Bulletproof Online Field Kit
Protection Checklist
0 of 18
Accounts
Devices
Crypto
Habits
Protect My Parents
The 1% Academy
Family Code Word
A word only your family knows. Nothing here is saved, and there is no account to create.
- Pick a secret word together. Choose something you would not say by accident, and do not use a pet name, a street, or a word that is already online.
- On any urgent call that claims to be a relative, ask for the word before you talk about money, gift cards, or bail.
- If they do not know it, hang up. Call that relative back on the number already saved in your phone.
- Stop and verify on a channel you trust.
- Never pay with gift cards, a wire, cryptocurrency, or a cryptocurrency ATM because someone told you to.
- Do not open links from unexpected texts or emails.
- Never share codes, passwords, or a recovery phrase.
- Hang up and call the number on your card.
- Use a family code word.
- Banks and the government never ask you to move money to protect it.
- Anyone offering to recover lost money for a fee is a scam.
- AARP Fraud Watch Network Helpline 877-908-3360
- National Elder Fraud Hotline (U.S. Department of Justice) 833-FRAUD-11 (833-372-8311)
- Report a scam: ReportFraud.ftc.gov
The 1% Academy · Bulletproof Online · Free, nothing to buy
Scam Scenarios · 0 correct of 0 answered
Chapter steps
1. Phishing, fake ads, and social tricks
- ☐ Hover over every link (or press and hold it on a phone) to see where it really goes. If the web address is off by even one letter, it is fake.
- ☐ Never sign in from a link in a message. Open the company's app, or type the official web address yourself.
- ☐ Treat urgency, fear, and “too good to be true” offers as the warning sign, not bad spelling.
- ☐ Report it. Use your mail app's “report phishing” button. If money moved, also report it to the Federal Trade Commission (FTC) at ReportFraud.ftc.gov or to the FBI's Internet Crime Complaint Center (IC3) at ic3.gov.
2. Email as the master key
- ☐ Protect email with a passkey or a hardware security key before any other account.
- ☐ Check the full sender address, not just the display name that shows in your inbox.
- ☐ Do not open surprise invoices or shipping documents (often PDF files). Sign in to the real account yourself instead.
- ☐ Confirm any change to payment details on a separate channel. Call the person on a number you already have, not one in the email.
3. Public Wi-Fi and VPNs: what they do and don't do
- ☐ Treat a virtual private network as optional. It is not protection against fraud.
- ☐ Do not click a link, pay, or type a password because the tunnel is turned on.
- ☐ If you use one, install it from the provider or the official store, not from an advertisement or a text.
- ☐ When a public network looks wrong, use cellular data instead.
4. Passwords, passkeys, and keys
- ☐ Move every important login into a password manager this week.
- ☐ Turn on passkeys anywhere the service offers them.
- ☐ Register two hardware keys on email and the password manager. Store one offline.
- ☐ Stop using text-message (SMS) codes on cryptocurrency, email, and banking accounts as soon as an authenticator app or a security key is available.
5. Romance scams
- ☐ Do not send money to someone you know only through messages.
- ☐ Search their photos with a reverse image search (Google Lens or TinEye). The same face under a different name is a reason to stop.
- ☐ Refuse any private trading website or app account they want you to open.
- ☐ Tell a friend what is happening. Secrecy is part of the script, and it is optional for you.
6. QR code lures
- ☐ Do not scan a QR code from an unexpected email, letter, or sticker.
- ☐ If a sticker looks crooked or newly placed over a meter or a menu, do not scan it.
- ☐ Read the full web address before you type a password or a card number.
- ☐ When you can, open the company from an application or a bookmark instead of from the code.
7. Marketplace, ticket, and rental scams
- ☐ Do not ship an item until the money is actually in your account.
- ☐ Do not pay a stranger with gift cards, a wire, or cryptocurrency for goods you have not received.
- ☐ Keep the conversation on the listing site. A request to move to text is a reason to slow down.
- ☐ For a rental or an event, verify the host or the venue on a site you opened yourself.
8. Fake direct messages (DMs), wallets, and giveaways
- ☐ Ignore giveaway direct messages (DMs). If it asks you to send crypto first, it is a scam.
- ☐ Type wallet and exchange web addresses yourself. Bookmark them once, from the real site.
- ☐ Never enter a seed phrase into a website, a form, or a “support” chat.
- ☐ If a browser extension asks for your private key (the secret code that controls a wallet), cancel and remove it.
