Pause. Reflect. Protect. (scam safety guide)
One simple habit that blocks most scams
It is meant to be as memorable as "Stop, drop and roll," but for fraud.
The 3 triggers that show up in most scams
When you notice any of these, treat it as your cue to actively pause.
- Unexpected contact
A call, text, email, DM, or pop-up you did not initiate.
- A surge of emotion
Fear, panic, excitement, shame, or the instinct to "fix it now."
- Urgency
Pressure to act immediately: "Right now," "today," "you'll lose access," "last chance," "don't tell anyone."
The "active pause" (what to do in the moment)
This is not just waiting. It is an intentional reset to move from emotion back to logic.
- Pause
Stop responding. Do not click. Do not download. Do not send money. Do not share codes.
- Reflect
Ask:
- Does this story make sense?
- Why is this happening now?
- What do I already know about this person or organization?
- What would I do if there was no time pressure?
- Protect
End the interaction and verify using a method you control.
How to verify safely (the Protect step)
Pick the option that fits the situation.
- Call back using a trusted number
Use a number from a statement, the back of a card, or the organization's official website. Do not use numbers sent in the message.
- Use a second channel
If someone texts, call. If someone DMs, email a known address.
- Contact the person directly
If the message claims to be a friend or family member, call the person (or someone close to them) using a saved contact.
- Get a second set of eyes
Ask someone you trust to read the message and tell you what stands out.
Quick example (so it's easy to remember)
A late-night call: "It's your grandchild. I'm in trouble and need money now."
- Triggers: unexpected contact, emotion, urgency
- Response: pause, then reflect (does this match what you know?), then protect (hang up and call the grandchild or the parents from saved contacts).
What to do when you're not sure
Default to safety
- It is okay to be "rude." End the call.
- It is okay to take time.
- Real institutions can handle verification.
If you already responded
- Stop communication.
- Change passwords for any accounts you may have exposed.
- Contact your bank or card issuer if money or card details were shared.
- Document what happened (screenshots, phone numbers, links, timestamps).