Anyone unexpected contacts you and asks you to act, pay, share information, or log in.
The single most reliable defense against impersonation is this. You break the connection the scammer set up and rebuild it through a channel you control. The number on the back of your credit card, the number on the company’s official website, the number on your last paper statement. Not the number the caller gave you. Not the link in the email.
A real bank will never object to you calling back. A scammer cannot follow you to the real bank’s switchboard. That is the whole trick.
A sticker over a real QR code (on a parking meter, a menu, a flyer) sends you to a fake payment or login page.
A friend (or a stranger) sends you a direct message with a link and 'is this you?' or 'OMG I can't believe you did this lol.'
A remote job offer arrives unsolicited, the interview is by text only, and they need your bank account details to set up payroll before you have started.
A text claiming your bank just blocked a suspicious $487 charge and asking you to call a number to confirm or deny it.
An email that looks like it's from your streaming service, email provider, or cloud storage saying your account is suspended and you need to sign in to fix it.
A call claiming to be from Medicare saying you need a new card and they need to verify your number and other personal details to send it.
A loud pop-up on a website claims your computer is infected and tells you to call a number for Microsoft or Apple to fix it.
After a grandchild-imposter call, a courier shows up at the house to pick up cash for bail.
A fake message says your toll account is past due and links to a near-perfect copy of a state turnpike site.
Cloned voice, hurried tone, asks for bail money on gift cards. The script is the same on every call.