When anyone contacts you claiming to be your bank, a government agency, a utility, or a company you deal with, hang up and call back on the number printed on your card, statement, or the organization's official website, never the number they gave you.

How to do it

1. 1End the contact politely and without explanation. You do not owe a caller a reason; "I will call the bank directly" is a complete sentence.
2. 2Find the number yourself: the back of your debit or credit card, a paper statement, the app you already have installed, or the official website typed in by hand, not one reached through a search ad or a link in the message.
3. 3If the inbound call came on a landline, use a different phone or wait a full minute and listen for a dial tone before dialing; some courier-fraud schemes have relied on the original line being held open so that the "callback" reaches the scammer again.
4. 4Tell the real organization what the caller claimed. Fraud teams will confirm or deny an inquiry, and the report helps them warn others.
5. 5Apply the same rule to texts, emails, pop-ups, and social-media messages: contact details inside a message are never the ones you use to check it.

When to use it

• •A call, text, or pop-up says your account is compromised, a payment failed, a package is held, or a warrant, fine, or tax debt is outstanding.
• •Someone claiming to be from tech support or a fraud department wants remote access, a one-time code, or a transfer.
• •A "grandchild", "boss", or "colleague" calls or messages in distress asking for money.
• •An inbound call comes from a number that matches the real organization; matching numbers are exactly what spoofing produces.

Counters

Evidence and how strong it is

The callback rule is the most repeated piece of consumer fraud advice from the US Federal Trade Commission and the FBI, and it targets the two conditions every impersonation scam needs: the scammer controls the channel, and the target acts before checking. Caller-ID spoofing makes the displayed number worthless as evidence, which the Federal Communications Commission acknowledges in its consumer guidance and in the STIR/SHAKEN caller-authentication framework it has required of major carriers since 2021; authentication has reduced some spoofing but has not eliminated it. Impersonation of government and business became a large enough category that the FTC issued a trade regulation rule against it in 2024, and the agency reported more than $10 billion in overall fraud losses for 2023, with imposter scams the most-reported category. Evidence strength: regulator and practitioner consensus grounded in complaint data. The rule has not been tested in a controlled trial, but its logic is structural rather than psychological, which is why it holds up regardless of how convincing the caller is.

1. US Federal Trade Commission (2024). As Nationwide Fraud Losses Top $10 Billion in 2023, FTC Steps Up Efforts to Protect the Public. FTC press release, February 2024
   The scale of reported 2023 fraud losses and the position of imposter scams as the most-reported category.
2. US Federal Trade Commission (2024). Trade Regulation Rule on Impersonation of Government and Businesses (16 CFR Part 461). Federal Register
   The regulatory recognition of impersonation as a distinct fraud category and the accompanying consumer guidance to hang up and call back on a number you find yourself.
3. US Federal Communications Commission (2024). Caller ID Spoofing. FCC consumer guide
   The explanation that displayed caller ID can be falsified and that STIR/SHAKEN reduces but does not eliminate spoofing.
4. Hadnagy, C. (2018). Social Engineering: The Science of Human Hacking (2nd ed.). Wiley
   Practitioner description of voice-phishing pretexts and why the target must control the verification channel.