Setting up your notebook: sorting messages by how they hook you
We have covered the one rule, we have covered who falls for this (everyone, on the right day), and we have covered the categories that do not change even when the tricks do. Now I want you to actually build something. Not merely listen to me describe it.
Get a notebook. A physical paper one, or a note on your phone if that suits you better. The medium does not matter. What matters is that you begin recording every suspicious call, text, and email you receive, and that you sort it by the hook. Not by what it is pretending to be. By what it is actually doing to you.
Why sort by the hook, and not the disguise
A point rarely explained at the outset: a scam may dress as Amazon one week, the IRS the next, and your grandson in jail the week after that. The costume changes constantly. But the hook beneath it is almost always one of about four things:
- Fear ("your account is compromised," "you owe back taxes")
- Urgency ("act in the next 15 minutes or we cancel your order")
- Money or a prize ("you've won," "claim your refund")
- A relationship ("this is your bishop," "it's me, I lost my phone")
If you sort your notebook by the costume, you will have fifty categories and it will feel hopeless. If you sort by the hook, you will have four categories, and you will begin recognizing the pattern before you finish reading the message. That is the entire objective of the exercise. You are training your eye.
How to actually do this at home
A straightforward setup. I will walk you through it the way I would want someone to walk me through it.
- Four pages, four hooks. Label them Fear, Urgency, Money/Prize, Relationship. If a message uses two hooks at once, which happens often, record it under whichever one hits first.
- Every time you get a sketchy message, write three things. What it said, who it claimed to be from, and which hook it was using. Takes thirty seconds.
- Don't click anything to check it. You are logging it, not investigating it. Hover over links if you want to see where they actually go, but do not tap.
- Review it once a week. Sunday afternoon, whenever. You will begin to see which hook you personally respond to. Everyone has one. Mine is urgency, to be exact. Fear I can usually shake off, but tell me I have fifteen minutes and something in my chest tightens even when I know better.
That is the system. I have run a version of this since my mother's IRS call, and it is the reason I can now examine most messages and sort them in roughly two seconds.
A note on backup codes, before you set anything else up
I want to insert something here that is slightly out of sequence, but it matters, and I would rather state it now than let you find out the hard way.
When you begin setting up two-factor authentication on your accounts, which we will do together in a later lesson, save your backup codes somewhere secure before you do anything else. I mean before. Not after.
I set up two-factor on my own accounts one Saturday, quite pleased with myself, and then obtained a new phone a few weeks later. My old phone held the authenticator app. My new phone did not have the codes transferred. I locked myself out of my own email for an hour attempting to prove I was me. To myself. That bothered me, chiefly because it was so avoidable.
So I now teach backup codes first, ahead of everything else, on account of that hour. Write them down. Print them if you have to. Store them somewhere that is not solely on the phone you are trying to protect.
The opinion part
I will state this plainly, because people argue with me about it: text message two-factor is fine. The security specialists online will tell you it is the weak option, and technically they are correct, there are more secure methods out there. But a text code is a hundred times better than no second step at all, and it is the one your uncle will actually turn on without giving up halfway. Perfect security that no one actually uses protects no one. Use what you will use.
Before next time
Start your notebook this week. It need not be fancy; four pages and a pen will do it. Bring it to the next class if you have caught anything interesting. I enjoy seeing what people are catching.
~kenneth