The internet parents are posting into today is not the internet they started posting into. Something’s shifted under everyone’s feet and most haven’t even noticed there’s a question to ask. Nobody handed them the memo that the ground has moved. The actual question underneath it is harder: how do you celebrate a kid without handing tomorrow’s version of them a problem you are creating today? Most parents haven’t sat with that question yet. They don’t know they should be sitting with it. They’re still operating on “cute photo or not.”.

The internet parents are posting into today is not the internet they started posting into. Something’s shifted under everyone’s feet and most haven’t even noticed there’s a question to ask. Nobody handed them the memo that the ground has moved. The actual question underneath it is harder: how do you celebrate a kid without handing tomorrow’s version of them a problem you are creating today? Most parents haven’t sat with that question yet. They don’t know they should be sitting with it. They’re still operating on “cute photo or not.”

The internet got hungrier.

If you’ve never heard the word “sharenting” before, here’s what it means. It’s the name for something you’ve probably watched happen constantly, or done yourself without a second thought. It’s a blend of “sharing” and “parenting.” It showed up around 2012 to describe parents posting photos, videos, or stories about their kids online. Most people doing it regularly have never heard the term. That makes sense. Nobody sat anyone down and said, “This thing you do constantly has a name, and researchers study it.”

It’s easy for someone online to throw the word around like it’s a diagnosis. Like admitting to it means admitting to doing something wrong. I don’t think that’s fair. When digital photo albums first showed up, they felt exactly like the sticky-page albums grandparents kept on the coffee table. Just easier to send across the world.

So no, I don’t think parents got reckless. I think the technology got more invasive underneath them. Data scraping. Facial recognition. AI tools that can build a profile out of nothing but a few years of birthday posts. A photo isn’t just a photo anymore. It’s data. What feels like a sweet update reads, to something built to harvest it, as raw material. Barclays forecast that by 2030, “sharenting” could be behind close to two-thirds of identity fraud hitting young people.

If that phrase doesn’t mean much yet, here’s the plain version. Identity theft isn’t someone breaking into an account that already exists. It’s someone collecting enough real details — full name, birthdate, hometown, mother’s maiden name — to convincingly become that person on paper. With those pieces, someone can open a credit card in a child’s name. Take out a loan. Pass a security check meant to confirm they’re really them. It usually doesn’t surface for years. A kid’s identity sits unused and unchecked until they’re old enough to apply for their first credit card or apartment. That’s exactly when they find out someone’s already been using their name.

That’s what the Barclays forecast is actually about. Not some vague future risk — the birthdays, hometowns, and mother’s maiden names sitting in years of posts, becoming the exact toolkit someone needs. Pulled together patiently, one caption at a time.

None of this is a case for paranoia. It’s a case for noticing that the ground has moved.

Here’s what nobody quite spells out

“Be careful what you post” gets repeated so often it’s stopped meaning anything. So let’s actually sit with why. Most people aren’t connecting these dots automatically. Two things are happening at once, and they’re different problems.

The identification problem, explained plainly. Once a company can reliably match a photo of a face to a name, it can find that same face anywhere else it turns up online — in someone else’s photo, on a different platform, in a context the original poster never imagined. A birthday photo posted for grandma stops being a private moment between family and becomes a searchable entry point into a person’s whole identity. That’s what “identification” means here: not that a stranger saw one photo, but that one tagged photo can now unlock everything else connected to that face.

Here’s how it already happened, not hypothetically. A company called Clearview AI scraped billions of photos off public social media — Facebook, Instagram, wherever a face happened to show up. It used them to build a facial-recognition tool, then sold access to that tool to police departments and businesses. Nobody whose face was in there knew it was happening. The UK’s data regulator, the ICO, fined the company £7.5 million in 2022. Clearview challenged the fine, and the case has moved through UK tribunals since; a 2025 ruling restored the ICO’s authority to pursue it, though a lower tribunal is still finalizing the fine itself as of this writing. France, Italy, and Greece have each fined Clearview roughly €20 million outright — and, notably, none of those regulators have actually collected a cent. Australia investigated the company too. This isn’t a hypothetical. It already happened, to real people’s photos, quietly.

