Sheftali's Unknown

The number on your screen is the one printed on the back of your card. That does not mean your bank is calling. Caller ID is a label the caller's own system attaches to the call, and it can be set to almost any number, which is the whole trick behind the safe account scam: borrow the real number, then say the account is under attack.

How the safe account scam borrows your bank's number

The scammer sets the caller ID to your bank's real number, usually copied from the back of your card, so the display matches while the voice belongs to a stranger who wants your money moved.

The FBI's warning, as summarised by security firm Bitdefender in May 2026, lays out the sequence. After the spoofed number comes your account number and balance, pulled from breaches, phishing or malware, or from abusing automated balance-check lines. Then the claim that staff are illegally inside your account, and the offer of a fix: send the money to a "safe" account, which belongs to the criminals, by Zelle or transfer. Every step answers the question you were about to ask: is this my bank?

The FTC's June 2026 release puts business impersonators at nearly $1 billion in 2025 losses, up from $866 million in 2024, and says bank impersonators carry the highest losses among them. That makes the bank impersonation scam worth a rule of its own.

Fake auto-renewal charges that list a phone number and a fake dealership website that insists on a wire work the same way: they move you onto a channel the scammer controls.

Four figures decide how worried to be. The first two come from that FTC release: dollars lost to imposters in 2025, and how many people reported one. The third is my own division of the first by the FTC's all-fraud total of $15.9 billion (March 2026 testimony to Congress), a figure roughly a quarter above 2024, so "it won't be me" is the wrong assumption.

The call-length figure is the odd one out: the person who stayed on that long, in the report Bitdefender summarised, still caught a disguised dollar amount at the final Zelle screen, so the last confirmation is a real checkpoint. The script exists to keep you talking until your thumb is already moving.

Is a call from my bank's fraud department ever real?

Yes, banks do call about suspicious activity, but a real fraud team never needs you to transfer funds, so any caller who tells you to move money to a safe account is running the scam, whatever the display says.

The FTC says it will never demand money or tell you to transfer money, so an official who does is, by definition, not the agency.

A scammer can copy the number on screen and the balance they recite, but not the request. Judge what is asked, never who appears to be asking.

Only the last of the four stages is yours to stop, so the decision to refuse is made before the call, not during it. Stages follow the FBI sequence as relayed by Bitdefender; the zeros and the one are my count of what you control.

Will my bank refund me if I sent the money myself?

Often not: refund rules mostly cover transfers you did not authorise, and a payment you approved while deceived is usually treated as authorised, so recovery can depend on the bank's goodwill and on how fast you report it.

In the report Bitdefender summarised, a Huntington customer sent $5,000 and reportedly got nothing back because she had approved it herself, while a Chase customer's roughly $40,000 was gone by the next day. Your approval becomes the bank's argument, so call the real number first and gather proof second.

The FTC's June 2026 release counts a dozen actions and more than $70 million in redress tied to its 2024 Impersonation Rule, roughly two cents on the dollar against a single year of imposter losses. My arithmetic, and a loose one since the actions span years, but the money mostly does not come back.

My view, and it is only a view: the standard advice to stay vigilant puts the burden on the one person in the conversation who cannot verify anything. I agree with banks on "hang up and call back", not on burying it in the small print. Never act on an inbound call about money (banks do ring first sometimes, which is why you judge the request), because the display is the one thing the caller controls. The same instinct breaks the unpaid toll text scam, where the message asks you to reply Y before the link works: step out of the channel the sender chose.

• Redial from a different phone, because a line you thought you ended can stay connected to the caller.
• Ignore any number the caller offers "to verify"; use the one on your card or in your bank's app.
• Read the final confirmation screen slowly; stop if the amount or recipient is off.

This week, copy your bank's fraud line from the back of your card into your phone, and settle now that any call asking you to move money ends with you hanging up and dialling that saved number. One redial breaks the script.

Apple's iMessage quietly disarms texts from strangers: if the sender isn't in your contacts, every link stays dead until you reply or save the number. That rule explains the oddest line in an unpaid toll text, the polite request to reply Y and reopen the message. The reply looks like a confirmation. Well, it is one, just not of any toll. It's the key that switches Apple's protection off.

Why does an unpaid toll text tell you to reply Y?

It tells you to reply Y because iMessage keeps links from unknown senders switched off until you respond, and a single reply, whatever it says, turns the link on and confirms your number to the sender.

