Yesterday I posted a reply on this discussion, but I really feel that scam prevention as a whole might be best separated and emphasised in its own topic.
This is a topic that I'm very passionate about so forgive me if my zeal gets in the way of the message, but my fellow Cheapies, I'm sure you'll all agree that the only thing better than saving a heap of money on a great deal is not losing a heap of money to a scammer when you might have.
So rather than getting lost in the comment section of another post, I'm reposting my comment here for discussion:
With all the news recently and the TVNZ Nigel Latta doco coming out, I have had some discussion with my son and wife about scams. They both have, I suppose understandably, got the message from the media that to protect yourself you simply "Don't click links". While it's a nice soundbite, sadly I feel that's the wrong message and it won't appreciably stop people being scammed, it'll just slow the scammers down a little until the next wave hits.
So what's the key message that should be getting out there? Three words: VERIFY, VERIFY and VERIFY.
1) Independently verify that the person who called you or sent you X is who they say they are. Don't trust anything they have given you until you do: don't click their link, don't call the number they provided, don't give them anything and don't do what they say. It doesn't matter if the message looks like it came from them, and it doesn't matter if you recognise the voice on the other end of the phone. If they are asking you to do something risky then STOP and VERIFY. Somewhat counterintuitively you should especially take time to verify if there's a sense of urgency involved.
2) VERIFY that websites you are using to enter sensitive details (logins, etc) are legitimate before you type a thing.
3) If you are making a legitimate substantial transfer (say paying a supplier or putting down a house deposit) VERIFY through two independent channels that the recipient is correct. Don't just "trust" the trust account details that your supplier/lawyer has just sent. Call them on the number from their website (and again, don't click a link in their email to get to their website!) and get them to read it out to you.
Let's have a discussion: what else do you do to keep your hard earned coin from going to scammers? What experiences have you had? What can business and government do to prevent scams?
Everyone should go and watch Jim Browning on YouTube, guy is a legend.
We see this shit all the time at work, some emails are so close to real that you have to take a magnifying glass to the headers to actually tell they're fake. We've spent many hours increasing our email security to help with the increase in attacks. A recent one contained 3 registered .com domains with the recipients full name followed by 1 or 2 random characters in the body of the email, very targetted and intentional.
You're right, vigilance is the key here, be weary of anyone claiming or offering anything, and everything that comes out of the blue. Use a password manager, rotate your passwords, never give out your MFA codes, use biometrics, etc. go a long way to protecting one from most attempts.
Even just enabling MFA and not just relying on credentials goes a long way.
Cool post, hot topic at the moment, and awareness is important.