And that’s really the point Clearview proves: it’s not a one-off villain, it’s a demonstration of what’s possible. Clearview only became visible because journalists and regulators eventually caught up to it. For every company regulators catch, there’s no way to know how many others are running the same quiet collection and simply haven’t gotten caught yet — smaller data brokers, apps with vague terms of service, tools nobody’s heard of that exist specifically to scrape and resell what’s public. None of them need permission to start. They just need a public photo and time.

That’s what makes this different from a one-time risk. A stranger downloading a single photo creates a bad moment. An unknown company patiently building a profile on a child for years, unnoticed, creates something else entirely — because that profile doesn’t do anything today. It just sits there, complete and waiting, until the day that child is old enough to open a bank account or sign a lease. Nobody sends a warning when someone finally uses it. The years of quiet collection and the moment of misuse can sit a decade apart, which is exactly why it doesn’t feel urgent now. The absence of visible harm today doesn’t prove nobody’s collecting anything — it’s often exactly what unauthorized collection looks like while it’s happening.

The permanence problem, explained plainly. Normally, if you regret posting something, you delete it and it’s gone. Training data doesn’t work that way. Once a company has trained an AI model on a photo, deleting the original post doesn’t undo what the model already learned from it. The lesson the model absorbed — this is what a face looks like, this is how it ages, this is the pattern of a name attached to a place — stays baked into the system whether or not the photo is still online. You can take back the post. You can’t take back what it taught.

In 2024, Meta changed its policy to let its AI train on public Facebook and Instagram posts and photos. It made the opt-out process complicated enough that most people never got around to it, and even where opt-outs exist, they’ve mostly covered EU and UK users under stronger local privacy law — US users have much weaker footing to object at all. Even the people who did opt out found the request only covered what happens going forward. Whatever the model had already used, stayed used.

A photo someone posts is a moment. It has a beginning and an end. You can delete it if you regret it. The training data that photo becomes isn’t a moment anymore. It’s a permanent ingredient in something else — something a company built for a purpose nobody agreed to, and can’t undo. A kid’s birthday photo, posted for grandma, doesn’t just sit there. It can become one small piece of a system that learns to recognize faces, target ads, or predict behavior — a system a company built without ever having a conversation with that child, using a face they didn’t get a vote on.

Most people are used to thinking about who can see a post. Almost nobody’s used to thinking about what that post can turn into, simply because nobody framed it as the real question

Things people say to wave this off

1.“They already have everything anyway.”

This is understandable. There’s some truth buried in it. Data brokers already hold huge amounts on all of us. A single new photo probably isn’t the difference between private and not private in some absolute sense. So why bother?

Here’s where that logic quietly breaks. “They have some of your data” and “they have your face, matched to your name, matched to your child’s face, matched to a decade of locations and routines” are not the same category of exposed. Most of what’s already out there is scattered. Fragments. Probabilities. Patterns. A clear, tagged photo of a specific child’s face is not a fragment. It’s a key. It turns everything else scattered about them into something matchable, searchable, identifiable in a crowd. A stranger could theoretically piece together a kid’s school, routine, and face from scraps across the internet, if they tried hard enough. A tagged, named, dated photo now can do that work for them quite conveniently. Every post doesn’t just add to a pile. It makes the pile easier to search.

There’s also a version of this argument that quietly gives up on a child’s choice. “There’s nothing to hide anyway” assumes the decision has already been made for them. Even if total privacy isn’t on the table anymore for anyone, the amount of searchable, identifiable material tied to a specific child, by the time they’re old enough to have an opinion about it, is still something being actively chosen. One photo at a time.

2.“There’s nothing worth stealing.”

The instinct behind it is understandable. Most people grew up thinking of “valuable” as money in an account, or an expensive thing someone could physically take. Data doesn’t feel like that. It doesn’t feel like property in the same way. Losing control of it doesn’t register as a loss. However, a child’s data doesn’t need to be worth anything to their parent for it to be worth something to somebody else.

A name, a birthdate, a school, a face — none of that pays for itself directly. But it’s the raw material for things that do make money. Data brokers buy and sell exactly this kind of information in bulk. Not because any single kid’s birthday is valuable, but because a complete, accurate profile of a real person is.

Remember the identification and permanence problems from earlier. Identity theft isn’t about stealing money directly out of an account. It’s about stealing enough real information about a person to convincingly become them. The Barclays forecast isn’t warning about someone hacking a bank. It’s warning about someone using a kid’s own birthday, hometown, and mother’s maiden name — collected patiently over years of posts — to impersonate them later. The theft isn’t of data. The data is just the tool. What gets stolen at the end is money, credit, or reputation, using pieces that child never knew had been handed over.