BleepingComputer laid out the mechanism in January 2025, with Apple's own explanation: links from an unknown number or email address stay disabled until you reply or add the sender to your contacts. The scam leans on habit. You already text YES to confirm a dentist appointment, so reply Y feels like routine admin. It's the one step the attacker cannot do remotely.

So I'd retire the standard advice to text STOP to spam. STOP is still a reply: it lights up the link, and as Malwarebytes noted in May 2025, every reaction tells the sender the number is in use, which raises its price as a traded data point, the raw material behind surveillance pricing built on your personal data.

A 2025 Palo Alto Networks Unit 42 report traced one smishing operation to 194,345 fully qualified domain names (full web addresses) on 136,933 root domains. Nobody can memorise a blocklist that long, so judging a link by eye was never going to protect you. Toll services were the most impersonated category, with nearly 90,000 dedicated phishing addresses. It's the pressure of the fake dealership website that insists on a wire transfer: rush you to the channel where checking feels like delay.

The amount is designed too. Malwarebytes reported in May 2025 that the DMVs of New York, Florida and California were warning about texts claiming a "small amount" in unpaid tolls. Small enough that you pay before you check. The real prize is the card number you type in.

Four numbers decide whether this deserves more than a delete, from the FTC's April 2025 tally of text-scam losses to NPR's monthly spam count via Malwarebytes and the FBI's first IC3 toll-smishing warning in April 2024.

The comparison with 2020 is the one to sit with. Reports fell while losses rose, so the people still caught are losing more each time, which fits a tiny fee that exists to harvest a card. My view, not data: Apple and the carriers could flag the reply-Y pattern itself, since no real toll agency needs a reply to make a link work. Until they do, your guard is your habit of not answering.

Real toll bill or toll text scam: how to tell them apart

A real toll bill reaches you through the account or mailed notice tied to your license plate, while the fake arrives from a stranger and only works once you reply to it.

The rows run from what you're asked to pay to what is left to do, with the genuine bill and the text side by side.

One row is our own arithmetic: the 46% is Unit 42's toll count divided by its total, and on the same numbers toll lures outnumber fake USPS ones about three to one. The complaint figure is from the FBI's IC3 notice, as covered by TechRadar in March 2025. Fail one row and you have your answer.

What happens if I clicked the toll text link and paid?

If you paid, assume everything you typed into that page now belongs to the scammer, and call your card issuer today to block the card and dispute the charge before bigger charges follow.

Then report the message at ic3.gov and delete it, as the FBI and FTC both advise. Screenshot it first: the payment page is probably offline already.

Expect a second wave, often dressed as help: a refund for a toll you never owed, the same move behind the extra-zero refund trap in renewal invoice scams.

• A text offering to refund the toll.
• A caller from your bank asking for a one-time code.
• Small unfamiliar charges on that card.
• More toll and parcel texts.

So here is the one step that breaks it, and you can take it this week: type the address of the agency that bills your plate, E-ZPass or your state's own, log in and bookmark it. Every toll text after that gets checked against the bookmark, never answered, and the reply the scam was built around never comes.

A renewal invoice scam does not want your card number. It wants a phone call. The email looks like a receipt from Geek Squad, Norton, McAfee or PayPal for a subscription that just renewed, with an order number and a cancel-by date, and it gives you exactly one way to object: a phone number printed where a link to your account should be.

How the renewal invoice scam actually makes money

It makes money by staging a refund, not by collecting the fake renewal: the caller fakes an overpayment on your own screen, then asks you to return the difference by gift card, wire, crypto or a payment app.

The FTC's tech support scam guidance names the opener: notices about automatic renewals for tech support subscriptions, sent by email or text. A company that really renewed you already holds your card and an account page, so it has no reason to make you ring a number. Our explainer on what a company must show you before an auto-renewal charge lands sets out what a genuine notice includes.

The call is where it turns. A September 2026 MalwareTips write-up describes the playbook: the agent installs AnyDesk, TeamViewer or Quick Assist, opens your bank and "refunds" you, then the page reads $5,000 instead of $500, often after shuffling money between your own accounts. In the FTC's words, they say they refunded you too much money and insist you pay them back. Do that arithmetic and you "owe" $4,500, nine times the promised refund, for money that never arrived.

The repayment channel is the tell. The FTC says these callers want gift cards, transfers, crypto or payment apps because paying that way is like using cash. Ask to pay by card and there is suddenly a "system issue" (odd, for a billing department). It is the same reason a fake dealership website insists on a wire.

