前两天我发了一篇关于留学生在美国常见骗局的文章。一位读者留言质疑里面"虚拟绑架"那一种——他说"自己绑自己、自己拍照、自己发出去"这种事不可信。
我理解他的质疑。现在的骗局精密到匪夷所思的程度，让人很容易否认。聪明、有职业训练、平时谨慎的人，都会上当。
包括我自己。
这一篇是写给上过当但说不出口的孩子和家长。和我曾经一样。
第一部分被骗走的两笔学费
去年某一天，我收到一所学校发来的学费通知。来自一个我熟悉的学校管理层，他用邮件介绍了学校会计给我，抄送了会计，我们三人在同一邮件链里。
那是一份格式完整的邮件，后续邮件也都从学校会计部的邮箱发来，附了正规发票。金额准确，用途准确。我做了我能做的所有核查：核实了会计的邮箱地址、CC 了学校的另一位管理员，让两个人都在邮件链上。
我转账。会计邮箱回复："已收到。"我把转账截图回复过去。
过了一个月，第二笔学费到期。我重复了同样的流程——同一个会计邮箱、同一种 confirmation、CC 同一位管理层。第二笔款转完，"已收到"也回来了。
大年三十。
我在家里给亲戚朋友发红包、发新年祝福、做饭，家里热热闹闹，手机响了。来自这所学校，说："你的学费一直没有交。"
学校的会计邮箱被黑了。攻击者用她的邮箱给多位家长发了"学费通知"，附上篡改过银行账号的发票，然后用同一个邮箱回复"已收到"。被骗的不止我一个人。
那一刻，"五雷轰顶"四个字一点不夸张。
我事后回想：那个 CC 的学校管理层，最开始几封邮件她是回复了的，后来就不回复了。我当时心想，她可能忙，不好意思去催她。
换句话说：我观察到了异常（anomaly），但我用"她可能忙"把它绕过去了。
这一点后来反复让我想起。
我去报警。警察告诉我："网络诈骗我们管不了，你去网上提交报案材料。"
我提交了。收到了 confirmation 邮件。一年多过去了，至今没有任何后续。警察当时还告诉我：这类网络诈骗，钱追回来的可能性低到等于零。
那之后很长一段时间，我对这个世界有一种强烈的不安全感。让我难过的不只是损失了那笔钱——是我引以为傲的判断力居然这么容易被绕过。一个学过临床心理、做了多年顾问、习惯于"看见别人内心"的人，居然没看见一封邮件背后的劫持。
第二部分今天差一点又上当
今天我又差一点中招。
收到一封看起来是 Citizens Bank 发来的邮件，说他们系统升级了，让我登录查看信用卡账户。我点进去，注册登录，所有信息都准确。然后我看到信用卡支付金额不对，点进去查看详情，但页面一直报错。
紧接着——大约就在我注册完一分钟之后——电话来了。一个声音说："这里是 Citizens Bank 反欺诈部门。刚才检测到你账户有异常活动，你是不是开了一张新信用卡？在上海有几笔消费？"
我直接挂掉。
挂掉之后我反复想这件事，然后我意识到一件让我后背发凉的事：
邮件是真的。 mail@em.citizensbank.com 是 Citizens Bank 真实的 email marketing 子域名，邮件确实是它发的。
网站是真的。 我注册的就是 Citizens Bank 官方网站。
页面报错也是真的。 大型银行网站偶尔有 bug，再正常不过。
但电话是假的。
骗子是怎么知道我刚注册完、网站刚报错、要在这一刻打来这通电话的？我至今没搞清楚。最可能的几种解释：我的电话号码早已在某次 data breach 里流出，骗子手上有一份"Citizens Bank 客户"的电话列表，每天自动拨几千通；或者更精准的版本，某个第三方 tracker 把我的浏览行为 real-time 卖给了骗子；或者我的设备上某个 app 被入侵了。
真相是哪一种我不知道。但这件事教会了我一件比之前任何防骗经验都重要的事：
即使邮件是真的，网站是真的，
紧接着打来的电话也可能是假的。
这一次我抓住的几个关键点：
- 银行从来不会用 unsolicited 电话主动问你消费细节。任何这样开场的电话——挂掉。
- 任何来电号称是"银行反欺诈部门"——挂掉后，自己用银行卡背面的官方电话回拨过去。这是唯一可靠的验证方式。
- 时机巧合反而是 red flag。骗子最擅长踩着你刚完成某个真实动作的瞬间打来，让你的大脑自动把"上一个真实动作"和"这一个假电话"绑成一件事。
