For the month of July I answered every call from an unknown number and kept every suspicious text, logging each one in a spreadsheet. I wanted a real sample of what an ordinary household receives, not the folklore version. Here’s what 23 attempts looked like, and what the pattern taught me.
The raw numbers
- 14 robocalls (recorded voice, press 1 to connect)
- 5 live callers (a real person on the line)
- 4 smishing texts (links to fake pages)
Six claimed to be my bank. Three claimed to be a phone carrier. Two impersonated a government tax office. The rest were the classics: fake parcel deliveries, auto warranty expiration, and one elaborate “your cloud storage is full, verify your card” play.
The structure is always the same
Every single live call, without exception, followed the same three-beat script:
- Authority: “This is the fraud prevention department at [bank].”
- Alarm: “We’ve detected two unusual charges this morning.”
- Resolution: “I just need to verify your identity to stop them.”
The resolution step is where the theft happens. Sometimes it’s reading back a one-time passcode they just triggered. Sometimes it’s “confirming” the card number they claim is compromised. Once it was installing a remote-access app “so our security team can watch the fraudulent transaction in real time.”
The genius of the script is that step 2 supplies the fear and step 3 offers the relief. Nobody reads out a verification code calmly — you do it in a state of manufactured urgency.
What almost worked on me
Two calls were good enough to be genuinely unsettling.
The first knew my bank’s name (correctly), my area code, and the last four digits of a card number. That last-four detail is cheap to buy on breached-data markets, but hearing it feels like proof. The tell: they asked me to read a code I had just received. No legitimate institution’s staff will ever need you to read them a code — the code exists precisely so that they don’t have to ask.
The second was patient, warm, and apologetic, then handed me to a “supervisor” who introduced pressure. The emotional pivot from kindness to urgency is a designed handoff. Real support conversations have no need to escalate your feelings.
The texts are getting better
All four smishing messages used real brand formats and short URLs. One took me to a pixel-perfect bank login page — correct logo, correct fonts. Two tells gave it away: the URL had the bank’s name only in the path, not the domain, and the page asked for card PIN, which no bank’s login ever does.
WARNINGNo legitimate message from a bank, carrier, or government office needs you to click a link in that message to solve a problem. The link is the problem. If you’re worried, close the message and open the official app or type the site’s address yourself.
Three rules that ended the experiment safely
- Never outbound-trust. Any contact that arrives inbound — call, text, email — gets treated as unverified until I’ve initiated contact myself through an official channel. This one rule defeats the entire genre, because every scam requires you to act within their channel.
- Codes are for screens, not voices. Any request to read a code aloud, ever, is the scam announcing itself. Hang up mid-sentence; politeness is a cost the scam is charging you.
- Urgency is the tell. Legitimate problems keep. Frauds expire. “Within 15 minutes” exists because thinking is fatal to them.
What I now do differently
Unknown numbers still get answered when I’m logging them, but in normal life: silence from unknown numbers, voicemail does the triage, and the carrier’s spam filter catches the robocalls. Every suspicious text gets reported to the carrier’s spam-reporting number and deleted — reporting takes ten seconds and measurably improves the filter for everyone.
The uncomfortable conclusion from 23 samples: none of these scams are technically sophisticated. They don’t need to be. They’re patience-based businesses that monetize the gap between how official institutions actually behave and what a frightened person on a phone call will do.
If this article helped you, please share it with others!
Some information may be outdated