Scams, Fraud & Consumer Protection
Phishing and Imposter Scams
How phishing messages and impersonation scams are built, and the specific tells that give them away.
No recording for this one yet - EconReader can read it aloud for you.
Phishing is a message - email, text, or social media - designed to trick you into handing over login details, card numbers, or one-time codes by pretending to come from a source you trust.
How a convincing phish is built
A well-made phishing message copies real logos, real formatting, and often a real sender name through spoofing, which fakes the “from” field so a message appears to come from an address it didn’t actually originate from. The message typically pairs that trusted appearance with one of the pressure tactics from the previous lesson: a locked account, a failed payment, a package that needs “confirmation” before it’s returned to sender.
A text message claiming to be from a delivery company says a package couldn't be delivered and provides a link to "reschedule." The link leads to a page that looks identical to the real company's site and asks for a small redelivery fee and card details. There was never a package - the entire message exists to get a card number typed into that page. This specific pattern, phishing delivered by text message, is sometimes called smishing.
The tells that hold up across almost every phishing attempt
- Mismatched links - the visible text says one thing, but the actual destination (visible by hovering, or long-pressing on mobile) is a different, unfamiliar domain.
- Generic greetings - “Dear Customer” instead of your actual name, because the message was sent to thousands of addresses at once.
- Urgent account threats - suspension, closure, or a “final notice,” pushing you to act before checking.
- Requests for information a legitimate sender already has - your bank does not need you to type your full card number into a text message reply to “verify” it.
Imposter scams: the same trick without the link
An imposter scam skips the fake webpage and simply has a person impersonate someone you’d trust: a government official, a company’s support line, a grandchild in trouble, a co-worker asking for an urgent transfer. The plausibility comes from research - a scammer targeting a business might reference real employee names and a real vendor relationship, pulled from public sources, to make an email request for payment sound routine.
Caller ID and sender names can both be spoofed relatively easily and are not reliable proof of who is actually contacting you. The only reliable verification is to end the contact and reach the institution or person yourself, through a number or address you already had - not one provided in the suspicious message.
Why this connects to the rest of this module
The next lesson looks at investment and romance scams, which use these same phishing and impersonation techniques but stretched over a much longer timeline - sometimes weeks or months - before asking for money.
- Phishing uses spoofed senders and copied branding to make a fake request look trustworthy.
- Mismatched links, generic greetings, and manufactured urgency are the most reliable tells.
- Imposter scams use the same pressure without a fake webpage, relying on impersonation alone.
- Caller ID and sender names can be spoofed - always verify independently, through a number you already had.