Spot the fraud
before money moves.

The scam

A distraught voice that sounds exactly like your grandchild calls: there has been an accident or an arrest, and bail has to be paid right now. Then a supposed lawyer or police officer takes over the call. The voice comes from an AI tool that was fed videos from social media.

What helps

If you are connected in the app, your grandchild has their own three-word code, which changes every day by default. You ask for that code and compare the answer with what your app shows for your grandchild. A caller who only has a cloned voice does not know these words.

The scam

"Mum, I've had an accident. The ambulance is here, you need to call the bank right now and approve a transfer." Your child's voice was cloned from a single voice message. The caller knows your partner's name, your car and your habits, because he collected all of it from social media beforehand.

What helps

Set up the connection while nothing is wrong. In an emergency you ask for the current code before you move any money, and a caller who cannot give it gets no transfer.

The scam

Fraudsters build a relationship over weeks or months, often with AI-generated profile photos, cloned voices and faked video calls. Only when trust is high enough does the sudden crisis arrive in which money is needed urgently.

What helps

A connection does not prove who someone really is. It does show whether you are still talking to the same person who set it up with you. If the other person cannot give their own code in a video call, or refuses a connection from the start, treat that as a warning sign.

The scam

A voice message or a video call appears to come from the CEO: a transfer has to go out by tonight, and the matter is confidential. Voice and face are fake but hard to tell from the real person, and the attached non-disclosure agreement looks genuine.

What helps

Make it a rule that no payment is approved without the current code of the executive who authorises it. The codes are never sent by email or chat, because each person reads their own code in their app and says it in the conversation.

The scam

Whole meetings can be faked, with familiar faces and voices generated in real time. The fake participants talk about real company matters they found in public sources, and at the end they ask for a transfer, a contract change or confidential data.

What helps

At the start of any call about money or confidential data, each participant gives their code. This takes about half a minute, and anyone who cannot give a valid code is left out of the decisions.

The scam

A message that seems to come from your largest client asks you to change the bank details for future invoices, redirect a delivery or approve a change order at once. The sender's address differs by one letter, and the writing style fits because the text was generated from real correspondence.

What helps

If you are connected with your most important clients, you check every significant change by code before you carry it out. If the code does not match, you call back on a number you already knew.

The scam

"Good afternoon, this is your bank's fraud department. We are seeing suspicious transactions and need to check your details." The caller knows your name, part of your account number and your recent transactions, because that data comes from an earlier breach. He asks you to approve a supposedly safe transfer, hand your card to a courier or install a security app.

What helps

If your bank uses Trusted Codes, the employee switches on her Beacon for the call and gives you the code when you ask. You enter it at verify.trusted.codes and see whether it is valid right now and which bank she works for. Treat a code that the page does not confirm as an attempted fraud.

The scam

"Hi, this is IT. We are seeing unusual sign-in attempts on your account. Please confirm your credentials and give me remote access so I can secure it." Many employees comply, because they do not want to be locked out and the caller sounds exactly like someone from their own IT team.

What helps

Helpdesk staff switch on their Beacon when they call colleagues. Agree internally that nobody gives out credentials or allows remote access before checking the caller's code. A caller who cannot give a code is called back on the known internal number.

The scam

"This is the tax office. You owe back taxes and there is a warrant for your arrest. Call back within the hour or the police will be sent." Calls like this rely on fear of the authority, so that people pay before they think.

What helps

An authority that uses Trusted Codes has its staff switch on a Beacon for outgoing calls. Citizens check the code they are given for free in a browser at verify.trusted.codes, with no app and no account.

The scam

"This is your GP surgery, we need to move your appointment. Could you quickly confirm your date of birth and your insurance number?" When the call seems to come from a surgery or a pharmacy, many patients give out such data without asking, because the reason sounds plausible.

What helps

Surgeries and pharmacies that use Trusted Codes give their staff a Beacon for calls to patients. Before you confirm personal or medical details, ask for the code and check it at verify.trusted.codes.

The scam

"This is Microsoft Support. Your computer is infected with a dangerous virus and your bank details are at risk." The caller gets the victim to grant remote access, then installs malware and empties accounts or charges for a fake virus removal.

What helps

Microsoft says it does not make unsolicited calls to customers, so such a call is always suspect. If your IT provider uses Trusted Codes, its technician can give you a Beacon code that you check at verify.trusted.codes before you let anyone onto your computer.

The scam

A real employee's credentials have been stolen. The attacker uses that person's email or chat account to message or call colleagues, request password resets or ask for confidential information. Because the account is real, nothing looks wrong at sign-in, and the internal phone number matches too.

What helps

A Beacon code is created in the Trusted Codes app on the employee's phone and is valid only while their session runs. Someone who has taken over only the email or chat account therefore cannot give the current code, and colleagues notice that something is wrong.

The scam

Someone at your door or at the building entrance claims to be a courier, a technician from the utility company or the caretaker. Once inside, they look around, take parcels or install surveillance equipment. Often a call has announced a delivery beforehand so that you are not suspicious.

What helps

When you expect a visit, you create a Guest Code in the app and send it to the real service provider. At the door you ask for that code, and only someone who received it from you can give it.

The scam

"I'm working at your neighbour's and noticed your roof is damaged. If I don't fix it today, it will cost three times as much." The supposed tradesman puts on pressure, shows no credentials and wants cash up front. The work is then done badly or not at all.

What helps

A trade business that uses Trusted Codes can send you a Guest Code from its company account on the spot. At verify.trusted.codes you see, without an app, who created the code and which business that person belongs to. If someone refuses this check, do not let them in.

The scam

Fraudsters get into the email exchange with a supplier, either through a hacked mailbox or a lookalike domain, and send an invoice with new bank details. Logo, invoice number and amount are right. Only the account is different.

What helps

The supplier seals its invoices as files. Before you pay, you drop the PDF you received onto the Seal's check page, and your browser compares it with the sealed original. If even one character has changed, for example in the IBAN, the check fails.

The scam

Anyone with access to a supplier's mailbox can redirect shipments, change delivery addresses or intercept orders. Such attackers often go unnoticed for months, because their instructions are written in the tone of the real correspondence.

What helps

Seal official instructions, purchase orders and shipping documents. An instruction without a valid Seal is not carried out, and you check with the supplier through a contact you already know.

The scam

An AI writes an email in a particular executive's style within seconds: "Please handle this personally and don't involve anyone else." Messages like this get past spam filters and use authority and time pressure to skip the normal approval process.

What helps

An executive seals important instructions in their app, and the signature is created on their own device. The check page shows who sealed the message and the original text, which you compare with the message you received. A forged email has no Seal issued to that person.