and ask for a refund, and no protection is named, because there isn't one. A gift card is worth reporting fast, and the FTC tells you to keep the card and the receipt. Cryptocurrency payments, in the FTC's own words, "don't have the same legal protections as credit and debit cards do, so it can be hard to get your money back".

In 2024, US consumers reported losing more money to bank transfers and cryptocurrency combined than to every other payment method put together.¹ That is not a coincidence about what people happen to use; it is what criminals ask for.

And now the part that most consumer advice leaves out, which is the difference between two words. Almost all of those protections are about an unauthorised transaction: somebody used your card, you didn't. A payment you made yourself, because you were persuaded to, is an authorised payment, and most of the protections don't reach it. You told your bank to send the money and your bank sent it.

That asymmetry is why the rule is worth having. Once the money moves on a rail like that, arguing about whether you were deceived is a much weaker position than never sending it.

Whether it should work that way is argued over rather than settled, and this course takes no side on it. The United Kingdom decided the other way: since October 2024 its regulator has required banks to reimburse most victims of authorised push payment fraud, up to a cap, with the cost split between the sending and receiving banks.⁷ US regulators have pressed banks on the same question without imposing a rule of that kind. As things stand in the US, the loss is yours, which is a fact about today rather than a law of nature.

A call, taken apart

Here's a real-shaped one. Read it once as though it happened to you at 4pm on a Thursday.

"Good afternoon, I'm calling from the fraud department. We've stopped a charge of $1,340 to an electronics retailer in another state, and we've flagged two more attempts in the last hour. Can you confirm you didn't authorise those? ... Right. Now, because these attempts are still active, we need to move your balance to a protected account while we reissue your card. I can do that with you now. It has to be today, because the holds expire overnight. I'd also ask you not to mention the details to branch staff, because part of this investigation is internal."

Now the same call with the machinery marked.

• "We've stopped a charge of $1,340": contact, with alarm and a specific number. Specificity reads as legitimacy, and it costs nothing to invent.
• "Can you confirm you didn't authorise those?": you're now agreeing with them, which is how the conversation is turned into a collaboration. From here you're on the same side, working on a problem.
• "move your balance to a protected account": gate three, and it's the entire purpose of the call. There is no such thing. A bank that suspects fraud on your account blocks the card and reissues it; the "safe account" exists only in scam calls, which is why the FTC lists moving money to protect it among the things a caller will ask for and a real institution will not.
• "It has to be today": urgency, with a fabricated deadline.
• "not to mention the details to branch staff": isolation, and the sentence that gives it away, because it's the only sentence in the call with no legitimate version.

The thing worth noticing is that four of those five are persuasion, and you can argue with persuasion all afternoon. The fifth one, the payment, is a fact about a rail, and you can just refuse it.

When the caller already knows who you are

Most people carry an instinct that a caller who knows their details must be genuine. That instinct is out of date, and the case is worth a section because it's the one that catches careful people.

Suppose the caller opens with your full name, your address, the last four digits of your card, and the name of your bank. Suppose the number on your screen is your bank's real number. Both are cheap now. Data breaches have made personal details cheap to buy, and caller ID is display text that can be set to show any number at all, which is why regulators treat spoofing as its own category of offence.

So "do they know my details?" has stopped working as a test. What still works is "would a real institution do this?" Real banks don't ask you to move money. Real government agencies don't take payment in gift cards, don't call to threaten arrest, and don't ask for a wire. Real employers don't send you a cheque to deposit and forward part of. The test survives because it's about their behaviour rather than about their knowledge, and their behaviour is constrained by what they need you to do.

And then the case with the opposite shape. A long con has no urgency at all. The romance scam and the investment scam run for weeks or months, and they're friendly the whole way. There is no pressure at gate two, because the pressure has been replaced by a relationship. Investment fraud took $5.7 billion in 2024, more than any other category, and almost none of it involved anybody being rushed.

So the shape has variants, and the constants across all of them are narrower than a checklist: money moves to a stranger, down a rail that doesn't come back, and somebody has a reason for you not to check with anyone. In the long con the isolation is subtler, and it sounds like intimacy: this is our thing, your family wouldn't understand, don't let them talk you out of it.

Three things to do this week

Most of this lesson is recognition. These are the actions, and the first is the one with the most protection in it per minute spent.

Freeze your credit at all three bureaus. A credit freeze means, in the FTC's words, that "nobody can open a new credit account in your name, including you". It's free to place and free to lift, it doesn't affect your credit score, and it lasts until you lift it.⁵ You have to do it three times, at Equifax, Experian and TransUnion separately, because they're separate companies. When you actually want credit, you lift it temporarily and put it back. This is the difference between somebody having your details and somebody being able to use them.

A fraud alert is the weaker version: it tells businesses to check with you first, lasts a year, or seven years with a confirmed identity theft report. Useful, not the same thing.

Pull your credit reports and read them. AnnualCreditReport.com is the one federally mandated free source, and imitators exist, which lesson 3 warned you about. You're looking for accounts you don't recognise, and addresses you've never lived at.

And know the first hour. If you've sent money: contact whoever runs the rail immediately, because whatever chance of recovery exists is largest in the first hours. That includes the odd one people forget, cash sent by post, which the US Postal Inspection Service can sometimes intercept before delivery, for a fee, on 1-877-876-2455. If your identity is involved, IdentityTheft.gov is the FTC's recovery site and it generates a specific plan rather than a list of tips. Report to the FTC either way, at reportfraud.ftc.gov, and then freeze what isn't frozen.

What people get wrong

"Smart people don't fall for scams." The FTC's data is the answer: 18 to 59 year olds report losing money more often than people over 60. Being scammed is a bad afternoon, not a character reference.

