The 30-Second Scam Test I Teach Everyone

Scams work the same way they've worked for centuries. Technology changes the delivery method — from letters to phone calls to emails to AI-generated video. But the psychology doesn't change.

Fear. Urgency. Authority. Love. Greed. Shame.

Pick any scam in history and it hits one or more of those buttons. The delivery mechanism is new. The emotional manipulation is ancient.

I've taught this to my family, my clients, and anyone who'll listen. Five questions. Thirty seconds. Works on every scam type.

The Five Questions

1. Who sent this?

Not who the display name says sent it. Who ACTUALLY sent it.

Check the email address — the whole thing, not just the name. "Amazon Support" from amazon-support-verify@x7k92.net is not Amazon. "Your Bank" from security-alert@bnk-secure-login.com is not your bank.

On a phone call: the caller ID said "IRS" — do you think the IRS spoofed their own number, or did someone spoof it to look like the IRS? It's the second one.

On a text: a random number claiming to be USPS about a package you didn't order. Block. Done.

2. Why now?

Scammers manufacture urgency because urgency bypasses thinking. "Your account will be locked in 24 hours." "You missed a jury duty summons and there's a warrant." "Someone tried to log into your bank account."

Real security problems don't demand instant action through a single email or text. Your bank may text you alerts, but it will not text you a login link. The IRS doesn't call you. Microsoft doesn't call to tell you your computer has a virus.

If the message needs an answer RIGHT NOW, that's the red flag. Not a coincidence. The defining feature.

3. Is this normal?

Does this situation make sense in your actual life?

Did you order a package from USPS? Did you enter a lottery in a country you've never visited? Is your boss actually the type of person who'd text you asking for Apple gift cards?

Most scam scenarios fall apart the moment you ask this question. "You've won a prize in a contest you didn't enter" — that's not winning, that's bait.

4. What happens if I'm wrong?

This is the question that saves you. If you wait an hour, what's the worst that happens?

If it's real: a legitimate bank will still have your account. A legitimate employer won't fire you for not buying gift cards. A legitimate government agency sends letters, not threatening phone calls.

If it's a scam: you just saved yourself thousands of dollars and days of recovery.

The asymmetry is enormous. Waiting costs nothing. Clicking costs everything. When the stakes are that lopsided, always wait.

5. Who can I verify with?

Never verify through the channel the message came from. If you get a text about your bank, don't click the link in the text. Go to your bank's website directly. Call the number on the back of your card.

If you get a call from "your grandson" saying he's in trouble, hang up and call his actual number. Not the number the caller gives you. The number in your contacts.

If your "boss" emails asking for an urgent wire transfer, walk to their office or call them on your company phone system. Not the number in the email.

Verification through an independent channel kills scams instantly. If it's real, the person will be glad you checked. If it's not, you just avoided disaster.

Why This Works on Every Scam Type

Email phishing. The sender address is wrong (question 1). They need you to click now (question 2). Your bank doesn't email links (question 3). Waiting costs nothing (question 4). Call the number on your card to verify (question 5).

Phone scams. The caller ID is spoofed (1). There's a warrant or an emergency (2). The IRS doesn't call you (3). Hang up and call them back at their real number (5).

Romance scams. They declared love quickly (2). A beautiful stranger with an investment opportunity is not normal (3). Verify on a channel you control before sending money — and remember even live video can be deepfaked now (5).

Tech support scams. Microsoft doesn't call you (1, 3). The "virus" they found only exists if you let them show you (4). A real security problem doesn't come from an unsolicited call (2).

Family emergency AI voice clones. Ask for the code word (5). Hang up, call their real number (5). If they won't answer simple personal questions, it's not them (1).

Practice This Now

The test doesn't work if you don't use it. Pick one question — whichever resonates most — and drill it.

For me it's question 4: "What happens if I'm wrong?" That single question has saved me more times than I can count. When someone demands instant action, my brain now automatically asks: what's the cost of waiting?

The answer is almost always: nothing. The cost of not waiting? Sometimes everything.

Get the Scam Decision Tree Card — a one-page flowchart version of this test. Print it. Stick it on your fridge. Give it to your parents. Free.

[Join the Digital Self-Defense list →]