So “there’s nothing valuable to steal” isn’t really the right question. The better one is this: does this information make it easier for someone to become this child, or to profit off knowing everything about them, without that child ever getting a say?

Not every post is a catastrophe. There’s room to be wrong about exactly where the real risk sits. “it’s already out there” or “it’s not worth anything” have always felt like reasons to stop trying, not actual arguments that trying doesn’t matter.

The gift kids aren’t being given

There is a different way to look at the situation, not as a restriction but as something parents are actually capable of giving.

Think back to anyone’s own late teens. There was room to mess up. To change your whole personality twice. To walk into adulthood mostly unwritten. That blank slate was a privilege, even if nobody called it that at the time.

Kids today are inheriting a version of themselves they didn’t write. A 2017 study, referenced by the American Academy of Pediatrics, found that teens judge their parents’ posts about them far more harshly than they judge posts from friends.

Long before they apply for a job or open a bank account, there’s already a searchable record of their tantrums, their milestones, sometimes their medical stuff. Put there with love, without a second thought. Pulling back on what gets posted isn’t hiding a kid. It’s leaving them room to tell their own story later, in their own words.

Nobody has to disappear. There’s a middle ground.

None of this means going dark. Privacy isn’t all-or-nothing. Plenty of families are finding a version that works:

1. Post the vibe, not the face. Hands, muddy boots, the back of a small head at the park.

2. Cover the face with an emoji if the moment should be public but the biometrics shouldn’t.

3. Move the real archive somewhere closed, a private group chat, a family-only app and save the public feed for the parts anyone would be fine with someone finding in ten years.

Before hitting share — three seconds

Next time a thumb’s hovering over the share button, ask yourself three question with no judgment attached.

1. Is there operational information in this — a school uniform, a house number, a full birthdate?

2. Would this be okay on a billboard outside your own office?

3. Is this being shared for the kid, or for the parent?

This is the first generation figuring it out in real time. There’s room to be wrong about exactly where the line should sit. There’s no clean answer here, but the shift is simple, even if the questions aren’t: share the moment, not the identity.

References

• Security.org, Parents’ Social Media Habits: 2021 — security.org/digital-safety/parenting-social-media-report

• Barclays / Techmonitor, Sharenting to Reach £676 Million by 2030 (2018) — techmonitor.ai

• Blum-Ross, A., & Livingstone, S. (2017). “Sharenting,” parent blogging, and the boundaries of the digital self. Popular Communication, referenced via American Academy of Pediatrics — aap.org

• TIME, Why Regulators Can’t Stop an AI Company That Scraped Billions of Photos — time.com

• The Conversation, Australia’s privacy regulator just dropped its case against Clearview AI — theconversation.com

• MIT Technology Review, How to opt out of Meta’s AI training (2024) — technologyreview.com

Most people hear "cyberbullying" and picture teenage drama. Someone posts a mean comment, everyone moves on, it sorts itself out. That's not what it is. It's calculated. It's varied. It’s willful, repeated harm. Not a one-off insult and it's evolved into something a lot bigger than a mean comment.

Here's what it actually looks like:

Harassment: a relentless stream of hostile or threatening messages. What makes it bullying instead of a fight is that it doesn't stop.

Outing: someone shares your private information without your consent. Your sexuality. Your mental health history. Something you told them in confidence, now weaponized.

Exclusion: deliberately cutting someone out of group chats or online communities. It sounds small. For a teenager, it's social exile.

Impersonation: a fake account using your name and your photos, posting things you never said, so you get blamed for them.

Cyberstalking: tracking someone's location tags, check-ins, and activity across platforms to intimidate them.

Sextortion and image-based abuse: sharing, threatening to share, or morphing intimate images of someone without their consent to blackmail or humiliate them.

Coordinated pile-on: someone screenshots you out of context, rallies a crowd, and hides behind it while you get buried under hundreds of strangers who think they're doing justice.

When the internet started, cyberbullying was a mean email or a harsh message on MSN. You closed the laptop and it was gone. Then social media gave it a permanent audience, a bad post from 2018 can still be the first thing that comes up when someone Googles your name today. Now we're in the AI phase. Perpetrators can morph someone's photos, clone their voice, build an entire fake digital footprint of things they never said or did. The tools have gotten sophisticated.