9. Rug pulls and junk coins
- ☐ If you cannot name the team behind a coin and confirm who they are somewhere other than the project's own site or chat, do not buy.
- ☐ Treat surprise “airdrops” (free tokens that appear in your wallet) and brand-new “meme coins” (joke coins with no business behind them) as hostile by default.
- ☐ Before you trade, look up the coin's official contract address (its unique ID) on a block explorer such as Etherscan, a public site that shows blockchain records. Names are cheap to fake.
- ☐ Size any speculative bet so a total loss does not touch rent, savings, or a hardware wallet.
10. Pig butchering
- ☐ Unsolicited warmth that turns into investing is the scam. Stop there.
- ☐ Never move savings, retirement, or a loan into a platform someone you have not met recommended.
- ☐ A site that shows profits but blocks withdrawals is not having a delay. It is the final stage of the scam.
- ☐ Video calls can be faked. Verify through a channel you chose, not one they sent.
11. Crypto ATM scams
- ☐ Hang up if anyone tells you to use a cryptocurrency ATM. Do not go to the machine.
- ☐ If you are already there, stop. Tell the clerk you are being scammed and do not insert more cash.
- ☐ Keep the receipt. Call your bank on the number printed on your card, and report the wallet address.
- ☐ File reports with the Federal Trade Commission (ReportFraud.ftc.gov) and the FBI (ic3.gov). Anyone who offers to recover the cash for a fee is a second scam.
12. SIM swaps and the phone number
- ☐ Ask your carrier for a port-out lock or account PIN (personal identification number), which stops anyone from moving your number without it. Verizon, AT&T, and T-Mobile all offer a version.
- ☐ Move crypto, email, and banking off text-message (SMS) codes.
- ☐ Use a phone number and email address for crypto accounts that do not appear on your public social-media profiles.
- ☐ If your service dies without warning, call your carrier from another phone, and lock your crypto exchange accounts.
13. Malware that steals cryptocurrency
- ☐ Before every send, compare the first several and the last several characters of the pasted address with the original.
- ☐ Download wallet software only from the official website. Remove browser extensions you do not recognize.
- ☐ Keep the operating system, the browser, and an antivirus program such as Windows Security or Malwarebytes updated.
- ☐ Put long-term holdings on a hardware wallet and read every destination address on the device itself.
14. Protect your recovery phrase
- ☐ Recovery phrase: kept offline on metal or paper, never shared, never typed into a website.
- ☐ Buy a hardware wallet only from the manufacturer's official store. Check every receiving address on the device's own screen.
- ☐ Read the start and end of every pasted address before you send.
- ☐ If you have been compromised: create a new wallet on a computer you trust, move what is left, and report it to the FBI's Internet Crime Complaint Center (ic3.gov) and to your exchange.
15. Wallet drainers and token approvals
- ☐ Reject any wallet prompt you did not expect, especially one that says approve or permit.
- ☐ Do not connect your wallet to a “mint” or “airdrop” you found in a message or an advertisement.
- ☐ If you already signed, open revoke.cash (a free site that lists the approvals your wallet has given) yourself, or the token-approval page on a block explorer, and revoke (cancel) the unknown approval.
- ☐ Move remaining funds to a new wallet only from a computer you trust, and only after the bad approval is revoked.
16. Address poisoning
- ☐ Never copy a payment address from your transaction history.
- ☐ Save trusted recipients in the wallet address book after you have checked the full address once.
- ☐ Compare the entire address, not only the first and last four characters, before you send.
- ☐ Ignore tiny “dust” transfers (very small amounts) you did not expect. Do not send anything back to them.
17. Smishing and the delivery text
- ☐ No links from unexpected texts. Not tolls, not the U.S. Postal Service (USPS), not your bank, not the Internal Revenue Service (IRS).
- ☐ Check a delivery inside the shipping company's app, or by typing its website yourself.
- ☐ Turn on carrier spam filtering and a call-screening app you trust.
- ☐ Forward junk texts to 7726 (it spells SPAM) when your carrier supports it, and report them to the Federal Trade Commission at ReportFraud.ftc.gov.
18. Fake virus alerts on the phone
- ☐ Close virus pop-ups. Do not call the number on them and do not install the application they offer.
- ☐ On Android, turn off installs from unknown sources except in the rare moment you truly intend to use one, then turn it off again.
- ☐ On an iPhone, do not install a configuration profile because a website told you to.
- ☐ If you already installed it, disconnect from the network, delete the application, run the phone’s built-in protection, and change passwords from a different device.
