Spotting The Scam

Spot the Scam Before You Click: The Red Flag Filter

What’s the fastest way to lose money or hand over your account to a stranger? It usually starts with one tap on a message that “sounds right” for half a second.

Emails, texts, and DMs don’t need to be well-written to work. Scammers count on urgency, confusion, and your habit of replying quickly. This chapter gives you a simple way to slow down on purpose: The RED FLAG Filter. You’ll learn the most common warning signs in messages and how to check them in seconds - before you click a link, download an attachment, or send money.

After this, you’ll be able to look at a message and answer three questions fast: Is this message pushing me to act now? Is the sender where they claim to be? Does the content match what a real person or business would say? You’ll also get a practical walkthrough using Tanya, a 34-year-old rideshare driver, because her phone is a magnet for fake “account” and “payment” messages.

Practical takeaway: Your goal isn’t to “spot scams perfectly.” Your goal is to build a habit that catches the obvious red flags every time.

---

The Most Common Message Red Flags (and What to Do With Each)

Scam messages follow patterns. Once you know the patterns, you stop guessing. Use The RED FLAG Filter to scan any email, text, or DM you receive. Each letter points to a specific thing you check.

1. R - Rush / urgency language

Scammers push fast action because you make worse decisions under pressure. Look for phrases like “act now,” “final notice,” “your account will be suspended today,” or “confirm within 2 hours.”

Why it matters: Urgency blocks your normal checks - sender, links, account details.

What to do: If you see urgency, do not click or reply. Move the message aside and verify it using a separate path (more on that soon).

2. E - Expectation mismatch

The message asks for something that doesn’t fit your real situation or the company’s usual style. Maybe it asks you to “update your banking info” when you haven’t changed anything, or it uses vague wording like “we noticed unusual activity” without details.

Why it matters: Real businesses explain the issue clearly and reference your account context. Scammers keep it blurry so you can’t check accuracy.

What to do: Compare the request to what you actually did recently. If it doesn’t match, treat it as suspicious.

3. D - Doorway links / attachments

Watch for links that look like they go to a login page, a “security check,” or a “document.” Also watch for attachments like “invoice.pdf,” “payment details,” or “verification.doc.”

Why it matters: The link or file often leads to a fake login page or malware.

What to do: Don’t open links from the message. Don’t open attachments you weren’t expecting. Verify using the official app or the company’s website you type yourself.

4. F - Fake sender signals

The sender name might look right, but the real address or handle doesn’t. Common signs include weird domains, misspellings, or a “support” account that doesn’t match the company’s usual identity.

Why it matters: Scammers forge appearances. They can’t forge your careful checks.

What to do: Check the actual sender address (email) or the exact profile/handle (DM). If you can’t verify it, don’t engage.

Each red flag becomes stronger when you see more than one in the same message. One red flag can be a mistake or a legit notice. Two or more usually means the message is trying to bypass your brain.

Quick self-check: Ask yourself, “If I received this from a real company I trust, would they need me to click a link inside the message to fix it?”

---

The RED FLAG Filter in Action (Tanya’s Rideshare Messages)

Tanya, 34, drives part-time and spends a lot of time on her phone. Scammers love that. She gets messages that look like they’re about “driver verification,” “payment hold,” or “safety checks.” The trick is to treat every unexpected message like a mechanic who wants you to sign paperwork before you see the invoice.

Here’s how Tanya applies The RED FLAG Filter to every suspicious message - without guessing.

Step-by-step: scan, then verify the safe way

1. Pause and read the top line for urgency (R)

Tanya looks for words that force speed: “today,” “immediately,” “final,” “within 2 hours,” or “account will be closed.”

Expected outcome: If she sees urgency, she treats it as suspicious automatically, even if the message looks polished.

2. Check whether the request matches her real activity (E)

If the message claims she needs to “update banking info” but she hasn’t updated anything, she flags it. If it says “we detected suspicious logins” but doesn’t tell her what time/location, she flags it too.

Expected outcome: Mismatch = higher risk. She doesn’t treat it like a normal support ticket.

3....