Loose change

Eleven files on how spies, con artists, hackers and pickpockets actually work, and the small rules that keep an ordinary person out of their way.

Experts in danger mostly know a short list of instincts to override

Spies, con artists and thieves live off instincts that serve you well most of the time. This book collects those instincts and, for each one, a rule you can decide on in advance.

Every entry is a case, a move, a drill and a grade

The grade is borrowed from the system intelligence services use to rate a report, the NATO grading sometimes called the Admiralty code. Here it rates the evidence behind a claim rather than an informant. A guide about deception that got its own facts wrong would undercut itself, so every entry shows its working.

Four rules run through both books

The first two belong to this book. Tripwires beat vigilance: a rule set at the point where things go wrong does the work that attention cannot do all day. And the check that matters is the one made through a route the other side did not hand you: the number on the back of your card, a family code word, the evidence you held back until the end.

The Watcher

What you notice, what you keep, what you make of other people, and how you check your own conclusions.

EYES

Most people walk through a room and keep nothing. The trade is noticing what changed, and keeping it.

Know what normal looks like before you judge anything

The US Marine Corps' Combat Hunter programme taught patrols to read a street by its baseline first: how busy it usually is, where people usually look.

Spend your time in public relaxed, but awake

Jeff Cooper's colour code names four states of mind: white (switched off), yellow (relaxed but aware), orange (one thing has your attention) and red (acting).

You see what you are looking for, and miss what you are not

Asked to count basketball passes, 56% of viewers missed a person in a gorilla suit walking through the game.

Spot the change

The two rows differ in three places. Learn the top row as a pattern, not as nine shapes.

Half the people looking straight at it never saw it

Missing the obvious is the normal case, not the exception.

When something pulls your eyes hard, look the other way

Eye-tracking of a pickpocket's hand shows a curved movement drags the eyes along the whole arc. A straight one lets them jump ahead.

Once is chance. Three times is a pattern.

Ian Fleming put it in a villain's mouth in 1959: "Once is happenstance. Twice is coincidence. The third time it's enemy action."

Kim's Game: look at the tray for one minute

Do not try to photograph it. Make up a story that links the objects, in order.

A memory is a story, not a photograph

Marine Corps observation training still uses "Kim's games": study a set of objects briefly, then recall them after a distraction.

Put what you need to remember along a route you already know

Fifty-one novices trained in the memory palace for six weeks. Their recall of 72 words rose from about 26 to 62, and the gain held four months later.

To recall more, go back to the scene, then tell it backwards

The cognitive interview, built for police witnesses, produces a large gain in correct detail with only a small rise in errors.

Testing yourself beats looking again

Students who reread a passage did better after five minutes. Students who had tested themselves remembered far more after two days and a week.

Write down what you saw before anyone talks to you

An eyewitness's first, uncontaminated identification made with high confidence is remarkably accurate. Confidence gathered later is not.

Seeing and remembering, in practice

Five habits, each a few seconds long. None needs special talent, and all of them improve with a week of practice.

TELLS

Nobody can read minds. What experts actually do is narrow the gap between liars and truth-tellers until it shows.

Nobody tells a lie from the truth much better than chance

Across 206 research reports and 24,483 judges, people sorted lies from truths correctly 54% of the time. A coin scores 50%.

Your read on a liar is a coin with a slight bias

And the bias leans towards belief: most truths pass, and so do more than half of lies.

There is no reliable tell, and liars do not avoid your eyes

A review of 158 possible cues found that most had weak links to lying or none. Across 32 studies, eye contact had no link at all.

Wait for a cluster, then ask a better question

Former CIA interviewers teach a rule: ignore any single behaviour. Look for two or more, the first within about 5 seconds of the question.

Make the story harder to tell, not the person more nervous

Mock suspects told to recount events in reverse order showed many more cues to lying. Police officers who watched the tapes caught more lies.