Why Ordinary People Do This

Here's the part that surprises most people. Majority of cyberbullying isn't done by career criminals or pathological monsters. It's done by classmates, coworkers, ex-partners - regular people.

So why do ordinary people do something so mean online when they wouldn’t do it in person?

The answer is in a concept called moral disengagement, and psychologist Albert Bandura mapped it out decades ago. It describes how a person can switch off their own conscience without even realizing they're doing it. They don't feel like they're doing something wrong. They've quietly convinced themselves they aren't.

There are five switches that flip to make this possible.

Moral justification: This is the reframe. “I mocked someone” becomes “I was calling out bad behavior.” “They deserved it.” “It’s just honesty.” This happens before the bullying, not after. The person’s conscience is still active, so they need the justification first. Once they have it, dressed up as fair or necessary or even righteous, they move forward.

Dehumanization: When you see a face, hear a voice, watch someone’s reaction in pain, your brain automatically triggers empathy. That’s the natural brake on cruelty. Dehumanization removes that brake. Online, that brake disappears. A username isn’t a person. A profile picture isn’t a face. The person on the other end becomes an idea instead of a human, and ideas are a lot easier to hurt than people.

Diffusion of responsibility: When a lot of people are piling on at once on a target, each person’s sense of personal responsibility shrinks. The math in their head goes something like: “I’m one of sixty people. I only said one thing. The blame is spread across all of us.” The bigger the crowd, the lighter each person feels. Nobody’s fully responsible, so nobody stops.

Displacement of responsibility: This is different from diffusion, it's not spreading the blame, it's handing it off. "My friends started it." "I was just going along." The person tells themselves they had no real choice. They're a participant, not someone who chose this.

Disregard of consequences: The perpetrator sends the message and closes the app. They never see the person at 3 am, unable to sleep. The harm only exists in the victim's world, and because they can't see it, some part of their brain decides it isn't real. “If it was really that bad, I would have seen evidence of it.” This allows them to maintain the belief that they didn’t actually cause harm, even though they did and the harm is real.

Put those five together and the cycle closes.

Justification gets it moving. Dehumanization removes empathy. Displacement and diffusion strip away responsibility. Disregard makes it all invisible. By the end, the person hasn't lost a fight with their conscience, they've rewritten what their conscience is willing to accept.

How You Actually Break the Cycle

If moral disengagement is a system, set of switches, that means they can be flipped back. There's real research on exactly how.

Dismantle moral justification by questioning the reasoning, not attacking the person. When someone says “they’re annoying so I can mock them,” the counter isn’t anger, it’s a question: would you accept that logic if it were used on you? Research on moral reasoning shows that when people are forced to apply their own excuse to themselves, the inconsistency destabilizes the excuse. You can’t hold “mocking is fine when someone annoys me” and “I’d hate to be mocked” at the same time.

Dismantle dehumanization by making the person impossible to forget. This is why victim impact statements work in courtrooms. It’s why anti-bullying programs that show real testimonials, an actual face, an actual voice, saying “this is what it did to me” work better than ones that just list rules. If you’re a bystander, simply asking a perpetrator “do you know how that person actually felt?” is more disruptive than it sounds.

Dismantle diffusion of responsibility by naming individuals. In Latané and Darley’s classic 1968 research on bystander behavior, the single most effective way to break up mob behavior was one person stepping out and naming what was happening, specifically, by name. “The group did it” collapses the moment someone says “you did this.” Suddenly everyone in the crowd has to decide, individually, whether they’re actually in.

Dismantle displacement by naming complicity. Research on complicity is clear on this: joining in makes you responsible too, even if you didn’t start it. “My friends started it, I just went along” is the classic move. The counter is direct: you chose to participate, and that’s on you.

Dismantle disregard of consequences by making the harm concrete. There are two ways to do this, and they work differently.

Understanding consequences: Showing someone the real impact - the tears, the sleepless nights - the abstract harm becomes concrete. This creates genuine guilt, shame about the action and desire to repair.

Experiencing consequences: Legal or formal consequences - a police complaint, a school record - make the harm undeniable. A bully who faces an FIR, a court appearance, or a documented complaint can no longer tell themselves nothing happened. The consequence is suddenly real in their world, not just the victim’s.