- 电话里直接质问 + 制造紧迫感 + 让你立刻提供个人信息——典型的 emotional flooding，前额叶下线的标志。
- 即使前面所有环境都是真的，下一步仍然可能是假的。骗子不一定要伪造整条链路——他们只需要在你已经放下警惕的瞬间，加进一个假的环节。
去年那笔学费的代价，换来了今天我把电话挂掉的反应速度。
第三部分我说出来之后，才看见骗局的真正规模
去年那次被骗之后，我做了和大多数人不同的事——我到处说。
对我的学生说。对我的家人说。对我朋友圈里所有可能听见的人说。
我不怕别人觉得我愚蠢。我只想多提醒到一个人，就少一个人上当。
说出来之后，我才发现身边那么多人都经历过类似的事——只是大多数人不敢说。我的一位家人后来告诉我，他也收到过几乎一模一样的假发票邮件，只是他比我机敏，转账前打电话核实了对方账号，骗局当场穿帮。
上一篇我整理了 10 种最常见的诈骗。这一篇，我想再加 10 种——专门发生在留学生身上、上一篇没有覆盖的。
留学生买二手家具、自行车、手机最爱用 Facebook Marketplace 和 Craigslist。骗子也最爱在这里下钩。常见套路：你看上一件东西，价格特别好。"卖家"说自己在外州、正在搬家、不方便当面交易，要求先用 Zelle / Venmo / Cash App 转 deposit "锁定"商品。钱转过去之后人就消失，商品要么不存在，要么早卖给了别人。
价格明显低于市场价、卖家不愿当面交易、要求线上预付、催你"快点决定否则卖给别人"——任意一条都该停下来。
留学生第一次买车特别容易踩。Craigslist 或 Facebook 上"私人卖家"价格比 KBB 估价低 30% 以上，卖家说自己在外州或即将搬家，要求先付 deposit 锁定。钱进去就消失，车不存在。
另一种：车存在，但 title 有问题——车是抵押未结清的、被偷过的、洪水泡过的。私人卖家不告诉你，你买回家后才发现保险办不了、过户出问题。
买任何二手车之前，必须查 VIN 报告（CarFax 或 AutoCheck）。不能线下看车的私人卖家，直接跳过。
你在 Marketplace 卖东西，"买家"用 cashier's check 多付款，说"对不起多付了，请把多的部分用 Zelle 退给我"。你以为 cashier's check 有银行担保，就把多的钱退了过去。几天后银行通知你支票是假的，原款被收回——你既丢了商品，又欠银行那笔钱。
重要：任何"多付款 + 请退给我"的剧本都是骗局。cashier's check 不是 100% 安全的，银行最终追回 chargeback 时所有损失都算在你头上。
骗子先给你 Zelle / Venmo 转一笔小钱（$50–500），说"对不起转错人了，请退回去"。你以为帮一下好心人就退了。但他的原始转账用的是被盗账户的钱——真正账户的主人会向银行投诉，银行从你账户里把那笔钱追回。你不仅亏了退给骗子的钱，可能还被卷入欺诈调查。
陌生人转账给你后让你退回去，不要直接退。先联系 Zelle / Venmo 客服或银行说明情况。
这是 2024–2025 急速崛起的一类骗局，技术门槛低到任何人都能做。骗子只需要你父母或子女在社交媒体上 3 秒钟的声音录音，就能用 AI 克隆出完全一样的声音，然后给国内父母打电话："妈，我出事了，被警察抓了，急需用钱保释。"声音、语气、口头禅都对得上。
根据 FBI 2025 年度报告，AI 语音诈骗在 2025 年第一季度录得同比 1,600% 的爆发式增长。
升级版本是视频通话：骗子用 deepfake 技术做出和你子女一模一样的视频画面，表情、嘴型同步。香港 2024 年一家公司在一次"全员视频会议"里被骗 2,560万 美元——会议里除了被骗的那一位真人，其他"人"全是 deepfake。
在孩子出国前，和他约定一个只有你们两个人知道的词——孩子小时候的小名、家里养的猫的名字、第一次全家旅游的城市、孩子出生那年家里发生的某件事。任何外人不可能查到的细节。约定规则：以后任何"紧急情况"打来的电话——绑架、急病、出车祸、需要急汇钱——一律先问这个暗号。问不出来的，无论声音多像、视频多真，都是假的。不要在微信、邮件、社交平台上用过这个词。声音不再可信。眼睛看到的视频也不再可信。在这个时代，只有暗号可信。