Ask for details that could be checked

Across 20 studies, people telling the truth gave more details that could be checked than liars did. Details that could not be checked did not reliably tell them apart.

Hold back what you know until they have told their story

Police trainees taught to hold their evidence back judged 85.4% of mock suspects correctly. Untrained trainees managed 56.1%.

Withholding the evidence beat watching the face

The trained interviewers were not better observers. They asked in a better order.

Read me

You have a great need for other people to like and admire you. You have a tendency to be critical of yourself. You pride yourself as an independent thinker and do not accept others' statements without satisfactory proof. At times you are extroverted, affable, sociable, while at other times you are introverted, wary, reserved.

A reading that fits everyone feels written for you

In a classroom test published in 1949, 39 students each got "their own" personality sketch. All got the same text, and rated its accuracy about 4.3 out of 5.

Keep your face still when you want an honest answer

In 1904 a Berlin horse "read" numbers by tapping. Shown number cards, he was right 98% of the time when the questioner knew the answer, and 8% when nobody did.

Read stress and comfort, not honesty

Joe Navarro, a former FBI agent, teaches people to watch the feet: one turning away "often reveals that there are issues between you and this individual."

Reading people, in practice

None of these needs a talent for reading people. Each one changes the conversation so that the difference between a true story and a false one gets larger.

DOUBT

Argue against your favourite answer before you act on it.

Write down what must be true, and mark what nobody has checked

In the 2002 Washington sniper hunt, the working picture settled early: one white man, military training, a white van. A US analysts' primer uses it as its warning.

Hunt for evidence that separates explanations, not evidence that fits

Richards Heuer's example: a high temperature tells a doctor that a patient is sick, but relatively little about which illness. Evidence that fits every answer decides nothing.

Before you start, assume it has already failed

Gary Klein's premortem: before a project starts, the team assumes it has just failed, then lists plausible reasons for its demise.

Put a number beside every "likely"

In 1951 a US estimate called an attack on Yugoslavia that year a "serious possibility". The board that agreed the phrase had meant odds from 20% to 80%.

One phrase, read as anything from 20% to 80%

Kent's remedy was five words, each tied to a number and a margin.

Grade who told you and what they said, separately

NATO's intelligence grading rates the source from A to F and the information from 1 to 6. A usually reliable source with an improbable report is B5.

Ask where you would push if you wanted to abuse it

In 2019 two security testers hired by Iowa's courts were arrested at a county courthouse after midnight and charged with burglary. The county said the state could not let them in.

Let your gut start a check, never finish one

One of the Moscow Rules that CIA officers worked by was "Never go against your gut". Gut judgements of lies, across 206 research reports, average 54%.

Checking your own thinking, in practice

Each habit makes a private judgement visible, to you first and then to anyone who can check it. That is most of what analysts mean by rigour.

The Handler

How information is drawn out of people, how decisions are steered, and how the long con is built.

RAPPORT

Much of what people give away is not stolen. It is offered, to someone who listened well and asked for very little.

Repeat their last few words, and people keep talking

Chris Voss, a former FBI hostage negotiator, teaches the mirror: repeat the last one to three words the other person said, then stay quiet.

Mirror drill: two minutes, no questions

In pairs. One person talks about their week. The other may only mirror or label.

Three negotiators’ moves, heard from the other side

Robin Dreeke, a former lead instructor at the FBI's Counterintelligence Training Center, puts the artificial time constraint first among his ten rapport techniques: a stranger weighs any approach for threat, and an end in sight lowers it (Dreeke, 2011). Voss and Raz (2016) teach labelling ("It sounds like…") and calibrated questions, open how and what questions that set the other side to work on your problem. Their accusation audit names the other side's worst objections before they can raise them.

A stranger who offers a range wants the exact number

The FBI lists bracketing among 21 elicitation techniques: "Provide a high and low estimate in order to entice a more specific number."

When a stranger gets your work wrong, let them

The same FBI list includes deliberate false statements: "Say something wrong in the hopes that the person will correct your statement with true information."

