Home  ›  Scam files  ›  Pretending to be family

Attack file · Pretending to be family

"Hi Mum, this is my new number."

Your mother is making tea when her phone buzzes. It is her son, she thinks, from a new number, because his phone fell in water. An hour later a bill has been paid to somebody she has never met.

Hi Mum, this is my new number.What arrivesHi Mum, my phone fell in water,this is my new number. Can you paysomething for me today? I will sendyou the details.2She answersthe greeting is theone he really uses3A small favoura bill, due today,nothing huge4The money is goneto an account shehas never seenIt ends here: ring the old numbertheir move
The orange chip is the stranger's message, travelling until something stops it. One phone call to the number she already has ends the whole thing.

What happens

The message comes from a number she has not saved. The greeting sounds right. The story about the broken phone explains why the voice would sound different if she called back, which is the point of the story.

The favour arrives a message or two later. It is always small, and it is always today. Small enough to say yes without stopping, which is exactly how it was designed.

Why it works

  • It is not a stranger she is judging. It is her own child, possibly in trouble. Her heart answers that before her head gets a turn.
  • The details are easy to copy. Names, family words, even old photos are often public. None of it proves anything. All of it feels like proof.
  • Today is the trick. Every version has a deadline, because a deadline is what stops her ringing the number she already has.

The moment it stops

Before she replies. Ring the number she already has for him. Or ask something only he would know, and nothing that is on anybody's Facebook.

Ring the old number. If he really is in trouble, he will pick up, and if nobody does, you have lost a minute.

Simply not true, whatever they say

  • Getting a new phone does not change the conversation you already have with someone.
  • No real emergency is made worse by calling back on a number you trust.
  • Your own child will not be offended by a question only he can answer.

If it already happened

Speed matters more than anything, because money can sometimes be held before it moves onward. The first hour is worth more than the next week.

  • 1
    Call your bank on the number printed on your card

    Never a number given to you. Say the words fraudulent transfer, which is what starts a recall.

  • 2
    Report it the same day

    India: helpline 1930 and cybercrime.gov.in. United States: ic3.gov and reportfraud.ftc.gov. United Kingdom: Action Fraud, or 101. Elsewhere: your national police non emergency line.

  • 3
    Keep everything

    Screenshots, account numbers, phone numbers, transaction references, times. Dull to collect, and the only thing that makes a report actionable.

  • 4
    Tell your family that day

    Shame is what keeps people quiet, and quiet is what lets the same crew come back in three months with a different story.

What KnownSquare changes about this one

The honest answer

What we remove: This whole scam needs one thing: a stranger being able to write to you. That is the thing that does not exist here. There is no number to guess, so the message never arrives, and nobody has to make a hard decision while worried.

What we do not touch: If somebody's phone is stolen while unlocked, messages from their account really are from their account. Only a locked phone stops that. And the same message will still reach an ordinary SMS inbox, which we cannot touch.

On an open networkanybody who has your numbercan write to you, and a strangerlands in the family chatOn KnownSquarea stranger has no address for youso nothing arrives, and there isno hard decision to makeit never arrives
The same attempt, on a network anyone can reach into and on one they cannot.

Sources and further reading

  1. UK Action Fraud, impersonation of family members
  2. Scamwatch, Australia, on Hi Mum scams
  3. US Federal Trade Commission, family emergency scams

Published 19 August 2026. Last reviewed 19 August 2026. Scam scripts change; if you have seen a version that differs from this, write to [email protected] and we will update the file and say that we did.

← All scam files