你信任的朋友或家人的社交账号被黑，攻击者用他们的身份给你发"急用钱"。典型说辞："我手机坏了，临时借我 $500 周一还"、"我在国外，钱包丢了，能不能帮我转一下"、"在外地办急事，先帮我付一下，明天还你"。你以为是真朋友，直接转账。
任何熟人通过文字消息借钱，无论金额多小，一律打电话或视频确认是本人。骗子最不希望你做的事，就是打电话验证。
骗子假冒知名公司（Google、Microsoft、Meta、Tesla 等）的 hiring manager，通过 LinkedIn 或 Indeed 联系留学生，说有 remote position，时薪 $50–100。"被录取"后，HR 要求先付：equipment deposit、background check fee、training fee、software license。每一笔几百到几千美元，付完之后人消失，或者继续找新理由要钱。
FBI 2024 数据：就业骗局损失从 2020 年的 $9,000 万升至 2024 年的 $5.01 亿。OPT 期间急着找 sponsor 公司的留学生是重灾区。
任何要求"先付费"才能上岗的工作 offer，都不是真的工作。
和杀猪盘（第 5 种）不同。杀猪盘是 3–6 个月的长线培养感情后引诱"一起投资"。这一类是几周到一两个月的短线：聊得很热络，对方突然说"父亲住院"、"被困在国外回不来"、"信用卡被盗刷"、"急需用钱保命"、"等下就还你"。钱转过去，人消失。
留学生特别脆弱：到美国头几个月孤独，一个温柔的"网友"可能是这一阶段唯一愿意听他说话的人。研究显示三分之二的国际学生在到美国的头几个月经历严重孤独感——骗子吃准了这一点。
网上认识不满三个月的人，突然"急用钱"——不管关系多好，都不要转账。
专门盯玩 Steam / Roblox / Fortnite / Genshin Impact 等游戏的高中生和大学生。"代充值打折"——你给骗子 $80，他承诺帮你充 $100 到游戏账户。充进去后账户被冻结，需要继续转钱"解冻"，金额越来越大。
任何游戏内"代充值打折"，一律是骗局。所有正规游戏都有官方充值通道，价格透明，便宜的代充不存在。
浏览某个网站时突然弹窗，警告"你的电脑中毒了，请立即拨打 Microsoft / Apple 技术支持电话"。号码看起来正式，弹窗也做得像系统警告。你打过去，对方让你下载 remote control 软件"修电脑"。一旦下载，骗子获得你电脑的控制权，可以盗取所有数据，或者锁定电脑要赎金。
Microsoft / Apple / Google 永远不会用弹窗警告你电脑中毒，也永远不会给你电话号码让你打过去。任何弹窗里的电话号码都是骗局。
以上 10 种，加上上一篇的 10 种，覆盖了我这些年看到的、听到的、自己经历过的、学生告诉我的约 80% 的真实案例。
第四部分临床心理学角度：聪明人为什么也会上当
学过临床心理咨询之后我才明白：上当不是因为人不聪明，是骗子精准利用了大脑里几个固有的 bug。
邮件标识是"学校会计"、"银行"、"中国公安"。大脑对权威源头的信息默认高信任。这是几万年进化出来的快速判断机制，正常情况下让我们高效，被骗时让我们脆弱。
骗子用 80% 的真实信息（你的真实姓名、真实地址、真实信用卡余额、真实学费金额、真实学校会计邮箱）包住 20% 的假信息（假账号、假发票）。大脑会自动用"真实的部分"为"虚假的部分"背书。
"必须立刻处理"、"今天截止"、"否则会有后果"。紧迫感让大脑的前额叶皮质（prefrontal cortex，理性判断中枢）下线，让杏仁核（amygdala，情绪反应中枢）接管。这种状态下，一个 40 岁的人的判断力可以瞬间回到 14 岁。
骗局的一个核心动作，是把你孤立。"不要告诉别人"、"这是机密"、"现在不能挂电话"，目的都是阻止你和第三方核实。如果你能跟一个清醒的人核对一下，骗局立刻穿帮。
你信任学校，学校信任会计，骗子伪装成会计。你信任银行，银行有 marketing 子域名，骗子踩着你和真实银行互动的瞬间插进来。骗子不需要骗你信他，他只需要骗你信你已经信的人。
当这 5 个 bug 同时被精准利用，没有人是真的免疫的。
第五部分那次之后我建立的几个具体协议
那笔学费没追回来。但它让我建了几个一直用到今天的协议：
