Safety content
How to Verify a Bank, Utility, or Tech-Support Message Independently
Almost every impersonation scam — fake bank alerts, fake "Microsoft" calls, fake power-company disconnection threats — collapses the moment the target verifies through a channel the scammer doesn't control. This page turns that insight into a habit your parent can actually follow.
The rule, in one sentence: never verify a message using the contact information inside the message. Look it up yourself, separately.
Why "call us back at this number" is the trap
Caller ID can be spoofed to show any name or number. Email display names can be forged. A message can carry the real bank's logo and still be fake. The one thing scammers cannot control is the number you choose to call from an independent source. That's the whole method.
The method (four steps)
- Hang up or stop replying. Politeness is not an obligation. Real organizations expect you to be careful.
- Find the official contact yourself. Use the number on the back of the card or statement, the official app, or the official website (type the address yourself or use a bookmark — don't click links from the message).
- Call or check, and ask a yes/no question. "Did you contact me about my account?" A real agent can answer that in seconds.
- Treat silence as confirmation. If the "bank" never actually called you, the message was the scam.
The script to teach a parent
Print this and put it by the phone. It's short enough to actually get used:
Specific cases
Banks and cards
Real fraud alerts exist, but they never demand the one-time code, and they never create a 20-minute deadline. When in doubt, call the number on the card. If the account were actually in danger, the bank's fraud department will be delighted you called.
Government agencies (IRS, Social Security, Medicare, courts)
Real agencies do not threaten arrest over the phone, do not demand gift cards or wire transfers, and do not ask for your Social Security number out of the blue. Call the agency's official number, or for Social Security impersonation specifically, report at ssa.gov/scam.
Tech support ("Microsoft," "Apple," your internet provider)
No legitimate company calls you because your computer "has a virus," and none will ever ask you to install remote-access software or buy gift cards for repairs. If your parent already gave remote access, disconnect the internet and call a trusted local repair shop.
Utilities threatening disconnection
Call the number on the actual bill — not the one from the caller — and ask about the account. Utility disconnection scams are among the most common in the U.S.
Exceptions that prove the rule
Sometimes a message is real. That's fine — the method still works. You're not deciding "real or fake" from the message; you're deciding from the independent channel. That's why the method is safe even when you can't tell.
Related
- Set up a family safe word — for the calls the verification method can't reach: "Grandma, it's me."
- The first-hour playbook — when a suspicious message has already arrived.
- Scam Risk Check — paste the message, get a risk band, in your browser.
Sources
- FTC — How To Avoid a Scam (retrieved 2026-08-07)
- SSA — Protect Yourself from Social Security Scams (retrieved 2026-08-07)
- FBI IC3 — IC3 (retrieved 2026-08-07)
Found an error? Report it.