Zero trust: a simple rule for every call, text and email

A gerontologist has a one-line fix for the fastest-growing category of scam calls and texts: trust nothing until it is verified. The advice comes from Sam Cradduck of Aging Untold, reported by KCRG-TV, and it borrows a term from cybersecurity called zero trust.

Cradduck's version is plain. A phone call, a text, an email, whatever is read, seen or heard, is not true until it is checked. That single habit, applied consistently, closes the gap that most scams are built to exploit.

Why the gap exists

Ransomware locks people out of their own data or device until a ransom is paid. Spoofed phone numbers and artificial intelligence can now make a caller sound real, familiar, even urgent. None of this works on its own. It works because the person on the receiving end was raised to answer the phone, be polite, and trust someone who sounds official.

Cradduck's point is that the scam is not really targeting the device or the bank account first. It is targeting the habit of politeness and the instinct to comply with urgency. The technology just makes the impersonation more convincing than it used to be.

What zero trust looks like in practice

Cradduck lists the specific moments where the habit needs to kick in: hang up the phone, then verify. Close the email, then verify. Do not open the link, do not listen to the text, do not pay for the toll road notice, do not renew the car warranty. Each of those is a live example already used by scammers, according to Cradduck.

The behavior itself is not complicated. It is the same instruction applied to every channel: phone, text, email. The friction it takes is small, a pause before acting, but the source does not test how many people actually manage that pause under real pressure.

A family safe word

Because AI can now fake a voice convincingly, Cradduck recommends families set up a shared safe word, known to everyone, used to confirm identity when a call or message seems to come from a relative in trouble. The idea is that a machine-generated voice can mimic tone and phrasing but will not know a word that was never said out loud to it.

This is the kind of behavioral pattern worth watching for automatically: a caller creating urgency, a request for money or information before verification, a channel switch mid-conversation. Systems built to flag those signals can catch what a rushed, polite response might miss.

The advice here is a mindset, not a checklist of scams to memorize. It asks people to change a default setting in how they respond to any unexpected contact, which is a harder ask than it sounds, precisely because it goes against everything most people were taught about manners.