- 任何 unsolicited（自己没主动找的）邮件，3 天不操作。邮件里的链接一律不点——要登录账户，关掉邮件，从浏览器自己输入官网地址。
- 任何转账前，必须电话或当面 verify（核实）。不是回复邮件 verify，是用我从其他独立渠道查到的电话号码打过去 verify。
- CC 多人的邮件链里，必须每个人都回复了我才放心。如果有人中途停止回复，我会主动追问。anomaly 不能用"她可能忙"绕过去。
- 任何来电要我提供信息或转账的，挂断后我主动打回去——用官方网站上查到的号码，不是来电显示的号码。
- 重大金额的事项，必须和家人讨论一次。孤立决策是骗子最爱的状态。哪怕家人说"听起来没问题"，这次确认本身就让大脑从情绪状态切回理性状态。
- 不在网络上和陌生人讨论钱。任何号称"投资机会"、"内部信息"、"高回报"、"急需用钱"的，无论包装多漂亮，一律拒绝。
第六部分写给上过当不敢说的孩子
第七部分写给会指责孩子"你怎么这么傻"的家长
尾声
写这篇文章的时候我犹豫了好几次。
公开承认"我被骗了两笔学费"，对一个职业上靠"专业判断"立身的人来说，不是没有代价的。读者可能会想："她连自己都看不清楚，凭什么帮我看清楚我家孩子？"
但我做了这个决定。
因为那段时间扛着"我居然会上当"的羞耻，我太懂那种感觉了。如果我作为一个受训过的临床咨询师都需要好几个月才走出来，那些没受过专业训练的孩子和家长又怎么走得出来？
如果有一个孩子因为读到这篇文章，鼓起勇气告诉父母他也上过当，这篇文章就值。
骗局真正的伤害不是损失的那笔钱，
是它在你心里留下的那道"我居然这么傻"的疤。
那道疤的解药，是原谅自己。
愿每个孩子，都被温柔以待，也被认真保护。
对孩子在美国的安全或适应有担忧？欢迎直接与 Apple 预约咨询。
预约免费咨询数据来源与参考文献
本文数据均来自官方机构与权威报告，截至 2026 年 5 月。
- FBI IC3 2024 年度报告（年度互联网犯罪损失 166 亿美元，就业骗局损失从 2020 年 $9,000 万升至 2024 年 $5.01 亿）：ic3.gov
- FBI IC3 2025 年度报告（年度网络犯罪损失近 210 亿美元，全美网络诈骗投诉总数突破 100 万件）：ic3.gov
- FBI 专题：Cryptocurrency and AI Scams Bilk Americans of Billions（含 2025 年 Q1 AI 语音诈骗同比增长 1,600% 数据）：fbi.gov
- FBI Operation Level-Up（FBI 主动介入杀猪盘等加密货币投资诈骗公开数据）：fbi.gov
- FTC 2025 租房骗局深度报告（$6,500 万报告损失，18–29 岁群体占 46%）：ftc.gov
- 香港警方 2024 年商业罪案调查科关于 Deepfake 视讯会议诈骗案公开通报（跨国公司被骗约 2 亿港元，约合 2,560 万美元）。
- 《Journal of International Students》及《Frontiers in Psychology》关于国际学生入美早期孤独感与心理适应的学术研究。
如何报案与求助
- FBI 网络犯罪举报中心（中文也可填）：ic3.gov
- 美国联邦贸易委员会消费者投诉：reportfraud.ftc.gov
- 中国驻美国大使馆领事保护：+1-202-495-2216
- 中国外交部全球领事保护 24 小时热线：+86-10-12308
- 如果是学生：第一时间联系学校的国际学生办公室（International Student Office）
A few days ago I published a piece on scams targeting Chinese international students in the US. A reader commented, questioning the virtual kidnapping entry — saying a scenario where someone "kidnaps themselves, photographs themselves, and sends those photos out" sounded implausible.