The friendliest interviewer often learns the most

Hanns Scharff, a Luftwaffe interrogator, drew information from captured Allied pilots with friendly talk, no pressure and an air of already knowing it all.

Friendly questioning got more, and felt like less

No pressure, no direct questions, and an air of already knowing. The last finding is the dangerous one.

Name the reason you are saying yes

The old shorthand for why people spy is MICE: money, ideology, compromise, ego. A 2013 article in the CIA's journal proposed persuasion science instead.

It is rapport only if they would still agree afterwards

The philosopher Sissela Bok proposed a publicity test for deception: would it still look justified if it were explained to a reasonable public?

Rapport, in practice

Five habits for both sides of a conversation. The first three keep you from giving away more than you meant to; the last two keep your own rapport honest.

LEVERS

Persuasion rarely defeats your judgement. It times itself for the moments when you are not using it.

A countdown is a reason to wait, not to hurry

A crawl of 11,286 shopping sites found 1,818 dark patterns, including 393 countdown timers and 632 low-stock warnings.

A small gift is an invoice you did not agree to

Diners offered one chocolate with the bill tipped 19.6%; with none, 19.0%. Offered a second piece as if on impulse, they tipped 23.0%.

A default is a choice someone else made for you

Where organ donation was opt-out, effective consent was near total: 99.98% in Austria. In neighbouring Germany, where it was opt-in, it was 12%.

Write your number down before anyone says theirs

After a rigged wheel stopped at 10 or at 65, people guessed the share of UN members that are African. Their median guesses: 25% and 45%.

Three smaller levers, and a tripwire for each

The decoy: with a print-only option at the same $125 as print plus web, 84% of students chose print plus web; without it, 68% chose web-only at $59 (Ariely, 2008). "Because": 60% let someone jump a copier queue when no reason was given, and 93% with the empty "because I have to make copies" (Langer et al., 1978). Foot in the door: 17% agreed to a large "Drive Carefully" garden sign, against 76% of those who had first agreed to a small one (Freedman and Fraser, 1966).

Decide what you need before you read the reviews

A card saying most guests reuse towels raised reuse from 35.1% to 44.1%. "Guests who stayed in this room" did better still: 49.3%.

When a call makes your heart race, wait 90 seconds

People aged 60 and over reported $7.7 billion in losses to the FBI's internet crime centre in 2025, up 59%. Fake officials and fake tech support took over $2.9 billion.

Practise saying no to the person in charge

In Milgram's first study, 26 of 40 men obeyed an experimenter to the last, 450-volt switch. With two fellow "teachers" refusing, four of 40 did.

Two people saying no cut full obedience from 65% to 10%

Authority is strong. Watching someone else refuse is stronger.

Learn the trick, and it works less well on you

Short videos explaining five manipulation tricks helped people spot them, in six experiments (6,464 people) and in a YouTube field study (22,632).

Scams use the same levers, plus your own greed and distraction

Two lists of seven: one from an analysis of scams, one from persuasion research. Three ideas appear in both.

Influence tripwires, in practice

None of these rules asks you to be suspicious all day. Each one is set once, in calm, and does its work only at the moment the pressure arrives.

CONS

A long con is not one lie. It is a sequence, and each stage is built to make the next feel like your own idea.

Two strangers who agree within a minute are a cast

Police in Savannah, Georgia, warned in 2011 of the pigeon drop: one stranger "finds" cash, a second confirms it is real, and you are asked to add money.

The scam aimed at you will not look like a scam

A Microsoft researcher argued that obviously fake "Nigerian" emails are obvious on purpose: they repel everyone except the people likeliest to pay.

Exclusivity can be a filter for people who would check

Madoff's fund had an air of exclusivity, and he was known to throw out investors who asked too many questions. Statements showed about $64.8 billion.

