Pause. Reflect. Protect. (scam safety guide)

For your information

These guides are for educational purposes only. Technology changes quickly — we can't guarantee every step will work on every device. We recommend backing up your data before making changes.

One simple habit that blocks most scams

Pause. Reflect. Protect. is a "muscle memory" response for moments when something feels off.

Based on AARP's scam-prevention framework, it is meant to be as memorable as "Stop, drop and roll," but for fraud.

The 3 triggers that show up in most scams

When you notice any of these, treat it as your cue to actively pause.

Unexpected contact
A call, text, email, DM, or pop-up you did not initiate.
A surge of emotion
Fear, panic, excitement, shame, or the instinct to "fix it now."
Urgency
Pressure to act immediately: "Right now," "today," "you'll lose access," "last chance," "don't tell anyone."

The "active pause" (what to do in the moment)

This is not just waiting. It is an intentional reset to move from emotion back to logic.

Pause
Stop responding and take a slow breath. Do not click, open attachments, download files, send money, or share codes. An urgent message is a reason to verify, not a deadline you have to obey.
Reflect
Ask:
- Does this story make sense?
- Was I expecting this link or file, even if I recognize the sender?
- Why is this happening now?
- What do I already know about this person or organization?
- What would I do if there was no time pressure?
Protect
End the interaction and verify using a method you control.

How to verify safely (the Protect step)

Pick the option that fits the situation.

Call back using a trusted number
Use a number from a statement, the back of a card, or the organization's official website. Do not use numbers sent in the message.
Use a second channel
If someone texts, call a saved number. If someone DMs, use a separate, trusted channel. A familiar account may have been taken over; replying to the same message may reach the scammer.
Contact the person directly
If the message claims to be a friend or family member, call the person (or someone close to them) using a saved contact.
Open the official app yourself
Check account alerts in the app or through a saved bookmark. Do not use the message's link or phone number to verify its own claim.
Get a second set of eyes
Ask someone you trust to read the message and tell you what stands out.

Think before you click or open a file

A familiar name, logo, or message thread is not proof that a link or attachment is safe. Someone you know may have had their account taken over. Confirm an unexpected file through a saved phone number before opening it.

On a computer: hover over a link without clicking to see its destination. The visible words can differ from the actual address.
On a phone: if you cannot inspect the address safely without opening it, leave the link alone and open the official app instead.
Read the hostname: the website name comes after https:// and before the next slash. In https://yourbank.example.com/login, the site belongs to example.com, not a bank called “yourbank.” This is an illustration, not a link to visit.
Watch for lookalikes: extra words, swapped letters, and shortened links can hide the destination. Seeing a brand name somewhere in an address is not enough.
A padlock is not an endorsement: HTTPS encrypts the connection; a scam site can use it too. Inspecting a link can reveal a warning sign, but cannot guarantee safety.

If the address is confusing, you do not have to decode it. Use a saved bookmark or open the service's app yourself.

Pause before sharing personal information

An official-looking form can still be a trap. Stop if an unexpected message asks for your password, sign-in code, card details, or Social Security number. Verify the request independently before entering anything.

Example: a text says, “Your account closes in 10 minutes. Verify now.” Pause and leave the link alone. Reflect: were you expecting this? Protect: open the real app and check its alerts, or call the number on your statement. Use that trusted route to resolve a genuine problem.

Quick example (so it's easy to remember)

A late-night call: "It's your grandchild. I'm in trouble and need money now."

Triggers: unexpected contact, emotion, urgency
Response: pause, then reflect (does this match what you know?), then protect (hang up and call the grandchild or the parents from saved contacts).

What to do when you're not sure

Default to safety

It is okay to be "rude." End the call.
It is okay to take time.
Real institutions can handle verification.

If you already responded

Stop communication.
If you only opened a link, close the page. A click alone does not mean your account was taken over. Do not enter details, approve prompts, or open a downloaded file.
Change passwords for any accounts you may have exposed.
Contact your bank or card issuer if money or card details were shared.
Document what happened (screenshots, phone numbers, links, timestamps).