Three cases from the past two weeks began the same way, in three different states: a screen or a voice that sounded official. A fake Microsoft pop-up opened a Georgia case that Sandy Springs police described on October 22.
A caller posing as Social Security told a Massachusetts resident they had been charged with a crime, according to a Connecticut indictment announced October 21.
Pennsylvania State Police warned on October 14 of callers who send people to hand over gold to "clear their name."
The details differ and the order of events does not. That order is the reason to use a fraud lifecycle.
Why a lifecycle helps
A list of warning signs asks a reader to remember dozens of things. A lifecycle gives each one a place to sit. It treats a scheme as a sequence, with a different observer, a different window to act and a different cost of being wrong at each step.
The Larigent Fraud Lifecycle has six phases: Targeting & Exposure, Contact & Pretext, Trust-Building & Isolation, Extraction, Post-Incident Response, and Re-Fortification, which feeds back into the first. It models scams run by strangers at a distance. A trusted person already inside the household follows a slower path that is handled separately.
Two things follow from the sequence. A signal seen early is worth more than the same signal seen at the transfer. And the person who sees it is rarely the person who can stop the money, so the phase tells you who needs to hear about it.
How to apply one
Start with the observation, not the label. Write down what was seen or heard in plain words, with the date and who saw it: "client said a caller told them they were charged with a crime." Then ask which phase it most naturally belongs to and what usually comes next.
Let the phase choose the response. Early phases call for a conversation. Extraction calls for a pause at the counter or the door. After a loss, speed matters, and afterwards the exposure that made it possible has to be closed or the loop begins again.
Use it to organise what you notice, not to predict a person. One signal rarely settles anything. Someone who stops driving to the bank and starts banking from home can look like someone being isolated, and a health event produces the same pattern a controlling third party does.
Matching real signals to phases
A pop-up that gives a phone number, followed by a caller claiming to be the FDIC, belongs to Contact & Pretext. The caller states what is wrong instead of asking, which is itself a signal (LFL-S05).
"You have been charged with a crime" belongs to Trust-Building & Isolation, where the Fear Override does its work. It is the sentence after which the victim stops weighing and starts doing.
A retirement withdrawal followed by deposits into five accounts, or a first-time gold purchase, belongs to Extraction, and it is the phase where a bank or adviser can see something.
Nearly a dozen visits by a stranger in changing cars, as in Georgia, is a courier or unexpected visitor at the residence (LFL-S14), visible to family and senior living staff long before it is visible to anyone at a bank.
An offer to recover lost money, one of the schemes California's attorney general named on October 20, maps to Re-Fortification feeding Targeting & Exposure. The report does not say who the targets are, so that mapping is our reading, not its finding.
The insight is that one case throws off signals in several phases, seen by different people. In Georgia the victim saw the pop-up, a relative could have seen the visits and a bank could have seen the cash. Nobody held the whole sequence, which is the argument for a shared map.
If this is your family
You do not need to know the script a caller is using. You need a rough sense of where in the sequence you are, because that tells you whether this is something to mention or something to act on today.
Before anything happens. Agree who gets a call if something looks wrong, and that a parent will call you before moving money for anyone who phones. It costs nothing, and it is far easier to agree on while nothing is happening.
When the first contact lands. A computer screen that shows a phone number, or a caller who says something is wrong with an account. Nothing has been lost yet, so this is a moment for a relaxed question: "What did they say, and did they ask you for anything?"
When pressure or secrecy appears. Phrases like "don't tell anyone" or "you will be charged with a crime," or a parent who seems hurried and says it is private. Slow things down. Hang up, and call the bank or agency on a number you look up yourself, never one the caller gave.
When money or a person is about to move. Cash leaving, a first purchase of gold, deposits to several accounts, a stranger arriving at the door. Ask before, not after: "Is someone waiting for this?"
After a loss. Call the bank the same day and write down who said what and when. Speed matters more than being certain, and nobody should be made to feel foolish for calling.
Closing the gaps. Change what made it possible, such as phone numbers, passwords and who is allowed to call. Expect another approach, possibly an offer to "get the money back."
Keep a simple note of what you see, with dates, and no conclusions: a new visitor, a call from an "official," cash leaving an account. If two different kinds of entry turn up in the same fortnight, talk with your parent calmly, and say what you noticed rather than what you suspect.
Sources