I understand the doubt. Scams today are engineered to a level of sophistication that makes them easy to dismiss as impossible. Smart, professionally trained, cautious people fall for them. Including me.
This piece is written for students and parents who were deceived and can't bring themselves to say so. Like I once was.
Part OneThe Two Tuition Payments I Lost
One day last year, I received a tuition notification from a school. It came from someone at the school I knew well — a manager who introduced me by email to the school's accountant, CC'ing the accountant and putting all three of us on the same email thread.
It was a properly formatted email. The subsequent emails all came from the school's accounting department address, with official invoices attached. The amounts were correct. The stated purpose was correct. I did everything I knew to do to verify: I confirmed the accountant's email address, CC'd another school administrator, and kept two people on the thread.
I transferred the payment. The accountant's email replied: "Received." I sent my transfer screenshot back.
A month later, the second tuition payment was due. I repeated the same process — same accountant email, same confirmation pattern, same CC'd administrator. The second transfer went through. "Received" came back.
Lunar New Year's Eve.
I was at home sending red envelopes to family and friends, exchanging new year messages, cooking — the house was warm and full of noise — when my phone rang. It was the school. "Your tuition hasn't been paid."
The school accountant's email had been hacked. The attacker used her address to send "tuition notices" to multiple families, attaching invoices with the bank account number quietly changed, then replying "Received" from the same inbox. I was not the only one who had been taken.
The phrase "struck by lightning five times" is not an exaggeration for what I felt in that moment.
Looking back afterward, I noticed: the CC'd school administrator had replied to the first few emails, then went quiet. At the time, I'd thought — she's probably busy, I didn't want to push her.
In other words: I noticed an anomaly — and I explained it away with "she's probably busy."
That realization has stayed with me since.
I went to the police. They told me: "Internet fraud isn't something we can handle — submit a report online." I submitted it. Got a confirmation email. Over a year has passed. There has been no follow-up. The officer also told me: for this category of internet fraud, the probability of recovering the money is effectively zero.
For a long time after, I had a deep sense of insecurity about the world. What troubled me wasn't only the financial loss — it was that the judgment I'd always trusted in myself could be so easily bypassed. Someone with clinical psychology training, years of experience reading people, and a professional habit of "seeing through to the interior" — who couldn't see through one hijacked email.
Part TwoI Almost Got Taken Again — Today
Today I nearly fell for it again.
I received an email that appeared to be from Citizens Bank, saying their system had been upgraded and asking me to log in and check my credit card account. I clicked through, registered and logged in — all the information was accurate. Then I noticed the credit card payment amount looked wrong, clicked into the detail view, and the page kept returning an error.
Then — roughly one minute after I finished registering — my phone rang. A voice said: "This is the Citizens Bank fraud prevention department. We've just detected unusual activity on your account. Did you open a new credit card? There are several charges showing up in Shanghai."
I hung up immediately.
Afterward I kept thinking about it, and then I realized something that made my blood run cold:
The email was real. mail@em.citizensbank.com is a genuine Citizens Bank email marketing subdomain. The email actually came from them.
The website was real. I had registered on Citizens Bank's actual official website.
The page error was real too. Large bank websites have bugs sometimes — that's completely normal.
But the phone call was fake.
How did the scammer know I had just finished registering, that the page had just errored, and to call at precisely that moment? I still don't fully understand it. The most likely explanations: my phone number had already been exposed in a past data breach, the scammer had a list of Citizens Bank customers and was dialing thousands automatically each day; or a more precise version, some third-party tracker sold my real-time browsing behavior to the scammer; or something on my device had been compromised.
