Module 7 · Lesson 3 · 30 minutes

🛡 Social Engineering Protection

For yourself, your family, and your team. What to say when someone tries to scam you. How to react to the voice of "security support."

📖 The Scale of the Problem

According to the Ministry of Internal Affairs of the Russian Federation and the Bank of Russia, in 2023, Russians lost over 15.8 billion ₽ to phone and online fraud (vishing/phishing). The primary category of victims is elderly people aged 60 and over: the typical scheme is a "call from bank security" requesting a transfer to a "secure account."

According to the Central Bank of the Russian Federation, on average, only ~7.7% of stolen funds are returned to victims. The clearance rate for such cases is in the single digits.

Almost all of this can be prevented with just one habit and one phrase. Let me show you.

🧠 The Core Principle: The "Magic Phrase"

Remember this one formula. For any call or email urging you to do something urgently:

📞 Standard Response

"Thank you for the call. I will call you back myself in 10 minutes using the official number from the bank's website."

And hang up. No discussions. No "buts" or "what ifs."

If it's actually the bank, they won't be offended. They want you to do this. They have a "callback" procedure.

If it's a scammer, they will either back off or start pressuring you. Pressure is the ultimate red flag of a scammer.

🎯 5 Scammer Phrases = Red Flags

🚩 If you hear this, it's a scammer
  • "Hurry, or your money will be gone" — banks never rush you
  • "Don't tell anyone about this call, not even your family" — the ultimate manipulation signal
  • "Transfer it to a backup/secure account right now" — a bank will never ask you to transfer funds
  • "Give me the SMS code / CVV / card expiration date" — the bank already knows this
  • "Install this app for verification" — banks don't call with such requests

If even one of these phrases is mentioned, it is guaranteed to be a scammer. Hang up. Don't "politely wrap up the call"—just hang up.

👨‍👩‍👧 How to Protect Your Family

The most vulnerable:

What to do:

👵 For Elderly Parents
  1. Print this out and stick it near the phone: "The bank never calls first. Hang up."
  2. Tell them: "If someone calls and asks you to do something urgently, call me BEFORE you do anything."
  3. Set a daily transfer limit on their card (e.g., 10k ₽). This can be done via the banking app or at a branch.
  4. Set up SMS alerts for all transactions for your grandmother/mother.
  5. Share 2-3 real-life fraud stories from the news. Emotional stories stick in the memory.
👦 For Teens
  1. Explain that any "legit online side gigs" starting at $5/hour are scams. That's not how real money is made.
  2. Ban them from sending intimate photos to anyone. Even "trusted" people online. Sextortion is a massive campaign targeting teenagers.
  3. Show them how to check the source: about:phishing in Chrome.
  4. Gift them a YubiKey ($50) for Steam/Discord/socials — impossible to hijack via phishing.

🏢 Protecting Your Team (If You Run a Business)

  1. Phishing simulation — run simulated attacks on employees once a quarter (using GoPhish). Send those who click back to training.
  2. Mandatory 2FA on all work assets: email, corporate services, online banking.
  3. Financial limits: transfers >$5000 require confirmation by a second person.
  4. "Dual-channel rule": if the CEO requests an urgent money transfer