Key Insights
- Scammers leverage urgency and fear to override critical thinking, making static warnings less effective during active attacks.
- Community financial institutions can target high-risk inflection points, like new payee setups and unusual transfers, to prompt verification.
- Real-time prompts, callback procedures, and employee escalation paths help interrupt emotional manipulation before losses occur.
In the late 1800s, Wisconsin professor Warren Johnson had a classroom problem that had nothing to do with his students. A custodian interrupted lessons every hour to check whether the room was too hot or too cold, then returned to the basement to adjust the furnace dampers. Johnson wanted fewer interruptions — and more consistent temperatures. His solution, patented in 1883, was an electric room thermostat that signaled when the heat needed adjusting, eliminating the need for those hourly classroom visits. Later improvements automated the adjustments themselves.
Today, a home’s thermostat handles that work quietly in the background, responding to temperature changes without anyone having to stop and think about it. Human psychology has its own background processes, too. As this article explores, scammers exploit those instinctive responses, using fear, urgency, and apparent authority to push customers toward action before they pause to question a request.
For community financial institutions (CFIs), the challenge is to interrupt that response before money or credentials change hands. October’s Cybersecurity Awareness Month offers an opportunity to look beyond whether fraud communications raise awareness and ask whether they help customers stop, verify, and seek assistance at the moment a scammer is applying pressure.
Behavioral Insights and Internal Fraud Data
Institutions can use behavioral insights and internal fraud data to identify the scams causing the greatest customer harm. They can then move to delivering prompts that counter the scammer’s message, provide clear ways for customers to pause and verify, and establish escalation paths to CFI employees who can intervene before a customer loses money or credentials.
The American Banking Association’s #BanksNeverAskThat campaign can provide an accessible foundation this October to build awareness about phishing and bank impersonation. Its simple, memorable messages introduce and reinforce the fact that banks don’t ask customers to share passwords or one-time codes, click unexpected links, transfer money to a “safe” account, or keep a request secret. CFIs can build on that foundation with targeted digital, branch, contact center, and payment workflow safeguards tailored to their own fraud exposure.
Emotions Override Critical Thinking
Preventative messaging that explains how a scam works and advises customers to avoid it may fail during an active scam attempt. Scammers exploit feelings of urgency, authority, secrecy, scarcity, and fear. For many people and in the right circumstances, those emotions have the power to override critical thinking.
Other inherently human beliefs and behavior can also tilt the field in the scammer’s favor. For instance, optimism bias makes us more likely to believe that bad things will happen to other people, and confirmation bias makes us more likely to look for information that confirms what we already think and ignore data that disagrees with our beliefs. It’s a recipe for believing that, because we are smart, we won’t fall for a scam.
Urgency, scarcity, and authority are also in the scammer’s toolkit. Just as shoppers respond to a merchant’s announcement that a favorable price is only available for a certain period, scamming victims tend to act more readily if they feel that they must take quick advantage of an offer or move fast to avert a problem. Someone’s built-intendency to trust other people, stress, or loneliness can also make them more vulnerable to cybercriminals.
Identify High-Risk Inflection Points
Scammers are happy to catch nearly anyone, no matter what the victim is doing at the time. But some inflection points make customers more vulnerable or are a sign that they may have fallen for a scam. These include new payee setups, unusual transfers, large cash withdrawals, credential-sharing requests, and changes to contact information. A suspected bank impersonation is also a high-risk decision point, as the customer must decide whether to believe that the person on the phone represents the CFI.
CFIs can use Cybersecurity Awareness Month and the American Banking Association’s #BanksNeverAskThat materials to give customers memorable phishing and impersonation scam rules. For instance, the material offers five quick ways to spot an email scam:
- An unusual email address.
- Misspelled words or odd grammar.
- Urgent warnings and other scare tactics.
- A log in request. Real banks never ask you to log in via email.
- Unexpected attachments.
Deliver Scenario-Specific Interventions
In-app warnings, payment prompts, callback procedures, in-branch conversations, and contact center scripts can interrupt scam narratives, encourage a pause, and route customers to a safe verification channel.
For instance, CFIs can regularly remind customers that if they receive a call claiming to be from their financial institution, they should hang up and call back using the number listed on the institution’s website. Similarly, a simple reminder such as “We don’t send links” on statements can help customers recognize suspicious messages and avoid malware.
For maximum effectiveness, interventions should boldly attract attention, interrupt instinctive actions, and direct customers toward the behavior most likely to protect them. A teller who notices that a regular customer is uncharacteristically nervous, for example, might explain that banks and law enforcement never ask anyone to secretly wire money. A bank manager can confirm this and take the customer to a private office to talk about what happened, breaking the sense of psychological urgency the scammer has intentionally brought to bear.
Manage communication as a fraud-control program. Outline cross-functional responsibilities and practical metrics, including prevented losses, warning-driven transaction cancelations, escalation outcomes, false-positive rates, repeat victimization, and customer experience. Measure whether messaging is reducing harm.
CFIs can use material from the American Banking Association’s #BanksNeverAskThat campaign to build awareness about phishing and bank impersonation. Simple, memorable messages introduce and reinforce the fact that banks don’t ask customers to share passwords or one-time codes, click unexpected links, transfer money to a “safe” account, or keep a request secret. CFIs can build on that foundation with targeted digital, branch, contact center, and payment workflow safeguards tailored to their own fraud exposure.
