Questions: Recognizing Online Scams and Fraud

Question 1

You receive an urgent email from your bank saying your account will be suspended in 24 hours unless you verify your credentials by clicking the link. The email has your bank's logo and looks professional. What is the most important warning sign that this may be a scam?

• A. The email is too short to be from a legitimate bank
• B. Banks never contact customers about account issues
• C. The artificial urgency is designed to prevent you from verifying the contact through official channels
• D. Professional-looking emails are always from legitimate sources

Answer: (C)

Urgency is the primary social engineering tool in scams — it shuts down critical thinking by creating panic. A legitimate bank will always give you time to respond and will provide verifiable contact channels. The professional appearance (option D) is a common trap: scammers invest heavily in mimicking real organizations. The correct response is to ignore the email entirely and log into your account directly through the bank's known website.

Question 2

A caller claims to be from the IRS and says you owe back taxes and will be arrested unless you pay immediately via gift cards. You're skeptical but they provide a case number and sound official. What should you do?

• A. Ask them to call back in an hour to give you time to prepare the gift cards
• B. Hang up and contact the IRS directly through a number you find yourself on their official website
• C. Ask the caller for their badge number and supervisor's name before complying
• D. Pay a small portion to show good faith while you verify the claim

Answer: (B)

The correct response to any unsolicited inbound contact claiming to be an authority is to hang up and initiate contact yourself through a channel you independently verify. The IRS does not demand immediate payment by gift card — that is a major red flag. Options A and C are wrong because they keep engaging with the potential scammer. Option D is wrong because any payment validates the scam and leads to escalating demands.

Question 3

Smart, technically literate people rarely fall for online scams because they can recognize the warning signs.

• T. True
• F. False

Answer: False

This is one of the most dangerous misconceptions about scams. Scammers calibrate their approaches to their targets: investment fraud is designed to fool financially sophisticated people; tech-support scams target those comfortable with computers. The 'I'm too smart to be scammed' belief is itself a vulnerability — it reduces vigilance. Every scam catches people in a vulnerable moment (distracted, emotional, or facing a novel scenario), regardless of general intelligence or technical knowledge.

Question 4

An unsolicited email that includes your correct name and account number is more convincing and therefore more dangerous than a generic phishing email.

• T. True
• F. False

Answer: True

Personalized information makes scams more convincing because it bypasses the mental shortcut 'this can't be real — they don't know who I am.' Scammers obtain personal details from data breaches, social media, and purchased data lists. A message that correctly identifies you feels legitimate, which is exactly why it's more dangerous. The correct sender address check still applies — look at the full email address, not just the display name, and verify through official channels regardless.

Question 5

Why is initiating contact yourself — rather than responding to inbound contact — such a reliable defense against scams?

Model answer: When you initiate contact through a verified official channel (the number on your bank card, the official website you navigate to yourself), you bypass all the ways scammers can impersonate legitimate organizations. A scammer can fake an email address, spoof a phone number, build a lookalike website, and provide a fake callback number — but they cannot intercept your call to a number you found independently. Responding to inbound contact means trusting that the contact is what it claims to be, which is exactly what scammers exploit.

Social engineering gives the scammer control of the communication channel — they choose how to reach you, what identity to project, and what verification they offer. By initiating contact yourself through a trusted source, you switch control of the channel. This single rule — never act on inbound contact you didn't initiate — protects against nearly every category of fraud: phishing, vishing, impersonation, and tech-support scams alike.