I No Longer Know If Warnings Do Any Good

Let me say this at the start. This article has no conclusion.

Normally a piece like this ends with "so please be careful." This time I could not write that line. Every time I tried, I stopped believing my own words. So instead I am going to write down the process by which I lost my footing.

There it was again

I read that a man in Akita City had been swindled out of more than fifty million yen in cryptocurrency. The very next day. Only the number of digits changes; the local paper carries a story like this almost every week.

My first thought, reading it, was this: is this really fraud, or is it just a failed investment?

I was wrong. A failed investment means you bought something that exists and its value went down. In this method, the thing you bought does not exist. The moment the money goes to the address the other side gave you, it is theirs, and the "unrealized profit" shown on the screen is just numbers. It has not gone up and it has not gone down. Nothing was ever moving.

The tell usually appears when you try to take the money out. There is a fee to pay. There is tax to pay in advance. There is a deposit required to lift a freeze on the account. A real exchange does not require an incoming payment in order to make an outgoing one. None of this has anything to do with cryptocurrency in particular. The same method has been run for decades with gold bars and unlisted shares.

Writing it out made me uncomfortable with myself. "Isn't this just a failed investment" is the single most common reaction that surfaces every time one of these cases is reported. And I had been about to write it down as though it were my own original insight.

I looked into why I do not fall for these

So I turned to my own case.

The fake police officer call would probably not work on me. The reason is simple: if you really were the suspect, the police would not telephone you. They arrive at your door one day without warning. I have been stopped and questioned by officers myself, and I know a little about how that organization actually moves. So when a voice on the phone tells me I am the culprit, the conversation ends right there.

Investment fraud would probably not work on me either. Because I do not invest.

Romance fraud would probably not work on me either. I use social media, but I have no appetite for sharing anything with people I do not already know, and I have no wish to fall in love over the internet. However much affection the other side shows, I can refuse it.

And here is what I noticed as I wrote that. This is not a story about judgement.

I am not avoiding these things by thinking clearly each time. The situation simply never arises. I do not own a drawer marked "investment," so investment talk cannot get in. I do not own a drawer marked "internet romance," so nothing can come in through it. I am safe not because I am clever, but because I am not carrying it.

This is the same shape as something I have written here in this column many times. Do not leave extensions installed that you do not use. Turn off the features you do not need. What you are not carrying cannot break.

Which means that a measure only works if it demands no judgement. "If something feels suspicious, check it" hands nothing at all to the person who never felt it was suspicious.

So this ought to prevent it

Filter by that condition, no judgement required, and not much survives.

One. Do not call back the number that called you. Look up the organization the caller named yourself, and call the number you found. No assessment of content is needed. It is simply a procedure.

Two. Sleep on it. Anyone insisting you decide today is holding something that falls apart tomorrow. This requires no judgement either.

Three. Say it out loud to one other person. You do not even need them to evaluate it. Somewhere in the middle of saying it, your own ears will notice.

And then there is this, which I think is the real one.

If you are told "please do not tell anyone," it ends there.

The fake police officer says it is confidential to the investigation, so please do not mention it even to your family. Romance fraud says let us keep this between the two of us. Investment fraud says this is being shared with you specially, so please keep it to yourself. The methods look nothing alike, and yet every one of them makes the same demand. It does not work unless you are isolated.

This requires no experience with investing and none with social media. You do not have to understand the content at all. The moment secrecy is requested, you stop, regardless of what is being discussed.

Having written it down, I thought it was rather good.

And yet it does not go down

These few things should erase almost all of the risk, and still the numbers do not fall. They rise.

That is where I lost my footing.

Why does something this simple not get through? Warnings are printed in the newspaper, broadcast on television, put in the city newsletter, taped to the wall of the bank. People read all of it and send the money anyway. I have seen the phrase "I knew about it" in these accounts more than once.

Is there any point in warning people? Is it even a thing worth doing? I have stopped being sure.

I have written several pieces on fraud in this space already. The week after I publish one, another case appears. It appears whether I write or not. So what exactly am I writing for?

Two things I did work out

Still, thinking it over, two things did come clear.

The first. You cannot get from "it is rising" to "the warnings are not working."

At the same rate of success, ten times the attempts produce ten times the victims. What has grown in recent years is not the number of careless people but the number of calls placed, messages sent, lists circulating, and the means of pulling money across borders. Writing the script and translating it used to take human hands. It no longer does. The unit cost of an attack fell, so the volume rose.

This is the same structure as the piece I wrote here recently about vulnerabilities in websites. The danger did not increase. What changed was the speed and the volume on the attacking side. The same thing is simply happening to people instead of servers.

So a warning can be working and the total can still rise. The rise proves nothing.

The second. A warning that worked never becomes a news story.

Nobody hears about the person who remembered and hung up. The one who felt something was off and slept on it, the one who told their family and stopped, they do not appear in the paper. Only the failures run.

The information I see every day is built so that only one side of it is ever visible. A fair amount of that feeling of futility comes from exactly there.

The label on the drawer

There is one more thing that fell into place.

Were the people who failed to follow those three rules foolish? I do not think so.

Those three sit in the drawer marked "fraud" inside your head. But to the person it is happening to, this is not fraud. This is "a call from the police." This is "a kind person giving me advice." The label on the drawer is different, so the drawer never opens. It is not that they did not know. It is that they could not recognize that it applied.

That is why "please be careful" does not land. It cannot be used until you have judged the content first.

"If they tell you to keep it secret, it ends there" has a chance of landing precisely because it routes around judgement. Whatever the other side claims to be, whatever the conversation is about, the moment that sentence appears, you stop.

My own safety is probably full of holes too

Having got this far, I come back one last time to myself.

I do not invest, so I am strong against investment fraud. I do not date online, so I am strong against romance fraud. Does that make me admirable? No. Those two things simply happen to sit outside my life.

So what happens when it comes from inside my life?

An email from someone claiming to be a new supplier of materials. An invoice saying my domain registration is about to lapse. A notice claiming a photograph I published infringes copyright. An urgent security warning from someone claiming to be the developer of an extension I actually use.

All of these arrive in a place where I have no choice but to make a judgement. And fraud is a business that reshapes itself to fit the target's life.

I opened up "I would never be fooled" to see what was inside, and what I found was neither virtue nor knowledge. It was a coincidence: the shape of the attack and the shape of my life had happened not to fit together. It is now quite clear that I am in no position to laugh at anyone.

Why I write it anyway

In the end, I still do not know whether warning people means anything. I am writing without knowing.

But I have decided to change what I expect of it.

More of the people reading this will be standing next to a target than will be the target. What stops these cases is usually not the victim but the teller at the counter, or the family. So write toward them.

And one more thing. With this kind of harm, the real contest is between the moment you realize and the moment you stop. The reason it reaches fifty million is that somewhere along the way you decide there is no going back, and what makes you decide that is the shame of having been fooled.

So let me put this down at least. Being deceived is not shameful. It is not an examination of your judgement. It is a business that first builds a state in which your judgement cannot function, and only then brings up the money. The order is the other way round.

The existence, somewhere in the world, of a piece of writing that says "this happens to anyone" probably raises, very slightly, the chance that one person speaks up a day earlier. A day earlier is one digit less.

If I measured this by whether the harm went to zero, I would stop writing immediately. Instead: one person, once, speaking up one day sooner. That is the ceiling, and I have decided it is enough.

There is only one tool I am leaving behind, and I am leaving it without certainty.

If you are told "please do not tell anyone," it ends there.

About the rest, I really do not know.