Scam Prevention
< BLOG
Scam prevention needs a rethink
We have spent years telling people how not to get scammed. Don’t click the link. Don’t give out your details. Check the sender. Don’t be pressured. If something looks too good to be true, it probably is. All sensible advice. But there is a problem with scam prevention when that advice becomes the main line of defence. It assumes that the person being attacked is in the best position to defend themselves. The latest research suggests that assumption needs a rethink.
Scammers aren’t looking for stupid people
Recent research analysing millions of scam-related domain signals found that the general population was the largest target group, accounting for over one third of the analysis. This pattern suggests that scammers often use volume rather than carefully selecting a particular type of person.
In other words, scammers don’t necessarily need to find a vulnerable person. They can simply reach enough people. This matters because it challenges the idea of the “typical scam victim”. There isn’t one. You don’t have to be old. You don’t have to be gullible. You don’t have to be bad with technology. You simply have to be in the wrong situation at the wrong time.
The vulnerability can be temporary
This is perhaps the most important point. The research found that scammers were more likely to exploit situational vulnerabilities than fixed personal characteristics. Financial pressure, emotional stress, uncertainty, loneliness and other temporary circumstances can all create an opening. Financial distress or financial aspiration was the largest category identified, followed by emotional stress and situational crises.
Think about what that means. Someone receives a message saying their bank account has been compromised. Normally, they would stop and check it. But today they’re worried about money. Or they’ve just had a difficult conversation. They’re tired. They’re distracted. The message says they have ten minutes to act. The scam hasn’t necessarily become more convincing. The circumstances have changed.
That is a very different way of looking at scam prevention.
“Be careful” isn’t much of a strategy
We often treat scam awareness as though it were a test. Teach people the warning signs and expect them to apply the knowledge when necessary. But scammers deliberately create conditions where normal decision-making becomes harder. Pressure. Urgency. Fear. Authority. Financial opportunity. Emotional connection. Relief from a problem.
These are not random ingredients. They are ways of getting someone to act before they have time to properly assess what is happening. So telling somebody to “be careful” isn’t necessarily addressing the mechanism being used against them. The scammer isn’t waiting patiently for the victim to make a considered decision.
They’re trying to prevent one.
The usual story about older people doesn’t tell the whole story
Another finding challenges a familiar assumption about scams. Older adults were not the most targeted group in the research. Working-age adults aged 18–60 accounted for 58.4% of the targeted signals. That does not mean older people aren’t at risk. They clearly are.
It does mean that designing scam prevention around the idea of the elderly person as the typical victim risks missing a much larger target population. The average internet user is already part of the target market.
Some scams are deliberately precise
There is another side to this.
Some scams are broad and designed to catch whoever happens to respond. Others are much more specific. The research found evidence of more targeted tactics against groups with particular characteristics, including cases where scammers appear to target both an individual and the people around them.
That could mean family members. Carers. Support organisations. Community groups.
The scammer isn’t necessarily attacking one person in isolation. They may be exploiting the network of trust around them. That makes scam prevention an ecosystem problem. And that is where the idea of safeguarding becomes interesting.
What if scam prevention was treated as safeguarding?
We already understand the principle of safeguarding in areas such as health, education and social care. The responsibility for protecting someone from harm doesn’t sit entirely with the person who might be harmed.
The people and organisations around them have a role too. Why shouldn’t the same principle apply to scams?
Instead of asking:
- “How do we teach people not to fall for scams?”
we could ask:
- “How do we make it harder for scams to succeed?”
That is a much more useful question.
The system should notice what the individual can’t
Consider what different organisations can see.
- A bank can see unusual payment behaviour.
- A technology platform can see suspicious activity.
- A telecommunications provider can identify patterns of communication.
- A business can recognise an unusual request from a customer.
- A community organisation may know that someone is currently dealing with a difficult situation.
- A family member may notice that something has changed.
Individually, none of these organisations necessarily has the complete picture. Together, they might. A safeguarding approach to scam prevention is about making that collective protection practical. It means designing systems and processes that can recognise potential risk and intervene at the right moment.
Not after the money has gone.
Before.
This is a systems problem
There is a broader lesson here. We tend to design processes around the assumption that the person using them is operating normally. But people don’t operate in a constant state. Their circumstances change. Their attention changes. Their confidence changes. Their ability to make decisions changes. A good system recognises that. It doesn’t simply put a warning on the screen and say:
“We’ve told you. The rest is up to you.”
It uses the information available to provide another layer of protection. That doesn’t remove personal responsibility. It recognises that personal responsibility isn’t always enough when the other side has deliberately engineered the situation.
Prevention needs to happen before the decision
This is where scam prevention needs to change. Awareness still matters. People should know what common scams look like. But awareness is only one layer of defence.
The more useful question is what happens when the warning signs appear. Does the system recognise them? Does somebody have the ability to intervene? Can relevant information be shared? Can a customer be given a warning that makes sense in the context of what they are actually doing? Can a trusted person become involved before financial harm occurs?
These are system questions, not awareness questions.
From awareness to safeguarding
The shift is actually quite simple.
From: “Don’t get scammed.” To: “Let’s make it harder for a scam to succeed.” The first puts the burden on the individual. The second asks what everyone around that individual can do.
That includes businesses. Banks. Technology companies. Telecommunications providers. Government. Community organisations. And anyone else operating a system through which a scam can develop. This doesn’t mean trying to eliminate every risk. It means recognising that the individual should not always be the last line of defence.
The real opportunity
The interesting thing about this approach isn’t another awareness campaign. We’ve had plenty of those. The opportunity is to rethink where intervention happens. A scam doesn’t suddenly appear at the moment money leaves an account.
There is usually a sequence. A contact. A conversation. A request. A sense of urgency. A change in behaviour. A payment. There may be opportunities to interrupt that sequence long before the final transaction.
That requires organisations to look beyond their own narrow part of the process. It requires information to move. It requires people to recognise risk. And it requires systems to be designed around what actually happens to people, rather than how we would ideally like them to behave.
Anyone can be vulnerable at the wrong moment
Perhaps the most useful thing to take from the research is this: Being vulnerable isn’t necessarily a permanent condition. Someone can be completely capable of spotting a scam tomorrow and still be caught by one today.
They may be frightened. Tired. Lonely. Under financial pressure. Distracted. Or simply dealing with too much at once. The scammer doesn’t need them to be stupid. They need them to be human. That changes how we should think about scam prevention. The answer isn’t to stop educating people.
It is to stop pretending education alone is enough. If scammers are professionalising the way they exploit people, then the systems around those people need to become better at protecting them. That is the move from awareness to safeguarding. And it may be one of the most important changes we can make in how we prevent scams.
