After 40 years in information security, if I could give every family in America just one habit to protect themselves from scams, it would be this:
Never call a phone number that appears in an email or text message. Instead, look up the organization's phone number independently — from their official website, the back of your card, or a verified directory — and call that number instead.
Why this works
The most common scam pattern looks like this: you get an email that appears to be from your bank, Medicare, the IRS, Amazon, or another organization you trust. It says there is a problem with your account and you need to call immediately. It includes a phone number.
That phone number connects directly to the scammer. Not the real organization. The entire email exists for one purpose: to get you to call that number.
Real-world examples
- An "IRS notice" with a callback number — calling it connects you to someone demanding gift card payment for back taxes
- A "Medicare alert" with a number — calling it connects you to someone asking for your Medicare number
- An "Amazon fraud alert" with a number — calling it connects you to someone asking for your account password and payment info
- A "bank security alert" with a number — calling it connects you to someone who will eventually ask you to move money to a "safe account"
How to find the real number
- Your bank: Call the number on the back of your debit or credit card
- Medicare: Call 1-800-MEDICARE (1-800-633-4227)
- Social Security: Call 1-800-772-1213
- IRS: Call 1-800-829-1040
- Any other company: Type their name directly into Google and call the number from their official website — not the number in the email
Teach this to everyone you know
This habit takes 30 extra seconds. It costs nothing. And it will protect you from the vast majority of phone-based scams no matter how convincing the email or text looks.
Got a message that looks like this?
Paste it into ProtectMyCircle and get an instant plain-English verdict — free, no account needed.
Check it now — free