I don't know which it was. But this incident taught me something more important than any prior fraud lesson:
Even when the email is real and the website is real,
the call that follows immediately after can still be fake.
What I managed to catch:
- Banks never call you unsolicited to ask about your transaction details. Any call that opens that way — hang up.
- Any caller claiming to be your bank's "fraud prevention department" — hang up, then call back using the official number on the back of your card. That's the only reliable verification method.
- Suspiciously precise timing is itself a red flag. Scammers are expert at calling exactly when you've just completed a real action, so your brain automatically links the real thing and the fake call into a single event.
- Immediate confrontation + urgency + a push to provide personal information right now — this is textbook emotional flooding, the signature of prefrontal shutdown.
- Even when all the surrounding context is real, the next step can still be fake. Scammers don't have to fabricate the entire chain — they only need to insert one false link at the moment you've already let your guard down.
The cost of last year's tuition paid for the reflex that made me hang up today.
Part ThreeWhen I Started Talking About It, I Saw the Real Scale
After being scammed last year, I did something different from most people — I told everyone. I told my students. I told my family. I told every person who might have been listening in my social circle.
I wasn't afraid of people thinking I was foolish. I wanted to prevent one more person from falling for it.
Once I started talking, I discovered how many people around me had experienced something similar — and had been too embarrassed to say so. A family member later told me he'd received an almost identical fake invoice email, but had been sharp enough to call and verify the bank account number before transferring — the scam fell apart on the spot.
My previous article covered 10 common scam types. Here are 10 more — ones that specifically target international students and weren't covered there.
International students frequently use Facebook Marketplace and Craigslist to buy secondhand furniture, bikes, and phones. Scammers love these platforms. Standard playbook: you find something at a great price. The "seller" says they're in another state, moving, and can't meet in person — they ask you to send a deposit via Zelle, Venmo, or Cash App to "lock in" the item. Once the money transfers, they vanish. The item either never existed or was already sold.
Price significantly below market, seller unwilling to meet in person, online-only prepayment required, pressure to "decide now or I'll sell to someone else" — any one of these should make you stop.
First-time car buyers among international students are especially vulnerable. A "private seller" on Craigslist or Facebook lists a car at 30%+ below KBB value, claims to be in another state or moving, and asks for a deposit to hold it. The deposit disappears, and so does the seller — no car exists.
Second type: the car does exist, but has a problematic title — undisclosed lien, stolen vehicle history, or flood damage. The private seller doesn't mention it. You discover the problem when you try to get insurance or transfer the title.
Run a VIN report (CarFax or AutoCheck) on any used car before buying. Any private seller who won't meet in person — move on.
You're selling something on Marketplace. A "buyer" pays you with a cashier's check — deliberately overpaying — and says "sorry, I overpaid, could you send the extra back via Zelle?" You think a cashier's check is bank-guaranteed, so you refund the difference. Days later, your bank tells you the check was fraudulent. The original amount is reversed. You've lost the item, lost the refund you sent, and potentially owe the bank.
Important: Any "I overpaid — please refund the extra" scenario is a scam. Cashier's checks are not 100% safe. When the bank claws back the chargeback, all the loss lands on you.
A scammer sends you a small amount via Zelle or Venmo ($50–500) and says "sorry, I sent this to the wrong person — could you send it back?" You think you're being a good person and send it back. But the original transfer came from a stolen account. When the real account holder reports it, the bank reverses the payment out of your account. You're out both the money you returned and potentially pulled into a fraud investigation.
If a stranger sends you money and immediately asks for a refund, don't send it directly back. Contact Zelle, Venmo, or your bank first to explain the situation.
This is one of the fastest-growing scam categories in 2024–2025, with a technical barrier low enough that almost anyone can execute it. A scammer needs just 3 seconds of your parents' or child's voice from social media to clone it with AI — then calls the family overseas: "Mom, I'm in trouble, the police arrested me, I need bail money urgently." The voice, tone, and speech habits all match.
According to the FBI's 2025 annual report, AI voice scam reports grew 1,600% year-over-year in Q1 2025.
