Recognise the pressure line before it reaches your desk.
Twelve annotated, illustrative reconstructions drawn from public scam guidance and incident patterns. They are not transcripts of real recorded calls. Each card shows the psychological lever, the tell and the exact verification line that ends the pretext.
Content warning and safe-use note
Educational use only. These cards describe pretexts and manipulation at a defensive level. They omit operational detail for spoofing, account compromise or voice cloning. Share the stopping line in training; do not treat the reconstructed dialogue as evidence of what happened in a specific incident.
The settlement-redirection call
The caller says a genuine matter is ready to settle and a last-minute account correction must be used before the cut-off.
Illustrative reconstruction — not a transcript
“The email thread has the updated details — please release it now and we can tidy the file note later.”
- Psychological levers
- UrgencyFamiliarityAuthority
- Tell-tale moments
- A changed destination account, a deadline used to suppress checking, and a request to trust the existing thread.
- The line that kills it
- “I will call the client on the number already held on file and verify the instruction before any funds move.”
The 'ATO officer'
The caller borrows the ATO's authority and claims an urgent account or debt problem needs immediate staff action.
Illustrative reconstruction — not a transcript
“This must be dealt with today. Stay on the line while we resolve the account.”
- Psychological levers
- AuthorityFearUrgency
- Tell-tale moments
- Threats, insistence on staying connected, and resistance to independent contact with the agency.
- The line that kills it
- “We do not continue this conversation on an incoming call. I will contact the ATO using its official published number.”
The 'bank fraud team' callback
The caller says suspicious activity has been detected and offers to transfer the staff member to a specialist.
Illustrative reconstruction — not a transcript
“For your protection, do not hang up — I am connecting you to our security desk now.”
- Psychological levers
- FearAuthorityUrgency
- Tell-tale moments
- The incoming caller controls the entire callback path and discourages independent contact.
- The line that kills it
- “I will end this call and contact the bank using the number on our existing record.”
The panicked client
A caller claims to be a known client facing an emergency and asks reception to bypass the ordinary payment process.
Illustrative reconstruction — not a transcript
“You know me — there isn't time for the normal check. Please put the transfer through and I'll send the paperwork later.”
- Psychological levers
- FamiliarityUrgencyEmotion
- Tell-tale moments
- Personal knowledge is treated as proof, process is postponed, and urgency increases when verification is mentioned.
- The line that kills it
- “I can help as soon as the code sent to the mobile already on file is read back.”
The 'IT support' receptionist call
The caller claims a security incident requires the receptionist to disclose information or follow instructions immediately.
Illustrative reconstruction — not a transcript
“I'm from IT and the principal has approved this. I need you to confirm the account details before the system locks.”
- Psychological levers
- AuthorityFearTechnical confidence
- Tell-tale moments
- An unexpected support call, borrowed executive authority, and a request for information outside the approved support channel.
- The line that kills it
- “I will end the call and contact our IT provider through the support details in our records.”
The voice-cloned director
A familiar-sounding voice claims to be a director and requests a confidential urgent payment.
Illustrative reconstruction — not a transcript
“It's me. Keep this between us until the announcement and process the payment before the meeting starts.”
- Psychological levers
- FamiliarityAuthoritySecrecy
- Tell-tale moments
- Voice familiarity substitutes for process, secrecy blocks peer review, and the payment sits outside the normal workflow.
- The line that kills it
- “I will verify this request through the director's known mobile and our usual payment approval path.”
The fake adviser cold-call
The caller uses public licence and firm details to make an unsolicited investment or rollover approach sound legitimate.
Illustrative reconstruction — not a transcript
“You can check our licence online. This rollover window is closing, so I need your authority today.”
- Psychological levers
- AuthorityScarcityFamiliarity
- Tell-tale moments
- Public facts are presented as secret proof and an unsolicited approach becomes time-critical.
- The line that kills it
- “I will contact the advice firm using the number I source independently before discussing any rollover.”
The fake lender callback
A caller claims a lender needs a quick correction before approving or settling a client's loan.
Illustrative reconstruction — not a transcript
“The application is approved, but the payout details must be confirmed now or settlement will be delayed.”
- Psychological levers
- AuthorityUrgencyOutcome pressure
- Tell-tale moments
- A consequential change arrives outside the lender portal and delay is used to discourage verification.
- The line that kills it
- “I will call the lender using the contact in our accredited channel and verify the request there.”
The SMSF rollover pitch
An unexpected caller offers to move superannuation into a supposedly better self-managed arrangement.
Illustrative reconstruction — not a transcript
“We've reviewed your super and can move it before the market changes, but the paperwork needs to start today.”
- Psychological levers
- ScarcityAuthorityFinancial anxiety
- Tell-tale moments
- Unsolicited contact, a promised improvement without a trusted relationship, and pressure to start a rollover immediately.
- The line that kills it
- “I will stop here and verify the adviser and firm through independently sourced records before taking any action.”
The compromised-mailbox withdrawal
A genuine client mailbox sends a plausible withdrawal request, followed by a caller asking to change the destination account.
Illustrative reconstruction — not a transcript
“I sent the signed form from my usual email. Please use the new account in my follow-up message.”
- Psychological levers
- FamiliarityConsistencyUrgency
- Tell-tale moments
- A real mailbox is treated as identity proof and the destination account changes after the original instruction.
- The line that kills it
- “I will send a code to the mobile already on file and verify the changed account through our approved process.”
The deposit-day agency impersonation
A buyer expecting instructions receives a call that appears to confirm altered deposit details.
Illustrative reconstruction — not a transcript
“The trust account in the earlier email is being reconciled. Use the replacement details so the property is not released.”
- Psychological levers
- UrgencyAuthorityExpectation
- Tell-tale moments
- The caller exploits a payment the buyer already expects and introduces replacement details at the last moment.
- The line that kills it
- “I will call the agency on the number published independently and read the full account details back.”
The supplier bank-detail change
A caller follows a plausible invoice email and asks accounts staff to update the supplier's payment destination.
Illustrative reconstruction — not a transcript
“Our banking has changed. The invoice is due today, so please update the supplier record before the payment run.”
- Psychological levers
- RoutineUrgencyFamiliarity
- Tell-tale moments
- A routine invoice masks a consequential account change and the supplied contact channel is used to confirm itself.
- The line that kills it
- “I will contact the supplier using the number already in our vendor record before changing any payment details.”
Public sources are cited as evidence of the threat patterns only. No endorsement of Vericode by Scamwatch, the Australian Cyber Security Centre, LPLC or ASIC is implied.