Could you spot it?
Eight situations. Pick what you'd do, and you'll get an answer straight away explaining why, whichever option you chose.
Some of these are not scams. That's deliberate. The aim isn't to make you suspicious of everything, because that's exhausting and people give it up within a week. The aim is a couple of habits that work whether something is real or not.
Nothing is recorded and nobody sees how you did, including us. Exactly what that means, if you want it.
1. A text about a package
USPS: Your package is on hold. A $1.95 redelivery fee is required. Pay here to release it: usps-redelivery-track.com/pay
What do you do?
It's small on purpose. The fee isn't what they're after. Your card number is, and they get it on the payment page.
Being genuinely owed a package is the other half. These go out to millions of people, so plenty of them land on somebody who really is waiting for something.
You went to something you already had rather than something you were sent. That one habit defeats almost every text on this page.
The post office does not text about fees for a delivery.
A convincing copy of a real website is cheap to make, so looking at it tells you very little, and the page can start working on you the moment it loads.
Checking the tracking number you already have costs the same effort and can't go wrong.
What this does with your answers
Nothing you tap is recorded, and nobody sees how you did, including us.
There's no score, no email, no sign-up, and no way to get something wrong in front of anybody. The quiz runs on the page itself with no scripts and no cookies, so your answers never leave your browser. Close the page or reload it and they're gone.
That matters more than it sounds. The most common reason people don't get help after a scam is embarrassment, and a test that reported your score would be the wrong thing on a site about exactly that.
(If you'd rather verify that than take our word for it, good. That's the instinct this whole site is about, and the privacy page sets out what is and isn't collected anywhere here.)
2. A call from a grandchild
It's your grandson. He's crying. He says there's been an accident and he's been arrested, and a lawyer will call you in a minute.
Then: please don't tell Mom.
What do you do?
The second caller exists to make the first one true. By the time the lawyer speaks, you've already accepted who's in trouble.
The whole thing can be ended before that call by hanging up and dialling your grandson yourself.
He'd be at work, or asleep, or halfway through dinner.
If he doesn't answer, call his mother. Even though you were told not to. Especially then.
It's much better than doing nothing, and the FTC suggests exactly this. Ask about the dog, or where you spent Thanksgiving, not his birthday, which is findable.
The gap: a crying caller can say I can't think straight, and that's hard to argue with. Hanging up and calling back has no such gap.
3. A new Medicare card
An envelope arrives from Medicare. Inside is a new card with a new number, and a letter explaining that your number was changed because your information may have been exposed.
Nobody has called you about it.
What do you do?
Medicare really did reissue cards with new numbers to people affected by a data problem disclosed in 2025, with a letter saying why.
This is why the site gives you a step rather than a list of rules: call 1-800-MEDICARE, on the number you look up yourself, and ask. That works whichever kind of envelope this is.
Not everything unexpected is a scam, and treating it that way is exhausting and makes people miss real things.
Real cards are paper, red white and blue, arrive free, and nobody calls to arrange one. A plastic card, or a call asking you to activate one, is the scam version.
Calling to check is exactly correct. The number to use is the one you look up yourself, because a number printed on a letter is only as trustworthy as the letter.
Here the letter is probably genuine. The habit still needs to be the one that works when it isn't.
4. The screen freezes
Your computer locks up. There's a flashing warning that your machine is infected and your files are at risk, an alarm sound, and a phone number for Microsoft support.
Nothing else on the screen responds.
What do you do?
The number being the only working thing is the whole point of the page.
Whoever answers will be calm and patient, will want to install something so they can see your screen, and will eventually ask you to open your bank account, just to check nothing's been taken.
The frozen screen is just a web page with a sound playing. Turning the machine off closes it. Nothing is infected and nothing is lost.
A real security warning never includes a phone number. That's the single most reliable tell on this page.
There's nothing for the scan to find, because nothing has been installed. The warning is a picture of a warning.
Turning the machine off is faster and ends it completely.
