I · Protection
Cognitive Defense
analysistraining
How fraud and scams select a person, work them, and drain them.
Last reviewed 2026-10-07
Scale
Reported to the FTC as fraud losses in 2024
$12.5 billion
Reported. The true figure is larger, because most fraud is never reported. The median loss across all fraud reports was $497 — the average is pulled up by a few catastrophic losses.
FTC Consumer Sentinel Network Data Book 2024
Lost to investment fraud alone in 2024
$5.7 billion
The largest single FTC loss category, and the one that empties retirement accounts rather than checking accounts. Imposter scams were second at $2.95 billion.
FTC Consumer Sentinel Network Data Book 2024
Losses reported to the FBI’s IC3 in 2025
$20.9 billion
A 26% rise year over year across 1,008,597 complaints. Business email compromise alone: $3.05 billion across 24,768 complaints — roughly $122,900 per complaint.
FBI IC3 Internet Crime Report 2025
IC3 losses reported by people 60 and over in 2025
$7.75 billion
Up 59% in a year, across 201,266 complaints, averaging $38,500. Over 12,000 people in that age group each lost more than $100,000.
FBI IC3 Elder Fraud Report 2025
Two True Things
Who Reports Losing Money
Adults in their twenties reported losing money in 44% of their fraud contacts. Adults in their seventies reported losing money in 24% of theirs.
The folk belief is that fraud is an elderly problem. Younger adults are defrauded successfully more often.
Who Loses More When It Lands
Median loss for people 80 and over was $1,650. For the 70–79 group, $1,000. For the 20–29 group, $417.
Both facts are true at once. Younger people get hit more; older people get hit harder. A curriculum that teaches only the second half leaves most victims out.
The Most Common Approach Is Not the Most Expensive
Email produced the most reports — 371,651 — and 11% of them involved a loss. Online ads and pop-ups produced the fewest — 42,023 — but 62% of those involved a loss.
Volume and danger are different axes. Treating the loudest channel as the worst one wastes attention.
The Most Expensive Approach Is a Phone Call
Highest median losses by contact method: phone calls at $1,500, text messages at $1,000, mail at $990, and other methods at $633.
In 2024 the phone had the highest median loss, because the people it reaches are the people with assets and the approach is slow enough to build trust.
Five Mechanics
Time Pressure Is the Load-Bearing Element
Almost every successful approach installs a deadline. The warrant is being served today. The account closes in an hour. The investment window shuts tonight. This is not decoration. Urgency prevents the one action that defeats nearly all of it: stopping to check through a channel the other person did not supply.
Research on affect and risk perception finds that emotional arousal reorganizes how risk is judged, substituting a felt sense of good or bad for deliberate evaluation. Applied phishing research finds persuasion cues and time constraints interact — the same message lands differently under a clock.
Authority Is Claimed, Never Verified In-Band
The caller says they are from the bank’s fraud department, the Social Security Administration, or the sheriff’s office. The claim arrives inside the same channel as the request, which means the channel cannot confirm it. Caller ID is trivially forged, and a spoofed number is the cheapest part of the operation.
The SSA’s Office of the Inspector General and the IRS both publish standing statements that their agencies do not demand immediate payment by phone, do not demand payment in gift cards, and do not threaten arrest over the telephone. The FTC’s government-impersonation guidance says the same.
Isolation From Anyone Who Would Say No
A worked target is told not to discuss it. The investigation is confidential. The surprise will be ruined. Your family will not understand the opportunity. The instruction to keep quiet appears in confidence, investment and government-impersonation fraud. It exists to remove the one person who is not under the spell.
FinCEN’s 2022 advisory on elder financial exploitation and its 2023 alert on the confidence-fraud pattern known as pig butchering both describe extended relationship-building followed by isolation from family and advisers as characteristic.
Time Invested Is the Product
Confidence fraud is not a call; it is a correspondence — weeks or months of ordinary, warm, unremarkable contact before money is ever mentioned. The relationship is the instrument. By the time an ask appears, refusing it feels like betraying a person rather than declining a proposition.
IC3’s 2025 figures: confidence and romance fraud, $929.3 million across 23,159 complaints, averaging about $40,100 each — losses per victim far above most categories, which is what long build-up buys.
A Familiar Voice Is No Longer Evidence
The family-emergency call — a grandchild arrested, in an accident, needing bail — now arrives in a cloned voice built from a few seconds of public audio. The FTC issued its consumer alert on this pattern in March 2023. In February 2024 the FCC ruled that SI-generated voices in calls are “artificial” voices under the Telephone Consumer Protection Act, which makes such robocalls illegal but does nothing to stop a targeted one.