Fear of consequences can stop the behavior but it doesn’t resolve the disengagement underneath.

You need both. Fear stops the behavior. Understanding stops the disengagement.

Shame Vs. Guilt

Shame says “you are a bad person.” When someone feels shame, their brain goes into defense mode. They double down on justifications, blame the victim harder, find reasons they’re actually the victim. Shame triggers moral disengagement deeper, not reversal of it. This is why public callouts and humiliation-based consequences often backfire, the person becomes more entrenched into the behavior you’re trying to stop.

Guilt is different. It’s shame about the action, not the self. Guilt says “what you did was wrong, and I know you as someone better than this.” That’s a completely different feeling. It creates a cognitive dissonance - the action doesn’t match who they think they are - and that dissonance is destabilizes moral disengagement. This triggers desire to repair, to correct course, to be who they think they are again.

Psychologist June Price Tangney’s research on moral emotions backs this up clearly: shame leads to defensiveness, denial, and further interpersonal hostility, whereas guilt leads to real change. “You’re a monster” gets you nothing. “This isn’t who you are. You’re capable of better. So why did you do this?” triggers guilt and the possibility of actual change. It’s also why a private conversation with someone they respect often works better than public pile-on. Public consequences create shame. Private accountability creates guilt.

That last point connects to something Karl Aquino's research on moral identity found: when people are reminded of their own values, of who they actually believe themselves to be, disengaged behavior drops fast. "Is this who you actually are?" destabilizes someone far more than "this is wrong" because most people already know it's wrong. What they haven't asked themselves is whether it fits who they think they are.

None of this works as a one-time conversation. Moral disengagement doesn't reverse in a single talk. It takes repetition, ongoing reminders of identity, ongoing exposure to the humanity of the person on the other end, ongoing accountability. This is why schools and platforms need to build this in as a system, not a lecture they give once.

That's how you help someone stop. But if you're the one being targeted right now, dismantling their psychology isn't your job. Protecting yourself is.

What You Actually Do If This Is Happening to You

Document everything, first. Before you block. Before you report. Before you even respond. Screenshots of messages, profiles, timestamps, usernames, the URL if it's public. Once a perpetrator knows they've been reported, they often delete everything. Get the evidence before they do.

Do not engage. This is harder than it sounds. Every response feeds the cycle, it tells them their behavior is working. Silence isn't weakness here. It's a strategic choice that starves the whole mechanism.

Report it, and document that too. Every major social media platform has mechanisms to report harassment, fake profiles, and non-consensual intimate images. Use them. Note the date, what you reported, and any reference number they give you. In India, you can file complaints directly through the national cybercrime portal at cybercrime.gov.in, women and children have the option to do it anonymously. Your documented screenshots serve as the foundational evidence required to initiate action.

Loop in someone you trust. Isolation is exactly what sustained harassment is designed to produce. It wants you alone. Counter that by showing someone the full picture, not "someone's being mean," but the actual pattern, so they understand the real scale of what's happening.

Cyberbullying is not a personality conflict. It's not drama that sorts itself out. It's a psychological attack, built on features of our digital world, sustained by mechanisms that let perpetrators feel fine while the person on the other end falls apart.

If you know someone this is happening to: take it seriously. Being online doesn't make it less real.

If it's happening to you: document, don't engage, report, and reach out. The law exists for exactly this. Use it.

Reference materials:

• Read Bandura’s foundational 1996 study on the mechanisms of moral disengagement

• About Latané and Darley’s classic 1968 research on group size and the diffusion of responsibility

• Research on moral emotions by June Price Tangney

• Karl Aquino’s research on the self-importance of moral identity

It isn't some complicated technical break-in that only happens to people who "don't know better." It's actually the opposite of technical. It's psychological.

So Why Do Smart People Actually Fall For It?

There's a real myth that phishing only catches people who are careless or not tech-savvy. The data says otherwise. Doctors, tech executives, finance controllers, highly trained, highly intelligent people fall for this constantly. Why? Because phishing was never designed to beat your IQ. It's designed to beat your biology.

Psychologist Daniel Kahneman, who won a Nobel Prize for his work on human judgment, spent decades showing that your brain runs on two different modes:

• System 1: fast, automatic, intuitive. It runs on autopilot, scanning for familiar patterns so you can decide in a split second without burning energy.