The upgraded version uses video calls: deepfake technology creates a real-time visual of your child, expressions and lip movements synchronized. In Hong Kong in 2024, a company was defrauded of $25.6 million USD during a "full team video meeting" in which every participant except the victim was a deepfake.
Before your child leaves for the US, agree on a word that only the two of you know. Something no outsider could ever look up — a childhood nickname, your cat's name, the city of your first family trip, something that happened the year they were born. Rule: for any "emergency" call claiming kidnapping, illness, car accident, or urgent money needs, always ask for the code word first. If they can't answer it — no matter how real the voice sounds or how convincing the video looks — it's fake. Never use this word in WeChat, email, or on social platforms. In this era, voices are no longer reliable. Videos are no longer reliable. Only the code word is.
A trusted friend or family member's social account gets hacked. The attacker messages you posing as them with an urgent money request: "My phone broke, can you lend me $500, I'll pay you back Monday," "I'm stuck abroad and lost my wallet," "I'm out of town handling an emergency, can you pay this first?" You trust the contact and transfer.
Any known contact asking for money via text message — no matter how small the amount — call them or do a video call to confirm it's really them. The one thing scammers most want to prevent is a phone verification.
Scammers pose as hiring managers from well-known companies (Google, Microsoft, Meta, Tesla) contacting students on LinkedIn or Indeed with remote positions paying $50–100/hour. After being "hired," HR requires upfront payment for equipment deposits, background check fees, training fees, or software licenses — each running from hundreds to thousands of dollars. Once paid, the contact disappears, or invents new reasons to demand more money.
FBI 2024 data: employment scam losses grew from $90 million in 2020 to $501 million in 2024. International students on OPT who urgently need a sponsor company are a primary target group.
Any job offer that requires you to pay anything before starting work is not a real job.
Different from pig butchering (scam #5 in the previous article), which involves 3–6 months of relationship building before introducing a fake investment. This version runs in weeks to a couple of months: you've been chatting warmly, and suddenly the person says their parent is in the hospital, they're stranded abroad, their credit card was stolen, they need money urgently and will pay you back right away. Money transfers, person disappears.
International students are particularly vulnerable: the loneliness of the first few months abroad means that one warm online contact may be the only person who seems genuinely willing to listen. Research finds that two-thirds of international students experience significant loneliness during their first months in the US — scammers know this.
Someone you met online less than three months ago, suddenly in an "emergency" needing money — regardless of how close you feel, don't transfer.
Targeting high school and college students who play Steam, Roblox, Fortnite, Genshin Impact, and similar games. "Discounted top-up" offers: you send the scammer $80, they promise to load $100 into your game account. After the load, the account gets "frozen" and requires more money to "unfreeze." The amounts keep escalating.
Any "discounted proxy top-up" for any game — it's a scam. All legitimate games have official top-up channels at transparent prices. Discounted third-party loading doesn't exist.
While browsing a website, a pop-up appears warning you that "your computer has been infected — call Microsoft/Apple tech support immediately" and provides a phone number. The pop-up is designed to look like an official system alert. When you call, the person instructs you to download remote control software so they can "fix your computer." Once downloaded, the scammer gains control of your machine and can steal all your data or lock the device for ransom.
Microsoft, Apple, and Google never use pop-ups to warn you that your computer is infected, and never provide a phone number for you to call. Any phone number appearing in a pop-up is part of a scam.
These 10 types, combined with the 10 from the previous article, cover roughly 80% of the real cases I've seen, heard, experienced personally, and had students report to me over the years.
Part FourClinical Psychology: Why Smart People Still Fall for It
My clinical psychology training helped me understand: getting scammed isn't a matter of intelligence. Scammers exploit several fixed bugs in how the human brain operates.
The email comes from "the school accountant," "the bank," "the Chinese police." The brain defaults to high trust for authority sources. This is a fast-judgment mechanism evolved over tens of thousands of years — it makes us efficient in normal circumstances, and vulnerable when deceived.
Scammers wrap 80% real information (your actual name, actual address, actual credit card balance, actual tuition amount, actual accounting email) around 20% false information (fake bank account, fake invoice). The brain automatically uses the true elements to vouch for the false ones.
