Section of the glossary
Eight schemes named by mechanism rather than by emotion. Each entry states the step without which the scheme does not work, because that is the step to close.
English version for the United Kingdom.
Also: fake page
Collecting credentials through a page that reproduces the appearance of a real service.
The loss occurs at the moment of entry rather than at the moment the link is opened. So the rule is not «do not open links» but «do not enter data on a page you reached from a message».
A padlock in the address bar proves nothing: it means the connection is encrypted, and certificates are issued automatically and free of charge.
Also: cover story
A prepared scenario and role under which a conversation is conducted.
A cover story always contains a deadline: an account about to be blocked, a parcel about to be returned. The deadline exists not for plausibility but to stop the person leaving the conversation to verify.
Trying to detect deception by voice does not work against a cover story. The callback rule does: end the conversation and restart it from your side.
Also: telephone fraud
Pretexting by telephone, usually in the name of a bank, support or a government service.
Caller ID is spoofed, and it is spoofed onto the official number specifically, so a matching number is not a confirmation.
Three requests end the conversation without discussion: read out a code, install a program, move money to a «safe account».
Also: clipboard hijacking
Replacing a copied payment address with somebody else's at the moment of pasting.
It is done by malware or by a person sending a «corrected» address. Checking the first and last characters does not help: similar addresses are generated for exactly that habit.
Only a full comparison against a source you control works: the contract or the account portal, not the message.
Also: BEC
Substituting payment details inside existing working correspondence.
The letter comes from a genuine address, in a genuine thread, after the thread has been read. It contains no signs of forgery, because in the technical sense there is no forgery.
One measure closes the category: details are changed only after confirmation by voice on a number that was known beforehand.
Also: long acquaintance
A scheme in which trust is built over weeks before the first request for money.
It differs by duration and by the absence of early requests, so the usual signs of hurry do not apply. The first request appears once the relationship is already subjectively valuable.
The structural sign remains: the money leaves by a route with no way back, and a meeting in person is postponed for outwardly reasonable causes.
Also: doubling
A promise to return a multiple of the amount sent.
The scheme relies on an outgoing transfer made by the victim, which makes it genuine, authorised and final.
One structural check covers it: no lawful operation requires sending money first in order to receive more.
Also: impostor support channel
A channel or profile presenting itself as the support service of a company.
It is found through search, through advertising or through a reply to a public complaint. Turning to «support» that wrote to you first is an inbound contact with all of its properties.
Support is opened only from inside the app or from the official site typed by hand. Genuine support does not ask for a recovery phrase and does not ask you to install anything.
| Scheme | Depends on the step | What closes it |
|---|---|---|
| Phishing | Entering data on the page you arrived at | Open the service yourself |
| Vishing | Continuing the inbound conversation | The callback rule |
| Address substitution | Trusting the pasted address | Full comparison with the contract |
| Business email compromise | Paying to the new details | Confirmation by voice |
| Giveaway | The victim's outgoing transfer | Nobody requires you to send first |
| Fake support | Turning to the channel you found | Support only from inside the app |