"There's a problem with your account"

This is the most frequently reported scam by Americans over 60. Not the costliest — but the one that arrives most often, in the most disguises.

How it arrives

A text, an email, or a voicemail about a problem:

A charge you didn't make — reply YES or NO
Your account is locked or suspended
Your password is expiring
A payment failed and your service will be cut off
Your package couldn't be delivered
An unpaid toll
Verify your details to keep your benefits
Your antivirus subscription auto-renewed for $499 — call to cancel

They impersonate whoever you're most likely to have: Amazon, your bank, Netflix, USPS, Apple, Medicare, Microsoft, your electric company, PayPal.

What they want

One of three things, and they're happy with any of them:

Your password — via a link to a fake login page that looks perfect
Your verification code — the six digits your bank texts you
A phone call from you — which turns into one of the bigger schemes on this site

That third one is the growing version, and the sneakiest. There's no link to inspect and no fake website to spot. Just a phone number and a story. Security advice that's all about "don't click links" doesn't help you here.

The tells

The link is wrong, and the wrongness is small. Real: chase.com. Fake: chase-secure-alerts.com, chase.verify-account.net, chasebank-support.co. Everything before the last dot before the slash can be faked; only the part immediately before the first single slash is the real owner.

Better rule: don't inspect links at all. Don't get good at spotting fakes. Just never use one. Type the address yourself, or use your own bookmark, or your bank's app.

The greeting is generic. "Dear Customer," "Dear Account Holder." Your bank knows your name.

Urgency plus a deadline. 24 hours. Immediately. Or your account closes.

Small errors. Odd grammar, a strange space before punctuation, a logo slightly the wrong color. Note: the good ones have none of these anymore. AI writes clean English now. Absence of errors proves nothing.

It arrived out of nowhere. You weren't expecting a package. You don't drive that toll road. You don't have that subscription. Though sometimes you do — they send thousands and some land right.

What to do

Never use the link. Never use the number in the message.

Instead:

Open your bank's app, or type the address you already know
Call the number on the back of your card
Log in the way you always log in

If the alert is real, it will be waiting for you inside your account. If there's nothing there, there was nothing there.

Never read a verification code to anyone. Your bank sends those to keep other people out. Nobody legitimate will ever ask you to say one out loud or type it into a chat. Anyone asking is standing at your bank's front door trying to get you to hand them the key.

Don't reply STOP to a scam text. It confirms a live person reads that number. Delete it, or report it by forwarding to 7726 (SPAM) — free on all US carriers.

If you clicked and entered your password

Change that password immediately — on the real site, typed yourself
If you use that password anywhere else, change it there too. This is the real damage. One password, reused, unlocks a whole life.
Change your email password first if it was the same one
Turn on two-factor authentication where offered
Watch statements for three months

You are not in trouble. You typed something into a box. Millions of people do it every year, including people whose job is computer security.

The one change that makes this stop mattering

Reusing the same password everywhere is why one stolen password becomes ten stolen accounts. A password manager fixes that permanently: it invents a different, harder password for every site and remembers all of them, so you only have to remember one.

You likely already have one, free, built into a device you own — Apple ("Passwords" on iPhone and Mac), Google ("Password Manager" in Chrome and Android), and Microsoft (in Windows and Edge) all include one. You don't have to buy or install anything. Ask someone you trust to help you turn it on and move your most important passwords — email and banking first — into it.

The habit that ends this whole category

Never use a link or number that came to you. Reach the company your own way, every time, without exception.

That's not vigilance and it doesn't require you to inspect anything. It's one habit, and once you have it, this entire category of scam simply stops working on you — today's version and every version they invent next.