• System 2: slow, deliberate, analytical. It's the part that actually double-checks a URL, questions a request, catches the thing that feels "off." It takes real effort to switch on.

When you're calm and unhurried, System 2 is right there, ready to spot a lookalike link. The problem is, scammers have gotten very good at making sure you never get to use it.

They do that by pulling three specific levers.

1. The urgency lever (amygdala hijack): "Your account will be frozen in 30 minutes." "Your card is about to be blocked." Your brain reads that as a threat, and a threat triggers what's called an amygdala hijack - a real physical stress response, cortisol and adrenaline flooding your system. When that happens, System 2 goes quiet. Your brain isn't being lazy, it's prioritizing speed over accuracy, because that's what a threat response is built to do. You're not choosing to skip the check. Your biology is skipping it for you.

2. The familiarity lever (cognitive ease): We're wired to trust what feels familiar, and scammers know it. That's why they research their targets - the right formatting, the right tone, the right internal jargon, mentioning your actual boss or a project you're actually working on. When something requires zero effort to process because it already "looks right," System 1 waves it through without ever calling in System 2 to check. The scam isn't fighting your judgment. It's making sure your judgment never gets involved.

3. The authority lever (conditioned obedience): This one hits hardest at work. If an email looks like it's from your CEO, a senior vendor, or a tax official, most people's instinct is to respond fast and respect the hierarchy - not to question whether the sender is really who they say they are. The desire to be efficient and professional overrides the instinct to verify.

Stack those three together - urgency, familiarity, authority, and you've got a message that never gives your analytical brain a chance to show up. That's the actual answer to "why smart people fall for it." It was never about intelligence. It's about which system got to make the decision.

It's Not a Hack. It's a Trap Dressed Up as Something Official

The word "phishing" comes from the same place as fishing. You cast a hook, bait it with something convincing, and wait for someone to bite. Except instead of fish, attackers are after your data - your full name, your date of birth, your Aadhaar or PAN number, your net-banking login, your card details. Enough pieces, and they can walk straight into your bank account or if you work for a company, straight into its network.

We used to say "just check for bad grammar and you'll spot the fake." Not anymore. Attackers are using AI to write these messages now. The grammar is flawless. The formatting is perfect. The urgency feels real, because it's engineered to feel real.

It's also not just email anymore. There's smishing - phishing through text messages. There's vishing - phishing through phone calls, usually someone claiming to be your bank. There's quishing - phishing through QR codes that quietly send your money out instead of bringing money in. The attack surface is everywhere your phone touches. Different channel, same three levers.

When a Global Cricket Body Lost ₹20 Crore to One Email

If you think this only happens to careless individuals, look at the International Cricket Council (ICC) - the body that governs cricket worldwide and drives a massive part of the sport's ecosystem in India.

In 2022, the ICC lost close to $2.5 million (roughly ₹20 crore) to what's been widely reported as a business email compromise, or BEC, attack. In a BEC scam, criminals don't hack their way in through code. They study an organization's email patterns, then send a message that looks like it's coming from someone trusted, a vendor, an executive, a finance contact and convince an employee to authorize a payment or wire transfer. Notice which levers that pulls: familiarity, because the message mirrors something the employee already trusts, and authority, because it appears to come from someone whose request you don't stop to question. The ICC reported the incident to law enforcement in the US, and the exact mechanics of how the fraudsters got in were never fully made public. But the outcome was blunt: real money, sent by real people who believed they were dealing with a real, trusted party, gone.

This is the high-stakes version of spear phishing, not a wide net thrown at millions of random people. A targeted, researched message aimed at one person or one role, built to look exactly like something they'd already trust.

The Everyday Version: Real Scams Hitting Indian Phones Right Now

You don't have to run a global cricket body to be a target. This same playbook runs at massive scale on ordinary phones across India, every single day.

Smishing - the fake delivery text.

Over the past couple of years, India Post has had to repeatedly warn people, through the government's own fact-checking body, that a viral text message is fake. It reads something like: "Your package couldn't be delivered due to incomplete address information. Update your details within 12-48 hours or it will be returned." There's a link. The link leads to a cloned website that looks almost identical to the real one. Some versions ask for a small "redelivery fee" of ₹25 to ₹100 and quietly harvest your card details the moment you enter them. Others plant something worse on your device the moment you tap the link. India Post has said, plainly and repeatedly: they never send messages like this. If you get one, that's your answer already.

