The most dangerous scam may start with someone being helpful.

The Scam Call That Doesn’t Sound Like a Scam

The most dangerous scam may start with someone being helpful.

Imagine your phone rings.

“Hi, this is going to sound strange, but I think I found something that belongs to you.”

The caller mentions a jacket. A bag. A watch. Maybe another personal item.

They aren’t threatening you.

They aren’t claiming to be the IRS.

They aren’t asking you to buy gift cards.

They sound like a normal person trying to do something nice.

And that is precisely why you should be suspicious.

Scammers Are Learning That Fear Isn’t Always the Best Weapon

For years, scam calls were relatively predictable.

“Your Social Security number has been suspended.”

“Your grandson has been arrested.”

“Your computer has a virus.”

“Your bank account has been compromised.”

Those scams still exist, but people have become better at recognizing them.

So social engineering is evolving.

Instead of immediately frightening you, a sophisticated scammer can begin by creating curiosity and trust.

A strange caller claiming to have found something belonging to you is an excellent example.

The natural response is:

“What did you find?”

“Where did you find it?”

“How did you know it was mine?”

Those questions begin a conversation — and the conversation itself can become the attack.

The First Goal May Not Be Money

This is something people misunderstand about modern scams.

The first phone call doesn’t necessarily need to steal anything.

It may simply need to learn something.

Suppose someone says:

“I found a watch with your information connected to it. Did you lose a watch recently?”

You might respond:

“No, but my son has an Apple Watch.”

Now the caller knows you have a son.

They might continue:

“Interesting. Could it belong to him?”

You might reveal his name.

A few innocent questions later, the stranger potentially knows family relationships, possessions, locations, travel habits or other details that can make the next attack far more believable.

Cybersecurity professionals call this social engineering.

The attacker isn’t hacking the computer.

They’re hacking the conversation.

AI Makes These Conversations Far More Dangerous

Artificial intelligence changes the economics of scams.

Scammers can increasingly combine information from data breaches, social media, public records and other sources with automated systems capable of conducting convincing conversations.

AI voice technology adds another problem.

The Federal Trade Commission has specifically warned that modern voice-cloning technology can reproduce someone’s voice from relatively small samples of recorded audio, creating opportunities for convincing impersonation scams. (Consumer Advice⁠)

And detecting these voices by ear is becoming unreliable.

A 2026 study examining AI-generated voices in simulated vishing attacks found participants struggled badly to distinguish synthetic voices from real ones. In the experiment, 75% of AI-generated samples were judged by a majority of participants to be human. (arXiv⁠)

That changes an important cybersecurity assumption:

A familiar voice is no longer proof of a familiar person.

The Innocent Conversation Can Become Reconnaissance

Consider how easily an unusual lost-item conversation could develop.

“Is this Michael?”

“Yes.”

“I found a watch that might belong to someone in your family.”

“Where?”

“Near the airport.”

“Oh, we were there last week.”

“Were you traveling with your family?”

“Yes.”

“Maybe one of your kids dropped it.”

Suddenly the caller has confirmed your identity, recent travel and family information.

None of those questions individually feels particularly dangerous.

Together, they’re intelligence.

That information could later make a phishing email, text message or impersonation attempt significantly more convincing.

The person who calls tomorrow doesn’t necessarily need to be the person who called today.

The Second Call Is Where Things Can Get Ugly

Imagine another call several weeks later.

Someone sounds like your child.

There’s panic in their voice.

They mention the airport.

They know about the trip.

They know your name.

They know details about your family.

And they need money immediately.

The FTC warns that scammers already use AI voice cloning in family-emergency scams and deliberately create urgency so victims act before independently verifying what happened. (Consumer Advice⁠)

Suddenly the harmless conversation about a missing watch looks very different.

This doesn’t mean every unusual call is part of an elaborate AI operation.

It means we need to change how we evaluate strangers who unexpectedly know something about us.

Stop Judging Calls by How Friendly They Sound

People often look for the wrong warning signs.

They listen for foreign accents.

Robotic voices.

Aggressive sales tactics.

Bad grammar.

Strange pauses.

Those signals are becoming increasingly useless.

The better question is:

Why does this stranger need information from me?

If someone legitimately found your property, you shouldn’t need to provide a biography to retrieve it.

Ask the caller to describe the item.

Don’t describe it for them.

Ask where it was found.

Don’t tell them where you’ve recently traveled.

Ask how they obtained your telephone number.

Don’t provide additional identifying information to help them “confirm” your identity.

Most importantly, don’t allow curiosity to override skepticism.

Use the Reverse Verification Rule

This is one of the simplest cybersecurity habits you can teach employees and family members:

The person initiating the contact does not get to establish their own identity.

If your bank calls, hang up and call the number printed on your card.

If someone claims to represent your child’s school, call the school directly.

If someone claims to be a coworker, contact that coworker through your normal communication channel.

If someone claims to have found something belonging to you, make them describe it first.

Never verify an unexpected caller using telephone numbers, links or information that the caller provides.

You independently find the trusted contact method.

The FTC recommends essentially the same principle for impersonation scams: stop and independently verify the story before taking action. (Federal Trade Commission⁠)

Businesses Need to Teach This Too

This isn’t merely a consumer problem.

The same psychology works extraordinarily well against businesses.

An employee receives a friendly call:

“I’m trying to return something one of your employees left at our office.”

“I’m trying to reach whoever handles your insurance.”

“Someone from your accounting department asked me to call.”

“I’m returning a laptop that belongs to your company.”

The employee wants to help.

So they provide a name.

A department.

An email address.

A manager.

A vendor.

A travel schedule.

Attackers can then use those details to construct much more convincing phishing and business-email-compromise attacks.

For an SMB, healthcare organization, law firm or school, that seemingly harmless information can become the reconnaissance stage of a cybersecurity incident.

A good Managed IT or cybersecurity program therefore shouldn’t only teach employees:

Don’t click suspicious links.

It should teach:

Don’t help strangers build the story they’ll eventually use against you.

Five Rules for Strange Phone Calls

1. Make the caller provide information first.
   If they supposedly found your watch, ask them to describe it. Don’t tell them what yours looks like.

2. Never authenticate yourself to an unexpected caller.
   Avoid confirming birthdays, addresses, family members, account information or travel details.

3. Break the communication channel.
   Hang up and independently contact the organization or person supposedly involved.

4. Ignore caller ID as proof of identity.
   The FTC warns that scammers can manipulate the name or number displayed on caller ID. (Consumer Advice⁠)

5. Teach your family and employees one sentence:
   “I don’t verify information on incoming calls.”

That sentence can stop an extraordinary number of social-engineering attacks.

AI Didn’t Invent Scamming. It Industrialized It.

The broader threat is very real: the FTC says Americans reported $3.5 billion in losses to impersonation scams in 2025, nearly triple the losses reported in 2020.

Scammers have manipulated people for centuries.

What AI changes is scale.

It can help attackers research targets, personalize conversations, generate convincing messages and reproduce voices at a speed that previously required significant human effort.

That means cybersecurity can no longer focus exclusively on protecting computers.

We also have to protect conversations.

The next sophisticated cyberattack against you might not begin with malware.

It might begin with a friendly stranger saying:

“I think I found something that belongs to you.”

And your safest response may be to reveal absolutely nothing.

70% of all cyber attacks target small businesses, I can help protect yours.

#Cybersecurity #ArtificialIntelligence #CyberSecurityAwareness #DataProtection #SmallBusiness