Reading time: 5 Minutes
MWi Hack
-
Write down the real phone number for one organization that handles your money or your benefits. Take it from a statement, a bill, or the back of your card, not from a message someone sent you. Save it in your contacts under a name you will recognize. That is the number you call when someone reaches out claiming to be them.
MWi Summary
- The behavior challenge starts this week, and it focuses on who is contacting you. October 1 covered your own accounts; this is about someone reaching out claiming to be an organization you deal with.
- The standard advice is to examine the message: the spelling, the sending address, how hard it pushes you to act now. That advice rested on something that was true for years: writing a clean, personal, specific message cost a person real time.
- It costs much less now. The same effort produces far more attempts, each one written for the person receiving it, without the surface errors that used to give them away.
- The arithmetic runs against the reader. A person has to judge correctly every time, and the other side has to succeed only once.
- The FTC’s instruction skips judging the message altogether: if a call or message might be real, hang up and call the organization at a number you know is correct. It adds that caller ID can display a real agency name or number and still be faked.
- The FTC also states what agencies do not do. They do not call, email or text asking for money or personal information, and VA’s own material adds that no one should ever be given VA.gov or eBenefits sign-in credentials.
Nothing Looks Wrong
A message arrives about your benefits. It uses your name. It mentions a claim, or an appeal, or a payment that needs confirming. The number on the screen belongs to an agency you recognize. Nothing about it looks wrong.
For years the standard guidance was to look closely at messages like that one. Check the spelling. Look at the sending address. Notice when something pushes you to act immediately. That guidance was sound, and it rested on something that is less true than it was: that writing a clean, specific, personal message took a person real time.
Producing a plausible approach used to be the expensive part of the work. That is why the same text got reused across thousands of people, and why the errors everyone was taught to look for were there at all.
AI Security
The FBI put this in writing in December 2024. Generative AI, its notice says, reduces the time and effort criminals must spend deceiving their targets, and helps them overcome common indicators of fraud schemes. It names translation tools that limit grammatical and spelling errors, which is exactly what people were taught to watch for.
Voice is part of it. The same notice describes cloned audio used to impersonate a relative in a crisis and ask for money, and used to access bank accounts.
It also arrives in more places. The same approach can come as a text, then an email, then a call, inside the same week.
Its two recommendations are the two actions in this week’s challenge. Verify someone by hanging up, looking up the contact yourself, and calling that number. And agree a word or phrase with your family that you can ask for. Neither takes more than five minutes.
The Arithmetic
A person has to be right every time. Whoever is on the other side has to be right once. Someone who receives ten approaches in a year and judges nine of them correctly has still had a bad year.
The attempts that get through tend to arrive when someone is tired, or driving, or partway through something else.
AWKO, a law firm that represents victims of fraud, describes the VA versions.
Veterans make up a large part of our client constituency. Occasionally, we will see a new wave of scams that, though different in their design, share a remarkably consistent pattern. The scams have included veterans who purportedly owed VA healthcare related co-pays, received VA disability overpayments in error, or have an opportunity to purchase new, amazing VA life-insurance policies. However, in each instance, the perpetrators impersonate a member of a trusted organization (VA, bank, etc.), create a sense of urgency, and solicit payment by various means, including credit card, third party payors (Venmo, PayPal, Zelle, etc.), wire transfers, and the like. Recasting an iconic expression: Don’t Trust but Verify, Verify First.
What the FTC Says Instead
The FTC has already moved past spotting. Its instruction is direct: if a call or message might be real, stop, hang up, and call the agency at a number you know is correct. It adds that caller ID should not be trusted, because the display can show a real agency name or number and still be faked.
That moves the work from judging a message to choosing a channel. You reach the organization by a route you already had, which settles it either way.
What VA Will Not Ask For
VA’s own outreach material is specific on one point. Sign-in credentials for VA.gov and eBenefits should never be given to anyone who asks for them, including someone who says they are calling from VA. There is no situation in which that is the correct step.
AWKO describes what follows.
The moment a target provides the scammer with personal information, or a victim acts upon a fraudulent request, it may be too late. Sometimes, the scam continues with escalated requests. By the time doubt surfaces, victims are often isolated from family, drained of savings, and convinced that one more payment will recover the loss. Clients often say they should have been smarter or caught an irregularity, but no level of education or sophistication is immune. Taking swift action such as contacting banks, informing authorities, and seeking advice from counsel, offers the greatest chance of recovery.
One Number, Saved Early
This is a smaller habit than it sounds. It is one number, written down once, from a source that came to you rather than from a message that found you.
Pick the organization where it would matter most, which for most people is wherever the money lands. Then nothing has to be decided under pressure later.
Resource
How To Avoid a Government Impersonation Scam, Federal Trade Commission (consumer.ftc.gov/articles/how-avoid-government-impersonation-scam). Written for the general public rather than for an organization. It covers impersonation of specific agencies, states what government agencies will not do, and gives the instruction this article is built on: if a call or message might be real, hang up and call the agency at a number you know is correct. It also warns that caller ID can show a real agency name or number and still be faked. It does not cover AI or voice cloning.
