Six doorways into your life, and what each one can convincingly fake.
The word for faking the "who's contacting you" part is spoofing. It applies to nearly every doorway below — the phone number, the sender name, the email address, the website, even a voice. Once you know what can be faked, the whole thing gets easier. You stop asking "does this look real?" and start asking "how would I check?"
What can be faked: everything on your screen. The caller chooses what number and name you see. They can display your bank's real main number, your doctor's office, a government agency, or a number from your own town and area code so it looks like a neighbor calling.
How the good ones sound: calm and helpful, never threatening. "We've stopped a suspicious charge on your card — I just need to verify I'm speaking with the right person." They may already know your name, your address, and the last four digits of your card. They may even warn you not to give out personal information, which sounds exactly like something a real bank would say.
The giveaway: sooner or later they need something from you that they could not get any other way — a code, a PIN, a password, a transfer, an app installed. A real bank already has your account open in front of them.
What can be faked: the sender name and number, and the look of the link. A text can even land in the same thread as genuine messages from a company, which makes a fake one look like part of a conversation you already trust.
The usual stories: a package can't be delivered · an unpaid toll · a bank fraud alert · "is this still your address?" · or a friendly wrong-number message that turns into a chat and, weeks later, mentions an investment opportunity.
The giveaway: the web address. Read it slowly, left to right, and find the part immediately before the first single slash. That's the real destination. usps.com/tracking is the Postal Service. usps-trackhelp.com is not — and neither is usps.tracking-help.com.
What can be faked: the display name, the logo, the layout, the footer, even the unsubscribe link. A scam email can be a pixel-perfect copy of a real one — because it usually is a copy, with the links changed.
The giveaway: the actual sending address, not the friendly name sitting on top of it. On a computer, hover over the sender; on a phone, tap the sender name to expand it. What matters is the part after the @ symbol. service@chase.com is a bank. chase@service-alerts.net is a stranger.
A newer twist: the email arrives after the phone call, to make the call feel official — which is exactly what happened to the gentleman in our story. Receiving a confirmation email proves only that someone has your email address.
What it looks like: a full-screen warning, often with an alarm noise or a robotic voice. "Your computer is infected. Do not restart. Call support now at this number." Sometimes the window won't close, which is the entire point — the panic is the product.
The truth: Microsoft, Apple, and Google do not scan your computer and put a phone number on your screen. Not ever. A security warning containing a phone number is a scam every single time, without exception.
Where it leads: you call, they ask to "connect to your computer so we can fix it," and now a stranger is operating your machine — usually while walking you into your online banking.
This is the newest doorway, and the cruelest. A few seconds of someone's voice — from a voicemail greeting, a video, a post online — is now enough to produce a convincing copy of it. So the call comes in and it sounds like your grandson: upset, in trouble, needing money right away, asking you please not to tell his parents.
The tells are exactly what they have always been: an emergency, a demand for secrecy, and an unusual way to pay. What's changed is that the voice being right no longer means anything at all.
Mail: official-looking notices about your Medicare card, a home warranty, a car warranty about to expire, or unclaimed property supposedly owed to you. Convincing letterhead costs nothing to print. Same rule applies — look the office up independently and contact them yourself.
Buying and selling online: a buyer who insists on overpaying, or who texts you a code to "verify you're a real seller." That code is a verification code for an account being opened in your name. Or a rental, or a puppy, that can only be paid for by wire or gift card, sight unseen. If it's cheap and urgent and can't be seen in person, it isn't there.
They chose how to contact you. You choose how to respond.
Every doorway above is one they control. The moment you close it and reach back out through a channel you control — a number you already had, an app you already use, a person you already know — the scam is finished.