Any fee to release a larger sum is the whole scam

In 1898 the New York Times reported an old swindle revived: a "Spanish prisoner" with a buried fortune, and a share for whoever paid to help recover it.

An early win is the bait, not the proof

David Maurer's 1940 study of the big con describes "the wire": a fake betting parlour, run by a whole cast, sold to the mark as a sure way to beat the races.

Spot the stage

Six panels from one modern con. Give each a stage name: put-up, play, rope, convincer, touch, blow-off.

Never take investment advice from someone you have never met

Investment fraud topped the losses reported to the FBI's internet crime centre in 2025: $8.6 billion. The UN estimated in 2023 that over 220,000 people were held to run online scams.

Four dollars in ten reported lost went to investment fraud

Losses reported to the FBI in 2025. Most of the investment fraud ran through cryptocurrency.

The police will never collect your money for safekeeping

Courier fraudsters cold-call posing as police or bank staff. In Singapore, at least 384 such cases from June to August 2025 cost victims S$20.2 million.

Nobody who calls about your lost money will get it back

Scammers buy "sucker lists" of people who have already paid scammers, the FTC warns. In 2025, Americans reported $1.4 billion lost to recovery scams.

Ask who chose the options before you choose between them

A magician riffling a deck steered which card people chose 98% of the time. Only 9% noticed any influence.

Say “I nearly fell for this” out loud

Con artists call the last stages the blow-off and the fix. Often no threat is needed: the victim's own embarrassment keeps the crime unreported.

The long con, in practice

Every stage of a con depends on the next one feeling like your own idea. These five rules each break a different stage, and the first breaks all of them.

The Ghost

Blending in, hiding things and passing messages: the oldest crafts of the trade, and what an ordinary person can borrow from them.

COVER

Cover is not a disguise. It is a life too dull to look at twice, lived on a timetable nobody else could write down.

When it matters, be the least interesting thing in the room

The CIA's chief of disguise wrote: "If possible, the cover should be sufficiently dull so that it does not pique undue interest."

Your fitness app may be drawing a map of your days

In January 2018 a 20-year-old student noticed that Strava's public heatmap traced military bases and patrol routes in Syria and Iraq.

The map needed no names to give the bases away

Where few people run, one daily loop is enough to draw a wall.

A fixed routine is the easiest thing in the world to watch

Robert Hanssen's last letter to his handlers promised contact "next year, same time same place". On 18 February 2001 the FBI was waiting at the drop, and arrested him.

A cover story survives because checking it feels rude

On 27 June 2010 the FBI arrested 10 Russian agents who had lived for years as ordinary Americans, among them "Richard and Cynthia Murphy" of Montclair, New Jersey.

A good legend is true wherever it can be checked

The KGB sent Albrecht Dittrich to the US as "Jack Barsky", a boy who had died in 1955 aged 10. With the boy's birth certificate, he lived as an American until the FBI found him in 1994.

Search yourself as a stranger would

Public sources only. Write down what someone could put together about you.

Carry the small proof of who you are, on paper

In April 1943 British intelligence floated a corpse off Spain as "Major William Martin". Theatre-ticket stubs, a tailor's bill and letters from a fiancée made him real.

Cover, in practice

Being ordinary is cheap, and breaking a pattern costs a few minutes. Both are worth more than any disguise.

CACHES

Hide things where searching costs more than it's worth.

A good hide is built against the searcher's map of the house

Nicholas Owen, a Jesuit lay brother, built hiding places for priests in English houses for about 18 years. Some hides were made to be found, to protect a second one.

Have the hides, and the plan, ready before the knock

At Baddesley Clinton in 1591, searchers went through the house for hours, took breakfast, and searched again. The five priests hidden there were not found.

A hidden door works when it looks like furniture that belongs there

In August 1942 Johan Voskuijl built a hinged bookcase to hide the door to the Secret Annex in Amsterdam. By November, eight people were living behind it.