"You must handle this immediately," "deadline is today," "there will be consequences if you don't." Urgency takes the prefrontal cortex (the rational judgment center) offline and hands control to the amygdala (the emotional response center). In that state, a 40-year-old's decision-making can revert to age 14 in seconds.
A core move in every scam is isolation. "Don't tell anyone," "this is confidential," "don't hang up the phone" — all designed to prevent you from checking with a third party. If you can verify with one clear-headed person, most scams collapse immediately.
You trust the school; the school trusts the accountant; the scammer impersonates the accountant. You trust the bank; the bank has a marketing subdomain; the scammer inserts themselves at the exact moment you're genuinely interacting with the real bank. Scammers don't need you to trust them — they only need to exploit the trust you already have in someone else.
When all five of these bugs are exploited simultaneously and precisely — nobody is truly immune.
Part FiveThe Concrete Protocols I've Built Since Then
The tuition money was never recovered. But it led me to build several protocols I use every day:
- Any unsolicited email (one I didn't go looking for): three-day no-action rule. Never click links in the email — if I need to log into an account, I close the email and type the official URL directly into my browser.
- Before any transfer: verify by phone or in person. Not by replying to the email — by calling a number I've looked up from an independent source.
- In any multi-person CC'd email thread: I don't feel settled until everyone has replied. If someone goes quiet mid-thread, I follow up. I no longer explain away anomalies with "she's probably busy."
- Any incoming call asking me to provide information or transfer money: I hang up and call back — using a number from the official website, not the incoming call's display number.
- Any significant financial decision: I discuss it with a family member first. Isolated decision-making is the state scammers prefer. Even if the family member says "sounds fine" — the act of that conversation alone pulls the brain from emotional state back to rational state.
- I don't discuss money with strangers online. Any "investment opportunity," "insider information," "high returns," or "urgent need for money" — regardless of how it's packaged — I decline.
Part SixFor Students Who Were Scammed and Can't Say So
Part SevenFor Parents Who Might Say "How Could You Be So Stupid"
Closing
I hesitated several times while writing this.
Publicly admitting "I lost two tuition payments to a scam" comes with a cost for someone whose professional identity is built on sound judgment. Readers might think: "She couldn't see through her own situation — how can she help me see through mine?"
But I made this decision anyway.
Because I lived through that period of carrying "I can't believe I fell for this" — and I know exactly what that feels like. If someone with clinical training needed several months to work through it, how are children and parents without that background supposed to find their way out?
If one child reads this article and finds the courage to tell their parents what happened to them — this article was worth writing.
The real harm in a scam isn't the money that was lost.
It's the scar it leaves in you — the one that says "I can't believe I was that foolish."
The cure for that scar is forgiving yourself.
May every child be held with gentleness — and protected with care.
Concerned about your child's wellbeing or safety while studying in the US? Book a free consultation with Apple.
Book a Free ConsultationData Sources & References
All data in this article comes from official agencies and authoritative reports, as of May 2026.
- FBI IC3 2024 Annual Report (internet crime losses $16.6B; employment scam losses from $90M in 2020 to $501M in 2024): ic3.gov
- FBI IC3 2025 Annual Report (internet crime losses near $20.9B; over 1 million complaints): ic3.gov
- FBI Special Report: Cryptocurrency and AI Scams Bilk Americans of Billions (includes 1,600% Q1 2025 AI voice scam growth): fbi.gov
- FBI Operation Level-Up (cryptocurrency investment fraud intervention data): fbi.gov
- FTC 2025 Rental Scam Report ($65M reported losses; 18–29 age group = 46% of victims): ftc.gov
- Hong Kong Police Commercial Crime Bureau 2024 Deepfake Video Conference Fraud (company defrauded ~HK$200M, ~USD$25.6M).
- Journal of International Students and Frontiers in Psychology: academic literature on international student loneliness and early adjustment in the US.
How to Report & Get Help
- FBI Internet Crime Complaint Center (available in English and Chinese): ic3.gov
- FTC Consumer Fraud Report: reportfraud.ftc.gov
- Chinese Embassy Consular Protection (Washington DC): +1-202-495-2216
- China MFA Global 24-Hour Consular Hotline: +86-10-12308
- For students: contact your school's International Student Office as soon as possible