Four things show up in almost every scam request — urgency, secrecy, an unusual payment method, and pressure to keep it from people who'd normally help — and they're not four separate warning signs, they're one system working together. A real photo or a familiar voice attached to a request shaped like that is still a scam.
Most advice about spotting a scam focuses on the story — is the emergency real, is the photo real, is the voice real. Those questions can take a long time to answer, and sometimes can't be answered at all. There's a faster question: not "is this true," but "what is this actually asking me to do, and how is it asking me to do it."
Almost every scam request is built from the same four pieces, and they're not four separate things to individually check off — they work together, each one doing a specific job:
Take any one of these away and the scam usually falls apart. Take away urgency, and you have time to think. Take away secrecy or isolation, and you tell someone who says "wait, that's not how this works." Take away the unusual payment method, and even if you're fooled, the money can often be recovered. That's why real requests — from real people, real banks, real government agencies — almost never combine more than one of these at a time, and scam requests almost always combine several.
A photo can be completely real — not AI-generated, not stolen from someone else, exactly what it claims to be — and the request attached to it can still be a scam. The photo answers a different question than the one that matters here. It might tell you the picture wasn't faked. It says nothing about whether you're being rushed, isolated, or asked to pay in a way you can't undo.
This is worth sitting with, because it cuts against the instinct this whole course exists to correct: evidence that the content is real doesn't tell you anything about whether the request is legitimate. A real photo of a real grandchild, sent by someone who has genuinely stolen their identity, attached to an urgent, secretive, wire-transfer request, is still exactly as much a scam as if the photo had been fake. Check the request, not just the evidence around it.
This lesson stops at recognition on purpose. Once you notice urgency, secrecy, isolation, or an unusual payment method — especially more than one at once — What to Do When You're Not Sure covers what to actually do about it. The two matter in different ways: this is about learning to see the shape quickly, before you're already halfway into it. That one is about the one habit that gets you out.