How Scammers and Attackers Think

“Why would anyone bother with me?”

A week has passed, and Grace Holloway is settling in at the Digital Help Desk. Her first visitor of the morning is Florence Baker again, who comes in every Tuesday. Florence puts her phone on the desk.

“Another one,” she says. “This time it's a parcel that couldn't be delivered. But I'm not expecting a parcel. Why do they keep picking on me? I'm eighty-one. I haven't got anything worth stealing.”

Arthur Pembridge, Grace's mentor, pulls up a chair. “That's the most common thing I hear,” he says gently. “And it's exactly what the people who sent that message are counting on. Let's look at how they think. Once you can see things from their side, their tricks become much easier to spot.”

You are not being picked out: you are being tried

Most people imagine a criminal sitting at a computer, choosing a victim and working hard to trick them. That does happen, but it is not how most scams work. Most scams are sent to huge numbers of people at once, by computers, at almost no expense to the criminal.

Think of it like fishing with an enormous net. The person sending the scam does not know or care who you are. If they send a message to a million phones and only one person in every thousand is fooled, that is still a thousand victims. A message that costs almost nothing to send only has to work very rarely to be worth sending.

This is why “I have nothing worth stealing” is not a defence. Florence was not chosen because someone thought she was rich. Her number was simply on a list, like millions of others.

What criminals want

Almost every attack is after one or more of four things:

When a message asks for any of these four things, your guard should go up straight away.

Look at it from the scammer's side

Here is the message Florence received. Read it first, then press the button to see what Arthur pointed out.

“The charge is tiny,” says Grace. “Why bother?”

“Because the charge isn't what they want,” says Arthur. “They want the card number, the expiry date and the security code that you type into their page to pay it. Once they have those, they can spend far more than 29 rupees.”

Notice too that Florence was not expecting a parcel. Many people are expecting one, which is exactly why this kind of message is sent to so many numbers: some of the people who receive it will have just ordered something.

Mass scams and targeted scams

There are two broad kinds of attack:

• Mass scams are sent to thousands or millions of people. The message is general (“your parcel”, “your account”, “your bank”) because the sender does not know anything about you. They are the most common by far.
• Targeted scams are aimed at one person or a small group. The criminal first finds out about you, perhaps from what you post online, and then writes a message that fits your life: your boss's name, your child's school, a shop you really use. These are rarer but more convincing.

Targeted scams are one reason why it is wise to be careful about what you share publicly. You will learn more about this in Module 7.

The three pressure tricks

Scams change all the time, but underneath they nearly always lean on the same few feelings. Arthur calls them the three pressure tricks:

1. Hurry. A deadline, a threat or a warning: “within 12 hours”, “your account will be closed”, “act now”. Hurry stops you from thinking and from asking anyone else.
2. Authority. The message pretends to come from someone you would normally obey or trust: a bank, the tax office, the police, your employer, a well-known company, even a family member.
3. Reward or fear. Something you want (a prize, a refund, a bargain) or something you are afraid of (a fine, a virus, trouble with the law).

A genuine organisation might occasionally use one of these. A scam usually uses two or three at once. The stronger the pressure, the more reason to slow down.

“Hurry, authority and reward, all in one short email,” says Arthur. “That's a very typical scam.”

Stop, Check, Ask

You cannot remember every scam, because new ones appear every week. What you can do is build one habit that works against all of them. Whenever a message, call or website surprises you or asks you to act, go through three steps:

1. Stop. Do not click, reply, pay or call back straight away. A genuine request will still be there in ten minutes. A scam depends on you acting before you think.
2. Check. Find out for yourself, using a way you already trust: open the company's app or type its address yourself, look at your account, or ring the number on your card or on an old bill. Never use the link, button or phone number in the message itself.
3. Ask. Talk to someone: a family member, a friend, a colleague, or the help desk. Scammers often say “keep this confidential”, because a second person usually sees through the trick at once.

Florence did the right thing without even knowing it: she stopped, and she came to ask. When Grace checks the real ParcelPost app with her, there is no parcel waiting at all.

A first look at links

Much of this course is about looking closely. Here is one of the tools you will use: a link inspector. It picks out the part of a web address that decides where the link really goes. Try the example links. You will learn exactly how to read addresses in Lesson 3.3; for now, just notice that the first one is ParcelPost's real address and the other two only pretend to be.

Exercises

Quick check

Choose an answer to see whether you are right and why.

Found a mistake on this page, or something unclear? Report a problem and mention “Cyber Safety Lesson 1.2”.