Spot the Scam: A Free Tip Sheet for Cybersecurity Awareness Month

Free to print and share · Updated October 2026

October is Cybersecurity Awareness Month. In fiction, cyber threats look like Digital Shadows in California, where Jennifer Johnson's cybersecurity team races to unmask a hacker called The Phantom, or Veil of the 4th of July, where the Johnsons have hours to stop a cyberattack on San Diego. In real life, most attacks start with something much smaller: a text, an email or a phone call that tries to rush you. The novels are fiction. The tips below are real, and you are welcome to print and share them at work, church, school or a family dinner.

The 10-second check: four red flags

Urgency or fear. "Your account will be closed today," "a warrant is out for you," "your grandson is in jail." Pressure to act right now is the most common scam tactic. Slow down.
A strange way to pay. Gift cards, wire transfers, cryptocurrency, payment apps to a stranger, or cash handed to a courier. Legitimate businesses and government agencies don't demand payment this way.
A request for a code or password. Never share a one-time passcode, MFA code, PIN or password with anyone who contacts you, even if they say they are your bank, a tech company or the police. Those codes are only for you to type in.
The contact came to you. An unexpected message with a link, attachment or phone number. Don't use the contact details in the message; go to the company yourself.

What to do instead

Verify on your own. Close the message, then open the official app or type the website address yourself, or call the number on the back of your card or on a statement.
Look before you click. Check the sender's actual email address and, on a computer, hover over links to see where they really go. Misspellings, extra words and odd domains (for example, a bank name followed by "-secure-login") are warning signs.
Caller ID can lie. Scammers can fake the name and number that appear on your phone. Hang up and call back using a number you already trust.
Talk to someone. Scammers often say "don't tell anyone." That alone is a red flag. Check with a family member or friend before you send money or information.

Scams to watch for this season

Fake delivery texts about a missed package or a small "redelivery fee." Track packages only in the retailer's or carrier's own app or website.
Look-alike shopping sites and too-good-to-be-true deals in ads and social posts. Buy from stores you know, and pay with a credit card, which generally gives you stronger dispute rights than a debit card, wire or gift card.
Charity scams that spike around Thanksgiving and Christmas. Give through the charity's own website rather than a link in a message.
"Family emergency" calls, sometimes using an AI-cloned voice of a loved one. Agree on a family safe word now, and hang up and call the person directly.
Tech-support pop-ups that say your computer is infected and give a number to call. Real companies don't do this. Close the browser.
QR codes on parking meters, flyers or in unexpected emails. Check the web address before entering any payment details.
Job and "easy money" offers that pay you to reship packages, buy gift cards or move money. These are often fraud.

Make yourself a hard target (the 2026 theme: "Don't Make It Easy for Them")

Use a password manager and a different, long password or passphrase for every account.
Turn on multifactor authentication (MFA), starting with email, banking and social media. An authenticator app or passkey is stronger than text-message codes.
Update your software on phones, computers and routers. Turn on automatic updates.
Freeze your credit at Equifax, Experian and TransUnion. It's free and stops most new-account fraud; you can lift it when you need credit.

These four habits follow the National Cybersecurity Alliance's Cybersecurity Awareness Month guidance: staysafeonline.org.

If it happened to you

Act fast: call your bank or card company using the number on your card, change the affected passwords, and turn on MFA.
Report scams and fraud to the Federal Trade Commission at ReportFraud.ftc.gov.
Report internet crime to the FBI's Internet Crime Complaint Center at ic3.gov.
Identity theft? Get a recovery plan at IdentityTheft.gov.
Scam texts: forward them to 7726 (SPAM) to report them to your carrier, then delete them.
Phishing emails: forward them to reportphishing@apwg.org, and use your email app's "report phishing" button.

There is no shame in being targeted. Scammers are professionals, and reporting helps protect the next person.

Talk about it: discussion starters for families, classes and groups

Have you or someone you know received a message that tried to rush you? What gave it away?
Which of the four red flags would be hardest for you to notice in the moment, and why?
What would your family's safe word be, and who needs to know it?
In thrillers like Digital Shadows in California, a whole team works to stop a hacker. In real life, who is on your "team" for checking a suspicious message?

For kids and teens

Never share passwords or codes, even with friends. A real company or game will never ask for them in a message.
If someone online offers free game currency, prizes or money "if you just" click, log in or pay, tell a parent or teacher first.
Money Magic for Kids also covers spotting scams for ages 7 to 12, and there is a free family discussion guide for it.

Questions or a group reading this book? Email markoliverauthor@gmail.com.