Four 2025 figures, from the FBI's IC3 crime report as summarised by AARP in April 2026 and from the FTC, show why the call is the part to refuse.

The support-scam loss is the one to sit with. That money left during calls people placed themselves, to numbers the scammer chose. Hang up before any app goes on and nothing after it can happen.

How do I know if a renewal invoice is real?

A renewal invoice is real only if the same charge shows up when you log into the vendor account or your card app yourself, without using any link or phone number taken from the message.

Logos and order numbers cost nothing to fake. Behaviour is harder, so compare what each one asks you to do.

Every scam row asks you to hand over control. Our own arithmetic on the FTC's 2025 figures shows why the payment row matters most: for every dollar lost through a card or payment app, at least $5.40 went by bank transfer or crypto, which a card dispute can't reach.

What happens if I called the number on a fake invoice?

Calling only puts you inside the script; the damage starts when you let someone onto your computer or send money, so what you do in the next hour decides what the call ends up costing.

If you only talked, hang up and stop there. If the agent got onto your machine, take it offline and remove the app they had you install. Then, from another device, change any password they could have seen, and call your bank on the number on your card.

The script reaches furthest with older people. The FBI's IC3 report for 2025, as summarised by AARP, found Americans over 60 lost $7.7B to online fraud. If you set up a parent's subscriptions, agree one rule with them this week.

Here we part ways with the usual advice. "Never trust emails" is too vague to use at 9 p.m. with an alarming invoice open; "nobody refunding you needs your screen" is a rule people keep. Whether banks should carry more of the loss on transfers a customer was tricked into approving is an open fight. We think they should, but you can't count on it.

Watch for the second wave, which is common:

• A "refund recovery" team calling days later. Same people, second round.
• A "bank fraud unit" asking you to move savings to a "safe" account.
• "Microsoft" calls about an expired Windows plan. Real consumer extended support for Windows 10 is set up in the PC's own settings, never by phone.

The decision is simple: an invoice is yours only if your own login shows it. This week, open the account for each subscription you really pay for and see how renewals appear there. And the one step that breaks the scam: never dial the number on the invoice.

Related: unpaid toll text scam that asks you to reply Y

A fake dealership website does not look cheap or sloppy. It looks exactly like a real dealer's, because it was copied from one, down to the logo and the inventory pages. Then it adds one rule the original never had: pay by wire, and pay before you see the car.

Why does a fake dealership website insist on a wire?

Because a wire is the one payment you cannot pull back on your own, and a site copied from a real dealer cannot keep your money if you pay any way that can be reversed.

A September 2026 FTC consumer alert lays out the method. Scammers use AI to copy a real dealer's site, logos and listings right down to the photos. They advertise rare or classic cars with a normal-looking process and flexible returns, then demand an upfront wire transfer. The car never arrives, and the sale is never recorded at the real dealer. Every trust signal on the page is now a copy, so the only thing left to test is what you are asked to do with your money.

So the old advice to hunt for typos or blurry photos is outdated. Those tells belonged to scams written by hand, and a cloned page has none. Real sellers are also expected to disclose terms before money moves, which is the logic behind what auto-renewal law requires a company to show you before it bills you. A clone owes you no such disclosure, and its only real term is how you pay.

A page that seems to know what you want proves little, since personalised offers are routine (see how your personal data sets your price). Four figures, from the FTC's 2026 imposter-scam data spotlight, the FBI's 2025 Internet Crime Report and a TheStreet report of 28 September, show how much can go wrong before you notice.

The slow build matters more than the total. Each reply and each scanned document makes stopping feel rude, and politeness is the cost a scammer wants you to weigh against a large sum. In the reported case the dealership named as payee was genuine and had nothing to do with the sale.

How do you verify a car dealer online before paying?

Check how you are asked to pay, which number you call and whether the seller allows an inspection, because a page can copy everything else and none of those three depends on how it looks. The table sets a real dealer against a cloned site, money first, because the loss happens there.

My own arithmetic, not a citation: the FBI's $503 million in non-delivery losses spread over its complaints works out to about $8,900 each, so the Lexus wire was roughly 8.7 times a typical paid-and-never-delivered loss and nearly four times the $20,699 average across all complaints. A car deposit belongs in a different risk class from an online order and deserves a different level of checking.

What if you already wired the money?

