Phone scams and text scams: how to recognize them

You can recognize phone scams and text scams by three things that almost always come together: someone who claims to be trustworthy (your grandchild, your bank, the police), an emergency, and a request that can't wait: a wire transfer, cash, the code from a text, a click on a link or an app to install. The defense is almost always the same, too: hang up and call the number you already had yourself. If it's true, it will still be true in five minutes.

These are the same old tricks with a phone in hand. Victor Lustig passed himself off as a French government official to sell the Eiffel Tower in 1925. Today the disguise is a familiar caller ID or a new number with a profile photo.

The grandparent scam

It's one of the most repeated phone scams in the US. The FBI described it step by step in a 2023 alert:

A scammer calls a senior and poses as their grandchild, who is supposedly in jail after causing a car accident. Then another scammer calls, posing as the grandchild's attorney, and asks for legal fees, bond money or medical costs.

How it works. The story escalates: an injured pregnant woman, a diplomat involved, a fatality. The “lawyer” demands secrecy, sometimes citing a judge's gag order, and asks for the money by wire, in cash hidden in a magazine or a book and mailed, or handed to a courier, such as a ride-share driver, who picks it up at the door. Between January and September 2023, the FBI's IC3 received more than 195 complaints about grandparent scams, with at least $1.9 million in losses. FINRA warns that some scammers now use AI-cloned audio of the grandchild's voice. The same script also travels by text or WhatsApp: a message from a “new number” saying the old phone broke, followed by an urgent payment.

Red flags. An unexpected call or a new number, an urgent and emotional tone, a voice that sounds “a bit off” because of the crying or the bad line, excuses not to talk to anyone else, secrecy and a rush for a fast payment.

What to do.

1. Hang up. Call your grandchild or child on their usual number.
2. If they don't answer, call someone else in the family, even if you were told to keep it secret. That's the FBI's advice.
3. Ask something only the real person would know, or the family code word.
4. Block and report the number.

The bank impersonation call

How it works. A text from “your bank” arrives warning of a suspicious charge or a blocked account, with a link, or a “fraud department agent” calls you. Scammers can spoof the number that appears on your screen and send texts that land in the same thread as your bank's real messages.

Then they ask for what they need to empty the account: your passwords, the code you just received, that you “move your money to a safe account” or that you install an app to “protect” your phone, which actually gives them control. In the “Phantom Hacker” scam the FBI warned about in 2023, fake tech support, a fake bank and a fake government agency take turns until the victim moves entire savings or retirement accounts to a “safe” account. Between January and June 2023, the IC3 received 19,000 tech support complaints with more than $542 million in losses; almost half the victims were over 60.

The rule that takes it apart. Your bank doesn't need your passwords or codes during a call it made to you. Don't act on any urgent request in the moment; contact your bank yourself. In the UK, the anti-fraud campaign Take Five sums it up in three steps: stop, challenge, protect. And if someone asks you to move your money to “a safe account,” you already know who owns that account. Hang up, open the bank's app or call the number on your card. In the UK, you can call 159: it connects you directly with more than 99% of retail bank current accounts and, unlike long numbers, it can't be spoofed.

Text message scams with a link

The most common are the package held by a delivery company, the fake refund from a utility or the phone company, the unpaid fine, and the surprise prize. The link takes you to a page that asks for your card number, expiration date and security code: with that, they have your card.

• Don't click links in messages you weren't expecting. Go to the official website or app yourself.
• If you're unsure about a delivery, contact the company through its official channels.
• Be wary of prizes: nobody gives money away on condition that you pay the fees first.
• In the UK, forward scam texts free of charge to 7726 so your provider can block the sender.

Codes: the key to your account

The code you get by text or in the app exists to authorize a payment or a change to your account. That's why it's what scammers want most. If you read it out to the caller, the transaction is signed by you, and the rules treat a payment you authorized, even under deception, differently from one you never authorized. In the UK, the Payment Systems Regulator has introduced a reimbursement requirement for these authorised push payment (APP) scams on transfers between UK accounts, but the first defense is still not to hand over the code. We explain it in what to do if you get scammed.

A rule for the whole family: codes are never read out to anyone, over the phone, ever. And no remote-access apps get installed at the request of a caller, even one who claims to be tech support.

The common red flags

1. Unexpected contact from a new number, or from one that looks official.
2. Impersonation of someone you trust: family, the bank, the police, the IRS or HMRC, a well-known company.
3. Urgency or fear: an accident, an arrest, a fraudulent charge, a blocked account.
4. Secrecy: “don't tell your father,” “don't call your bank, the line is being monitored.”
5. A specific request: money by wire, gift cards or cash, a code, a link, an app.

If you see two of these red flags together, cut it off. You can go over them calmly in the MATERIUM scam checker.

If you've already paid or shared your details

1. Call your bank now, on the official number, to block your card and try to stop the payment.
2. Change any passwords you shared and log out of open sessions.
3. Keep the messages and the number, then block and report it.
4. Report it: in the US to the FTC at ReportFraud.ftc.gov and to the FBI's IC3; in the UK to Report Fraud. Take the report reference to your bank.
5. Beware of the follow-up call. Whoever calls later offering to recover your money for a fee is running a recovery scam.

The same trick, a century ago

In 1925, Victor Lustig presented himself to the scrap dealers of Paris as an official of the Ministry of Posts and Telegraphs. He told them the state was going to dismantle the Eiffel Tower and sell it for scrap, and he met them in a hotel suite, not an office, because the matter was “too delicate.” Borrowed authority, secrecy and an exclusive offer: exactly what the fake bank uses today. His rule is Law of Deception No. 1: “The victim's greed does the con man's work.” That's why the “surprise prize” still works.

Pretending to be someone else is the oldest trick in the trade. Frank Abagnale boasted of having been a pilot, a doctor and a lawyer, although later investigations have cast doubt on much of his story. Our lesson is the same with the fake grandchild and the fake pilot: don't trust someone because of who they say they are; check who they are.

Older adults are the favorite target of these calls. If you want to prepare your family, we can help with elder fraud.