"If it's my bank's real number on the screen, it's my bank." Caller ID is display text and can be set to anything. The number proves nothing; hang up and dial the number on your card.

"If they know my details, they're genuine." Details are cheap now. Behaviour is the test that still works.

"The money is insured, so I'd get it back." That depends entirely on the rail, and on whether the transaction was authorised. A payment you were talked into making is authorised, which is where most consumer protection stops.

"Checking my credit report hurts my score." It doesn't. Checking your own is a soft inquiry, which lesson 3 covered.

"I'd know if my identity was stolen." Usually the first sign is a bill or a rejection, and both arrive well after the fact. That's what the freeze is for: it works whether or not you noticed.

"There's no urgency, so it can't be a scam." Investment fraud took more money than any other category in 2024 and most of it is patient.

Practice

Connections

Lesson 3 taught credit reports and scores as machinery for borrowing. This lesson uses the same machinery defensively: the freeze, the report, and the fact that checking your own is a soft inquiry. That is the same knowledge doing a second job.

Lesson 1's habit of asking what a statistic measures earns its keep on the age figures. "Younger adults lose money more often" and "older adults lose more" are both true, they measure different things, and quoting either one alone produces a false picture that sounds like a fact.

Lesson 5 gives you the test for the investment version, which is the most expensive category of all. A return that is high and certain does not exist; the whole of lesson 5 is why. Anybody offering one is telling you what they are.

Lesson 8 is the closest relative here. Insurance was about handing off a loss you couldn't absorb, and the loss in this lesson is one nobody will hand off for you, which is why the defences are procedural rather than financial.

And the course ends here on purpose. The other nine lessons build something worth having, and the last one is about the fact that other people know you have it.

Go deeper

• IdentityTheft.gov, the FTC's recovery site. It asks what happened and produces a plan with the letters and the order of operations. Bookmark it now rather than looking for it on the day.
• FTC consumer advice on scams, which is organised by scam type and updated as the types change, and reportfraud.ftc.gov for reporting. Reporting feels pointless in the moment and is the reason the numbers in this lesson exist.
• FTC Consumer Sentinel Network Data Book, published every spring. Worth ten minutes each year to see what has moved.
• Khan Academy's scams and fraud unit, free and short, with more worked examples of specific scam types than this lesson carries.
• Maria Konnikova, The Confidence Game (2016). A book about why cons work on people rather than about which cons are current, which is the half this lesson has room to state and not to develop. It is the best single thing to read if the section on the long con was the part that unsettled you.
• CFPB on frauds and scams, the other US regulator in this space, with material on elder financial exploitation and on what a bank will and will not do.

Sources

[1] Federal Trade Commission, "New FTC data show a big jump in reported losses to fraud to $12.5 billion in 2024", March 2025, and the Consumer Sentinel Network Data Book 2024; $12.5bn reported lost, up 25%; 2.6 million reports; the share of reports involving a loss rising from 27% to 38%; investment scams $5.7bn and imposter scams $2.95bn; bank transfers and cryptocurrency together exceeding all other payment methods; email, phone and text as the top contact methods. https://www.ftc.gov/news-events/news/press-releases/2025/03/new-ftc-data-show-big-jump-reported-losses-fraud-125-billion-2024

[2] Federal Trade Commission Data Spotlight, "Who experiences scams? A story for all ages", December 2022; "anyone can be scammed", adults 18 to 59 being 34% more likely than adults 60 and over to report losing money, and median losses of $500, $520, $800 and $1,500 by age band. https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2022/12/who-experiences-scams-story-all-ages

[3] Federal Trade Commission, "False alarm, real scam: how scammers are stealing older adults' life savings", August 2025, and the 2025 report to Congress on protecting older consumers; imposter losses of $10,000 or more more than twice as likely, and losses over $100,000 three times as likely, to be reported by older adults. https://www.ftc.gov/news-events/data-visualizations/data-spotlight/2025/08/false-alarm-real-scam-how-scammers-are-stealing-older-adults-life-savings

[4] Federal Trade Commission, "What to do if you were scammed"; the payment-method guidance quoted here, including that cryptocurrency payments "don't have the same legal protections as credit and debit cards do, so it can be hard to get your money back". https://consumer.ftc.gov/articles/what-do-if-you-were-scammed

[5] Federal Trade Commission, "What to know about credit freezes and fraud alerts"; "There's no cost to place or lift a credit freeze", a freeze meaning "nobody can open a new credit account in your name", that "it doesn't affect your credit score", that it "lasts until you lift it", that it must be placed at each of the three bureaus, and the one-year and seven-year fraud alert durations. https://consumer.ftc.gov/articles/what-know-about-credit-freezes-fraud-alerts

[6] Consumer Financial Protection Bureau, "What should I do if I think there has been an unauthorized transaction on my account?"; liability for unauthorised electronic fund transfers capped at $50 if reported within two business days, up to $500 if reported after that but within 60 days, and unlimited for transactions occurring after the 60-day period. https://www.consumerfinance.gov/ask-cfpb/what-should-i-do-if-i-think-there-has-been-an-unauthorized-transaction-on-my-account-en-1017/

[7] UK Payment Systems Regulator, the Authorised Push Payment reimbursement requirement in force from 7 October 2024, covering Faster Payments and CHAPS, capped at £85,000, with the cost shared between the sending and receiving payment firms. Cited here only to show that the US position is a policy choice rather than a necessity. https://www.psr.org.uk/information-for-consumers/app-fraud-reimbursement-protections/

The example call in this lesson is constructed rather than transcribed, and is built from the patterns the FTC describes in sources [1] and [4]. All figures are US reported losses, which are a floor rather than a total, since most fraud is never reported.