Call the bank that sent the wire the same day and ask for a recall, then file a report at ReportFraud.ftc.gov and with the FBI's IC3, because speed is the one lever you still hold.

Recovery is possible, not promised. The FBI's figures above cover only incidents that reached its bank channel, so read them as a reason to call fast, not as odds for your own case. TheStreet's account of the Lexus wire does not say whether any money came back, and I would not assume it did.

Scam exchanges can involve links and attachments, so keep your banking computer patched, and read what extended Windows 10 support to October 2027 covers if yours is still on it.

One grey area, and this is opinion, not finding: a dealership that really exists proves less than buyers think. Treat its name on your paperwork as a reason to phone it, never to relax.

• A return policy is a promise from the seller, so it is worth exactly as much as the seller.
• A real dealer's name on your paperwork proves the name exists, not that the bank account is theirs.
• Search the dealer's name plus scam or complaint before any money moves.

The decision is simple: pay only for a car you have seen, or had inspected by someone you chose. This week, and every time after, call the dealership on a number you found yourself, ask whether that car is theirs, and send no wire until it is.

Related: the safe account scam, where a caller showing your bank's real number asks you to move money

Here is the mechanism, not the sob story. You sign up for a trial or a first-year rate, hand a card number over once, and the company bills that same card on the same date every year until you notice and stop it. No reminder call, no requirement to warn you first, unless the state you're billed from has passed an auto-renewal law that says otherwise. Most of the country still runs on the old default: silence counts as agreement.

That changed unevenly. A federal rule meant to make cancellation as easy as sign-up got struck down in July 2025 over a skipped cost study, not the substance. What's left is a patchwork, state by state, deciding what you are owed before the next charge hits.

What does an auto-renewal law actually require before you're charged?

These laws usually require clear disclosure of the renewal terms before you agree, a separate opt-in in some states, and a working one-click cancel path in a few.

Streaming services already shifted real cost increases into ad tiers and extra-member fees instead of raising the sticker price, and what a retailer knows about you can quietly set the price you are quoted. This law is the backend version of the same fight: not what you are charged, but whether you were ever told the charge was coming back.

California set the pattern other states are copying. Since July 1, 2025, any company billing a California resident must show renewal terms clearly before the sale closes and get an explicit yes, not a pre-checked box (Cal. Bus. & Prof. Code §17602(a)(1), via Purchy, 2026). It must also keep proof of consent for three years, so a disputed charge puts the burden on the company, not the customer. Four numbers below make the size of this fight concrete, from Purchy's 2026 tracker and WilmerHale's 2025 analysis.

That compliance-cost fight is why cancellation protection now lives at the state level, not a federal floor. Courts ruled on procedure, not on whether the policy itself was good, and the FTC skipped a required step. Whether companies made cancelling hard was never actually litigated. Until that changes, every state deadline below is a separate, narrower experiment in the same idea.

Which states have an auto-renewal disclosure law in 2026?

Five states have a real 2026 deadline: California active since mid-2025, then Maine, Colorado, Maryland and Connecticut landing between January and July. Check what your own state requires before assuming a cancellation page is doing you a favor. Below is what changed, when, and what it gets you if your billing address falls inside that line.

The five dates are not random: California's and Connecticut's effective dates sit exactly twelve months apart, and each law between tightens a different angle, disclosure, consent, notice, then cancellation. Colorado and Connecticut now require cancellation to move as fast as sign-up did. If your state is not one of the five yet, this timeline is the best evidence of what's coming, not a guarantee of when.

Where Auto-Renewal Protections Still Fall Short

Even where a state law like this exists, it only protects residents billed from that state, and federal enforcement stayed thin after the click-to-cancel rule's reversal in 2025.

The FTC has not gone quiet. WilmerHale's 2025 analysis expects it to keep leaning on its existing Restore Online Shoppers' Confidence Act and Section 5 authority, already used against Amazon, rather than rewrite the vacated rule. That is a real option with no state law covering you, but it moves at federal-investigation speed, not same-day refund speed.

The same silent-default pattern shows up whenever a company can change your bill without a fresh yes, including device makers forcing a subscription onto hardware you already paid for once after a cloud service shuts down. A state law usually covers this too, only where it's written broadly enough to include a change in terms.

• A trial in a state with no disclosure law can still auto-bill off the fine print you scrolled past.
• A phone cancellation outside Connecticut can still open with a retention pitch before the rep processes your request.
• An annual contract renewing outside Vermont has no guaranteed advance reminder window at all.
• "Cancel anytime" on a marketing page is not the same claim as a state-mandated one-step cancel link.

