The 3 Kinds of Financial Fraud:
which defense works for each

The illegal wing of the same business

$230 Billion a Year Is the Price of Inattention: the fees worth moving accounts over catalogued the legal ways money gets taken from you. This chapter covers the criminal ones — fraud, scams, identity theft. They run on the same fuel: not paying attention, being rushed, and a good story. They just aren't bound by any rules about disclosure.

The defenses will look familiar, and that's the point. The same visibility and structure that beat the legal extraction beat most of the criminal kind, because both depend on nobody watching.

The three kinds of threat

Someone gets into your account. Your login is stolen or phished and the account is emptied. The defenses are unglamorous: a different password for every account, kept in a password manager; two-factor authentication anywhere money lives; and suspicion of every login link that arrives in a message. Go to the site yourself instead. The real bank will still be there in ten seconds.

Someone opens credit in your name. This is identity theft, and the structural defense is a credit freeze — free at all three bureaus,¹ and it blocks anyone from checking your credit to open something new until you unfreeze it. It is the single most valuable thing you can do here and hardly anyone does it. The free weekly reports (VantageScore vs. FICO: why the free number isn't the one your lender sees) are how you spot anything that gets through.

Someone talks you into it. The fake call from the tax office or the bank's fraud team, the grandchild in trouble, the investment that's too good, the romance that turns into a crypto request. They all share the pattern in Stories Beat Statistics: the 3 questions to ask any narrative: a story, a reason to hurry, and a way of paying that can't be reversed — a wire, gift cards, crypto, chosen precisely because you can't get the money back.

The tells are always the same. Real institutions don't demand secrecy, don't demand speed, and don't ask to be paid in unusual ways. Anyone who does is reading from a script.

The four defenses

Most of this curriculum has already built them.

Watching is how you detect it. A household that sees every transaction (Can't See Where It Goes? mapping every account) catches fraud in days rather than when the statement arrives. Plenee's feed is exactly this tripwire.

The freeze is how you prevent it. Keep all three files frozen as your normal state, and unfreeze only when you're actually applying for something (Half a Point of Mortgage Rate Costs $48,000: the 12-month runway builds the thaw into the run-up).

The pause is what kills scams. Take 5 Ways to Outsmart Your Own Money Habits's 48-hour rule and apply it here: nothing financial that started with someone contacting you happens the same day. Ever. It costs nothing and defeats almost every script, because every script depends on hurry.

Agree a household rule in advance. A code word for real emergencies, and a habit of hanging up and calling back on a number you already have. Decide it before it happens, because these scripts are built to target the moment when you're frightened. In 2025, Americans aged 60 and over filed more than 200,000 fraud complaints, reporting over $7.7 billion in losses.² That's only what got reported.

The takeaway

Fraud is extraction without the disclosure rules, and it dies in the same light. Freeze your credit files, put two-factor on anything holding money, watch your transactions, and give every urgent story that arrives out of the blue 48 hours it can't survive. The entire business model depends on catching households that weren't looking, and by this point in the curriculum that isn't you.