19. Vishing and cloned voices
- ☐ Let unknown numbers go to voicemail. Scammers hate a delay.
- ☐ Never read a one-time code, a password, or your full Social Security number (SSN) to a caller.
- ☐ Family emergency calls: hang up and call that person back on the number already in your phone.
- ☐ Agree on a family code word for real emergencies. A cloned voice will not know it.
20. Grandparent and family emergency calls
- ☐ Hang up. Call your relative on the number saved in your phone.
- ☐ Set a family code word and tell each person how you will use it.
- ☐ Do not pay a caller who says not to tell the rest of the family.
- ☐ If you already sent money, call your bank on the number on your card and use Get help now.
21. One-ring and premium-rate calls
- ☐ Do not return one-ring calls, especially numbers that start with an unfamiliar country code.
- ☐ Turn on silence-unknown-callers on an iPhone, or caller-identification and spam protection on Android.
- ☐ Read the bill for premium or international charges and dispute charges you did not make.
- ☐ Report the number to your carrier and to ReportFraud.ftc.gov.
22. Malware and spyware on the phone
- ☐ Install from the official stores only, and read recent reviews before you install anything new.
- ☐ Watch for a battery that drains much faster, data use you cannot explain, new applications you did not install, or the phone running hot while idle.
- ☐ Scan with the built-in protection. On Android that is Google Play Protect. Delete anything you do not recognize.
- ☐ Keep the system updated. Most mobile malware prefers phones that are months behind.
23. Zero-click attacks
- ☐ Install operating-system updates as soon as they are offered. That is the actual fix for a zero-click flaw.
- ☐ Restart the phone after major updates so the new system is what is running.
- ☐ Do not install a scanner because you are worried about spyware. Use the manufacturer’s update and, if needed, a known security vendor.
- ☐ If you are in a high-risk role and the phone behaves strangely after a message you did not open, get help from a reputable incident responder rather than from a caller who found you.
24. Wrong-number texts that become relationships
- ☐ Do not continue a conversation with a wrong-number text that becomes personal.
- ☐ Never send money, gift cards, or cryptocurrency to someone you have not met, no matter how long you have been texting.
- ☐ Search their photos. If the same face is attached to other names, stop.
- ☐ Report the account on the app you are using, and report the loss to the Federal Trade Commission if money moved.
25. Agencies, one-ring, and fake support
- ☐ Hang up on threats of arrest, deportation, or a suspended Social Security number.
- ☐ Check tax questions by signing in at irs.gov, and check tickets or fines with the agency directly, not through the number in the message.
- ☐ Do not return one-ring calls from strange country codes. Check the bill monthly.
- ☐ Never install remote-access software because a pop-up or a caller told you to.
26. Your bank says move your money
- ☐ Hang up if anyone tells you to move money in order to protect it.
- ☐ Call the number on the back of your card. Do not use a number they gave you.
- ☐ Do not share a one-time code, and do not let them remote into your computer.
- ☐ If money already left, tell the bank it was fraud and ask for a recall the same day.
27. Job and task scams
- ☐ Do not deposit your own money to unlock tasks, withdraw earnings, or keep a job.
- ☐ Stop when an offer you did not apply for asks you to pay in order to get paid.
- ☐ Ignore the small payments you already received. They do not make the next request legitimate.
- ☐ Report the account on the app, and report the loss if you already sent money.
28. Signs the phone may already be compromised
- ☐ If several symptoms started together, disconnect from Wi-Fi and Bluetooth and delete any app you do not recognize.
- ☐ From a different device, change the email password, sign out other sessions, and check the carrier account for a recent SIM change.
- ☐ Run the phone's built-in malware scan. On Android, open Google Play Protect.
- ☐ If money or accounts were touched, follow the Get help now page the same day.
29. Daily prevention, written as a list you can finish
- ☐ Move email and banking off text-message codes and into an authenticator application or a passkey.
- ☐ Put a password manager on the phone and stop reusing passwords.
- ☐ Keep recovery phrases and photos of identity documents out of the camera roll.
- ☐ Check call forwarding and the monthly bill, then show this list to someone you live with.
30. Lock the device itself
- ☐ A six-digit passcode (PIN) or longer, plus face or fingerprint unlock. Remote wipe turned on.
- ☐ Review permissions. Remove anything a simple application does not need.
- ☐ Automatic system and app updates on. No installers from a text message, and Google Play Protect left on (Android).
- ☐ Charge in public from your own cable or a wall outlet, and test that your backup restores.