Vishing - the call that already knows your card number.

This is the one that catches people off guard, because the caller sounds like they know you. They'll state your actual card details back to you, or reference a real recent transaction, to win your trust fast. Then comes the pressure: your card is about to be blocked, unless you "verify" by reading out an OTP right now. The moment you do, the money's not being verified, it's being moved. No real bank will ever call you and ask you to read out an OTP. That single fact is the whole scam, once you know it.

Quishing - the QR code that takes instead of gives.

This one is especially sharp because it plays on a mistaken assumption. In India's UPI-driven world, a QR code shows up claiming to be a "cashback," a "refund," or a "lottery win." People scan it expecting money to land in their account. But a QR code is built to send money, not receive it. The second you scan it and enter your UPI PIN, you've authorized an outgoing payment, straight to the scammer. There is no such thing as "scan this QR code to receive money." If a code implies otherwise, that's the tell.

Why None of This Is About Being Careless

Look at the pattern across all three. The ICC case. The fake delivery text. The "your card will be blocked" call. None of them hacked anything. Each one just pulled the same three levers - urgency, familiarity, authority, and let biology do the rest.

That's the real skill scammers have built: manufacturing a feeling, not writing better code.

Your Practical Checklist - Use This Every Time

1. Pause on urgency: Any message demanding instant action, "24 hours or your account is suspended," "12 hours or your package is returned" is a signal to stop, not to comply. Real organizations, banks included, don't threaten instant account closure over a text message.

2. Check the actual domain, not the logo: Scammers can copy a logo, a font, an entire page design in minutes. What they can't do is legally own a company's real domain. If a message claims to be from your bank or India Post but the link doesn't match their official domain exactly, that's your answer. Look at the URL bar, not the pretty design around it.

3. Go direct, every time: Never act through the link or number inside an unsolicited message. If you're worried about a delivery or an account, close the message, open a fresh browser tab, and type in the official website yourself. Or open the company's app directly. You're bypassing their fake doorway entirely, and this one habit alone blocks most of these attacks.

4. Hang up, then call back yourself: If someone calls claiming to be your bank, a government office, or any company asking you to "verify" details or read an OTP, hang up. Find the real number from your bank statement, your card, or the official app, and call that number yourself. You're the one initiating the verification now, not them.

5. Report it: India has a dedicated portal for this: cybercrime.gov.in, and a national helpline at 1930. Reporting a scam doesn't just protect you, it helps shut the operation down before it reaches someone else who might not pause in time.

The goal here is to build one habit: trust after you've checked, not trust by default. That's it. That's the whole shift. You're smart enough to spot the patterns. You just have to remember to actually look.

Reference materials:

ICC ₹20 crore business email compromise (2022)

• ESPNcricinfo report as covered by The Daily Star: https://www.thedailystar.net/sports/cricket/news/icc-loses-25m-phishing-scam-3226706

• The Federal: https://thefederal.com/sports/icc-lost-close-to-2-5-million-in-phishing-scam-in-2022-report

• Business Standard (via TBS News, same wire pickup): https://www.tbsnews.net/sports/icc-falls-prey-online-scam-loses-close-25-million-usd-571586

India Post smishing scam

• Press Information Bureau (PIB) Fact Check, via Business Standard: https://www.business-standard.com/finance/personal-finance/that-india-post-parcel-message-on-your-phone-it-s-a-scam-says-pib-125101300283_1.html

• PIB Fact Check follow-up, via Business Standard: https://www.business-standard.com/finance/personal-finance/another-delivery-scam-surfaces-pib-flags-fake-india-post-sms-125102000484_1.html

• Business Standard (case detail, ₹23.26 lakh Hyderabad victim): https://www.business-standard.com/india-news/new-india-post-scam-targets-citizens-what-is-it-and-how-to-be-safe-124091700490_1.html

Daniel Kahneman - System 1 / System 2

• APA Monitor on Psychology, official summary of Kahneman's work: https://www.apa.org/monitor/2012/02/conclusions

• The Decision Lab (academic reference guide): https://thedecisionlab.com/reference-guide/philosophy/system-1-and-system-2-thinking

A note on the rest: "amygdala hijack" and "cognitive ease" are established psychological terms (the former coined by Daniel Goleman, the latter from Kahneman's own book)