So here is the one step that breaks the pattern: before you argue about a renewal charge, check your billing address against the dates above. If your state has a matching law, cite the statute in your dispute, not just the word "unauthorized." That's the difference between a ticket that goes nowhere and one escalated the same day.

Related: how a fake dealership website uses a wire-only payment to take deposits

Related: how a renewal invoice scam dresses up a fake auto-renewal charge

"Spare parts availability." Three words sitting in a government framework, and they decide more about your next repair bill than any warranty you hold. Where genuine parts are scarce or slow, a market appears to fill the gap, and most phone repair scams in India are not elaborate cons. They are a counterfeit display fitted quickly, charged at a genuine price, with nothing in writing to argue against afterwards.

How Do Phone Repair Scams Actually Work?

Almost always through the part rather than the labour, because a customer can see what a technician does and cannot see what went in, and phone repair scams rely entirely on that asymmetry holding for the ninety minutes you are away.

The common version runs like this. A display assembly is quoted at close to the brand's own price. What gets fitted is a refurbished panel or a copy, the difference stays with the shop, and the phone works well enough on the day you collect it. Colour shifts, touch dead zones and early failure arrive weeks later, by which time the conversation has moved on and the receipt, if one exists, says nothing about which part was used.

A second version involves nothing being replaced at all. A fault is diagnosed loosely, a component is named, and the phone comes back working because something simpler was reseated. The charge stays. Neither version needs a criminal, only a counter where the customer cannot check the claim, which is the same structure behind the way work from home job scams are built.

That delivery window is the quiet one. A shop that cannot get a genuine display inside a fortnight does not schedule the job. It either recommends a new handset or fits whatever is in the drawer, and the customer usually accepts because waiting feels worse than paying. Slow parts supply does not only delay repairs. It creates the market that fake parts are sold into, and component prices move for their own reasons on top of that, as the 2026 memory shortage made obvious.

The Tells On A Fake Spare Part

Most of them show up within the first week rather than at the counter, which is why the useful checks happen before you hand the phone over and in the ten minutes after you collect it, not somewhere in between.

The old part is the test that costs nothing. A shop fitting a genuine component has no reason to refuse it, and a shop that reacts badly has told you something the invoice never would. Take a photograph of the handset serial before you hand it over, and check it matches on collection. Devices have gone in for a screen and come back as a different unit, which is the hardware version of finding that the smart home gear you own stopped being yours.

Does The Government Portal Protect You?

Only if your brand happens to be on it, because onboarding to the Right to Repair Portal is voluntary rather than required, so a missing company has not failed any test and a listed one has simply published terms you can hold it to.

That distinction matters at a counter. If the brand is listed, its repair terms are public and a service centre can be measured against them. If it is not, you are relying on the shop's own word, and the framework submitted to the Department of Consumer Affairs in May 2025 does not change that until somebody notifies it. Complaints in this area reached 22,864 in 2024-25, up from 19,057 two years earlier, so the demand ran well ahead of the rule.

• Look the brand up before you book: two minutes on the portal tells you whether published terms exist at all.
• Absence proves nothing: a brand that never joined has not been judged, so treat the gap as missing information rather than a verdict.
• Authorised is a claim, not a badge: ask which brand authorised the centre and check that on the brand's own site.
• Keep the invoice with the serial on it: without that document a complaint has nothing to attach itself to.

What We Cannot Tell You

How common counterfeit parts are in the Indian repair market is not something anyone has measured properly, so this piece gives you the mechanism and the tells rather than a percentage, and a figure invented for effect would be worse than none.

We also do not cover board level repair, water damage recovery or anything involving a device still under manufacturer warranty, where the first move is the brand rather than the shop on the corner. What I will offer as opinion is this: the single line in India's draft framework that would change the odds at the counter is a parts supply deadline, and it is the one still left blank. Europe set a five to ten day delivery window and still ended up with most models publishing no repair information at all, which tells you a rule without an audit is a label. The same slow shift of cost onto the customer runs through the cheaper plan a streaming service only shows you at the exit.

Do one thing before your next repair. Find the brand's own price for the part you are being quoted, then decide whether the gap in front of you is a bargain or a substitution. A shop charging less for the same component is possible. A shop charging the same for a different component is the thing you are trying to catch, and the only moment you can catch it is before the phone leaves your hands.