“We need to verify your account”: how to spot fraud without losing your cool