Mom Forwarded Me a Screenshot: What to Actually Say Back

Mom Forwarded Me a Screenshot: What to Actually Say Back

It's 9:14pm on a Tuesday. Your phone buzzes. No message, just an image — a blurry screenshot of a text, half the frame cut off, a phone number at the top you don't recognize. Three minutes later: "is this real???"

You know exactly what's happening here. You are, once again, the family's unpaid fraud desk. And whatever you say back in the next ten minutes decides two things: whether this specific message gets handled correctly, and whether the next one gets forwarded to you at all, or just quietly acted on because asking felt embarrassing last time.

That second part matters more than people think. Get this response wrong — too dismissive, too alarmed, too "how did you fall for this" — and you don't just lose this round. You lose the habit of being asked first.

Why "that's obviously fake" is the wrong first move

I get it — you glanced at it for two seconds and the tell jumped out at you immediately. The domain's misspelled, or the "bank" is one you don't even have, or the whole thing reeks of urgency. Saying so feels efficient.

It also skips the actual question, which isn't "is this fake" — it's "how do I know that, and how would I know next time without you." Answer with a verdict and you've solved today's problem. Answer with the specific tell and you've taught them to spot the next nine on their own.

There's also a real chance your two-second read is wrong. Scam screenshots are blurry, cropped, missing the sender info that would settle it either way. "Obviously fake" said with total confidence, followed by "actually, wait, that's a real overdraft notice" is exactly the kind of whiplash that makes someone stop asking.

Step 1: check the artifact before you react to the person

Before you say anything, actually check the thing in the screenshot instead of judging it on vibes. Two ways to do it, depending on what got forwarded:

If it's a screenshot of a text or email — a message with a link, a phone number, a "click here to verify" — the fastest path is running the whole screenshot through Cautellus's scanner. It pulls every URL, phone number, and email address straight out of the image with OCR, then checks each one against 10,000+ confirmed scam entities pulled from Reddit's scam-tracking communities, FBI IC3, FTC alerts, and global phishing databases, refreshed every six hours — plus a typosquat check against major brand domains, so "arnazon-support.com" gets flagged even if nobody in the family would've caught it by eye. First scan's free, no card required, once every 30 days.

If it's a screenshot of a document — a check, a bank statement, a driver's license someone sent to "prove" who they are, a rental listing that looks a little too good — that's a different kind of fake, and Cautellus's scam image checker is built for exactly that: font-rendering tells, watermark absence, layout that doesn't match the real template, signs of AI-generated staging. A real photo can still be part of a scam if the numbers on it are fabricated, which is the whole reason this needs a different check than a text does.

Either way, you're not eyeballing a blurry image and guessing. You're checking the actual thing.

Step 2: answer with the specific tell, not a verdict

Once you know what it is, say the specific reason, not just the conclusion. Compare these two replies:

"Yeah that's a scam, delete it."

"That link goes to a domain that's been reported as fake — see how it's 'chase-secure-verify.top' instead of chase.com? Real banks don't send links like that, they tell you to log into the app directly."

The first one closes the conversation. The second one gives them something to use unsupervised next time — a pattern to recognize, not just your say-so to trust. This is the actual difference between "I checked it for you" and "I taught you to check it," and only one of those scales past this one text message.

If the scan came back clean, say that too, with the honest caveat: no flags against the record so far doesn't mean the sender is who they claim to be, just that nothing about the link or number has been reported yet. "Looks clean, but if they're asking you to send money, call the actual company yourself before you do anything" is a complete, honest answer — not a hedge.

Step 3: set up the callback rule so this doesn't need you every time

The screenshot-and-wait pattern works, but it doesn't scale, and it puts you in the loop for something that should be a 30-second solo check. The fix isn't a lecture. It's one rule, agreed on once:

Before sending money or personal information to anyone who contacted you first — hang up, close the text, and call the organization back using a number you already have, not one from the message. That's it. That single habit defeats almost every impersonation scam regardless of how convincing the message looks, because it removes the scammer's only advantage: controlling which number you call next.

Pair it with a family safe word for anything claiming to be an actual relative in an emergency — I wrote up the full 30-second setup for that here, and it's the single most effective thing I've seen against the AI-voice-clone version of this ("it's me, I'm in trouble, don't tell Dad"), which shows up constantly in grandparent-scam calls and is only getting more convincing.

If it turns out to be real

Sometimes the screenshot is legitimate — an actual overdraft notice, a real delivery delay, a real Venmo request from a friend. If the scan comes back clean and the context checks out, the job's done. Say so plainly; that reassurance is worth as much as catching the fake ones.

If it turns out the other way — they already clicked, already sent money, already gave up a code or a card number before asking you — skip the postmortem and move straight to containment. Call the bank's fraud line directly, not a number from the message. If money already moved, minutes matter more than getting the full story first. FBI's IC3 and the FTC's fraud report line are both worth filing with regardless of dollar amount — it's the follow-up questions and case-building that need the paper trail, not just your own peace of mind.

Adults 60 and older lost $4.9 billion to fraud in 2024 according to the FBI's IC3 Elder Fraud Report — a number that's almost certainly an undercount, since embarrassment keeps a lot of it unreported in the first place. None of that is a reflection on anyone's judgment. It's a reflection on how much better the messages have gotten. My full elder fraud protection guide and complete guide to the scams targeting seniors go deeper on the specific patterns most likely to target an aging parent, if you want the fuller picture beyond this one screenshot.

FAQ

My parent keeps forwarding me screenshots with no context. How do I get them to include more info? Ask once, gently, for the sender's number or email address along with the image — that's usually the piece a scan needs and a screenshot crops out. Frame it as "this helps me check it faster," not "you're doing it wrong."

Is it rude to just tell them to use the scanner themselves? Not if you frame it as giving them the tool, not offloading the work. "Next time, you can run it yourself in about 30 seconds at cautellus.com — I'll still double check anything that worries you" keeps you in the loop without keeping you as the only checkpoint.

What if I'm not sure and the scan comes back clean? Clean means no matches against the current record — not a guarantee the sender is legitimate. If money, a password, or a code is involved, the callback rule still applies: verify through a number you already have before anyone acts on it.

Should I just tell them "never click links in texts"? It's simpler advice, but it's also advice nobody actually follows 100% of the time, including you. A callback habit and a 30-second check hold up better than a blanket rule that gets abandoned the first time a message looks urgent enough.

What if the screenshot is of a scam that already happened — money's already gone? Contact the bank or payment app's fraud line immediately; for wires and instant transfers, the window to reverse anything is measured in hours. File with the FTC and FBI IC3 regardless of whether you expect the money back — the report itself feeds the pattern-matching that flags the next version of this scam faster.

The goal was never to be the permanent fraud desk for your family. It's to make yourself unnecessary — one specific tell, one callback habit, and one tool they'll actually use before you at 9pm on a Tuesday.

---

Sources: FBI Internet Crime Complaint Center (IC3) 2024 Annual Report · FTC Report Fraud