5. A text from your bank
Fraud alert: Did you authorise a payment of $3,950 to a money transfer service? Reply NO if this was not you.
What do you do?
Replying is the point of the message. It proves the number is live and starts the conversation on their terms.
Within a minute the phone rings, and the number on your screen is your bank's real number, because that can be faked.
A real problem is visible in the app. If it isn't there, there wasn't one.
And you never entered the conversation, which is where everything else in this scam happens.
Calling to check is right. Calling a number that arrived in the message is not, because whoever sent the text chose it.
The number on the back of your card is the one that can't be chosen for you.
6. A call you were expecting
Yesterday you rang your insurance company and left a message asking them to call you back.
Today they call. The person asks you to confirm your date of birth before they can discuss the account.
What do you do?
This one is very likely real. You asked them to call, and confirming who they're speaking to is ordinary and required.
A rule that makes every real interaction impossible gets abandoned within a week, and then nothing is protecting you.
You started this. That's the meaningful difference, and it's the difference the whole site turns on.
One line keeps even this safe: I'd rather call you back on the number on my statement. Any real company says yes without a pause.
It costs two minutes, works whether or not the call was genuine, and no legitimate company will object.
Worth knowing you're not being difficult. A real fraud department is pleased when you do this.
7. Your closing is on Friday
Three days before closing on a house, your attorney emails the wiring instructions. It's the same thread you've been using for weeks. Her signature is the one you've seen thirty times.
The account details are different from the ones she sent in March. She apologises: their escrow account is being audited.
What do you do?
Read the address every time, because often it really is one letter off and that catches it.
But when somebody is inside the real mailbox, the address matches perfectly, because it is hers. Then this check passes and the money goes.
If somebody is reading that mailbox, your question goes to them. You'll get back a calm yes, on the right thread, in the right voice.
A second message isn't a second channel. A second medium is.
Not the signature block, which somebody in the mailbox can edit. The number you already had, from your own file, before any of this started.
Any change to payment details is worth treating as fraud until a phone call proves otherwise, including the times it turns out to be real.
8. You've won
A call says you've won $22 million and a car in a sweepstakes. Before they can release it you need to pay the taxes, which they can arrange today.
They mention a sweepstakes company whose name you know.
What do you do?
They'll have a reason why that isn't possible. There's always a reason, and each one keeps you talking.
The question that ends it isn't about the tax. It's whether you entered anything.
Real prizes are free. No tax, no shipping, no customs, no processing fee.
And the second question: did you enter? If not, the FTC's answer is blunt. You absolutely didn't win.
The real company says plainly that it never asks anyone to pay a fee to collect a prize.
Slightly slower than simply hanging up, and it reaches the same place. If you'd rather check than dismiss, check this way.
How did you do?
Only you know, which is the point.
If you got most of them, the thing you were doing was probably the same thing each time: you went to something you already had instead of something you were sent. A number on your own card. A tracking number you already had. A phone number from a letter you signed months ago.
That's the whole method. It works when you're tired, it works when the story is convincing, and it works on scams that haven't been invented yet.
If some of them caught you, the two that catch nearly everybody are the bank text and the closing wire. Both are designed so that every check you can make from inside the conversation comes back reassuring. Neither is about being careless.
The three steps, for the fridge
- Break the contact. Hang up. Close the message. Even if you were told not to. Especially then.
- Use a path they did not choose. Call back on a number you already have, or one you looked up yourself. The number they gave you is the scam.
- Take all the time you can get. Nothing real falls apart overnight.
If any of this has already happened to you or to someone you love, you're not the first and you did nothing stupid. These are staffed operations with scripts, practised on thousands of people before they reach you.
Call your bank and use the word "fraud". Report it at ic3.gov. Then call the National Elder Fraud Hotline, 833-372-8311, Monday to Friday, 10 a.m. to 6 p.m. Eastern. They're free, and they'll tell you what to do next.
Anyone who contacts you afterward offering to recover your money for a fee is the next scam.
Related: The three steps · Five signs it's a scam · I think I was scammed