The FCC ruling is the regulatory hook; the FTC alert is the fraud description. Neither claims that detection by ear is reliable, because it is not.
Payment Decides Recovery
| Method | Recovery | Law |
|---|---|---|
| Credit card | Strongest | Fair Credit Billing Act |
| Debit card and ACH | Real but weaker | Electronic Fund Transfer Act, Regulation E (12 CFR 1005) |
| Traditional wire transfer | Historically none | UCC Article 4A, not the consumer regime |
| Zelle-type push payments | Contested | Unsettled; enforcement posture has reversed |
| Gift cards | None | No consumer recovery regime |
| Cryptocurrency and cash | None | No consumer recovery regime |
Credit card. Liability for unauthorized charges is capped at $50 by statute, and in practice every major network offers zero. Disputes are a defined process with a defined timeline.
Debit card and ACH. Error-resolution rights and liability caps that can be as low as $50 if you report promptly — and that grow sharply the longer you wait. The money leaves your actual account first and comes back later, if it comes back.
Traditional wire transfer. A wire you were tricked into authorizing has historically sat outside Regulation E. One federal district court, in New York v. Citibank, held that some parts of a consumer wire can fall under the Electronic Fund Transfer Act. The Second Circuit heard that appeal on April 6, 2026. No decision is cited here; treat the law as unsettled. A wire is still not a protection you can count on.
Zelle-type push payments. An authorized push payment — one you were manipulated into sending — is generally not protected the way an unauthorized card charge is. The CFPB sued over Zelle fraud in December 2024 and dismissed that case in March 2025. New York filed its own case in August 2025. Neither case gets your money back.
Gift cards. For years the FTC has documented gift cards as scammers’ preferred payment method, for the reason that makes them useless to you: once the code is read aloud, the value is gone and untraceable.
Cryptocurrency and cash. Irreversible by design. The FTC’s 2024 investment-fraud figure was $5.7 billion. IC3’s 2025 report put crypto investment scams at $7.2 billion. Most of that money has no chargeback.
Afterward
Report Fast to IC3
Call your bank right away and ask for a recall, then file at ic3.gov. The FBI’s Recovery Asset Team coordinates freeze requests with receiving banks. In the 2025 Internet Crime Report the team handled 3,900 incidents, $1.16 billion in attempted theft, and froze $679 million — a 58% success rate. Recovery still depends on speed measured in hours.
Report to the FTC
reportfraud.ftc.gov feeds the Consumer Sentinel database. That is where the FTC loss figures come from. It does not recover money. It is how the pattern becomes visible to the people who bring cases.
Identity Theft Has Its Own Track
identitytheft.gov produces a personalized recovery plan and the affidavit that other institutions will ask for.
Freeze Credit Before You Need To
A security freeze at each of the three nationwide bureaus has been free by federal law since the Economic Growth, Regulatory Relief, and Consumer Protection Act took effect on September 21, 2018. It blocks new accounts in your name, costs nothing, and is lifted temporarily when you need credit.
Tell the Household
The isolation the approach depends on is broken by saying it out loud. The shame that keeps victims silent is itself part of the mechanism, and it is the reason the reported numbers are floors rather than measurements.
Structure Over Vigilance
Prebunking Has Measured Effects, and They Fade
Inoculation research — exposing people to a weakened form of a manipulation technique before they meet the real one — has genuine field evidence behind it, including a large randomized study run through YouTube advertising by researchers with Google’s Jigsaw unit, published in Royal Society Open Science in 2022. It also has a documented failure to replicate: a re-examination in an Indian sample found no improvement in discriminating true from false headlines. The effects that do appear decay over weeks.
Teach it as real but perishable. One exposure is not immunity, and a technique that works in one population may not transfer to another.
Phishing Training May Do Far Less Than Assumed
A field study across 12,511 employees at a US financial technology firm found no significant effect of embedded phishing training on click rates or reporting rates, with negligible effect sizes. What did predict clicking was the difficulty of the lure — about 7% for easy lures against 15% for difficult ones. A separate study found individual susceptibility is not even stable across repeated trials, which undercuts the idea of a reliably phishing-prone person.
This is recent work and some of it is still in preprint, so hold it loosely. But it points somewhere useful: design your accounts so that clicking the wrong thing is survivable, rather than trying to train yourself into never clicking.
The Controls That Work Are Structural, Not Vigilant
Nothing on this page asks you to be more alert. Phishing-resistant sign-in on your email, a credit freeze, a card instead of a wire, a household verification phrase, and a standing rule that no deadline survives a callback — these work while you are tired, distracted and being lied to convincingly, which is the only condition that matters.
Vigilance is a resource that runs out. Structure is not.