A false wall held six people through a search of the house

When the ten Boom home in Haarlem was raided on 28 February 1944, four Jewish refugees and two resistance workers were behind a false wall in Corrie ten Boom's bedroom. They were not found.

The best container is too ordinary to inspect

In June 1953 a Brooklyn newspaper boy dropped a nickel and it fell apart. Inside was a tiny photograph of 10 columns of five-digit numbers. Nobody could read it for four years.

A desk, a speakeasy and a temple, each built to be searched

Roentgen's pieces "literally unfold to reveal hidden compartments, secret drawers" (Koeppe, 2013). Louis XVI and Marie Antoinette paid 80,000 livres for one, the most the royal household had ever paid for a single piece of furniture.

Find the cache

Six places people keep cash or a passport. Where does a burglar look first, and which place is safe?

Burglars start in the bedroom and know the clever places too

Of 50 experienced burglars, 45 searched homes in a predictable order, and about two in three began in the master bedroom. In a virtual house, burglars stayed about 9 minutes.

Burglars search in the same order, and begin in the bedroom

Experienced burglars describe searching as routine, almost automatic. A routine is predictable.

The Underground Railroad had few secret rooms and no quilt codes

Quilt "maps" became popular only in the late 1990s, and there is no evidence that tunnels were ever purpose-built. Most fugitives rested in kitchens, parlours and spare rooms.

In some places, the hidden compartment is itself the crime

Since 2012 Ohio has made it a felony to build a hidden compartment into a vehicle to hide drugs, or to drive one knowing it is used that way.

The cleverest hiding place is in plain view, looking worthless

In Poe's 1844 story, police take a minister's rooms apart for a stolen letter. It sits in a cheap card rack, turned inside out and re-addressed.

Hiding things, in practice

A burglar has minutes and a mental list. Anything on the list is found; anything that takes time is usually left.

DROPS

A dead drop, a chalk mark and a family code word have one thing in common: both sides agreed them in advance, in calm.

A dead drop means the two sides never have to meet

Robert Hanssen left packages for his Russian handlers under a footbridge in a Virginia park. A strip of white tape on the park sign signalled the drop.

A good signal means one thing and looks like nothing

On 13 October 1993 Aldrich Ames chalked a mark on a mailbox to tell the Russians he would meet them in Bogotá. The FBI was watching. He was arrested on 21 February 1994.

A fake rock in a park, and an admission six years later

In January 2006 Russian television showed a hollow "rock" in a Moscow park that, it said, British diplomats read with pocket computers. In 2012 a former No. 10 chief of staff conceded it.

The oldest trick is hiding that there is a message at all

Herodotus records both Greek stories, and he is the only ancient source for them (Herodotus, 1920). In the second, Gorgo, Leonidas' wife, guessed the message was under the wax.

Five rows, five columns: a code you can tap through a wall

In June 1965 four American prisoners in Hanoi's Hoa Lo prison built a code on a 5 × 5 letter grid: tap the row, pause, tap the column. They signed off "GBU", God bless you.

Tap your name

The dots under each part title spell its codename in this grid: . The matchbox on the title slide of Book Two, Dry Matches, is written in it too.

A one-time pad cannot be broken, if you use it only once

Claude Shannon proved in 1949 that a key as long as the message, truly random and never reused, leaves a codebreaker nothing to work with.

Used once, the pad is perfect. Used twice, it breaks

One wartime shortcut in a Soviet print shop gave American codebreakers 37 years of work.

Decode the nickel

Open the coin on the title slide. This is the key to its microfilm: 94099 91807 91479 78955 27322 14707 99760 74567

To find a leak, give everyone a slightly different copy

Tom Clancy named it the "canary trap" in 1987: each copy of a document is worded a little differently, so a leaked quote shows whose copy it came from.

Numbers on the radio: a one-way channel to anyone, anywhere

A shortwave station opened with bars of an English folk song, then a woman's voice read groups of five numbers. The "Lincolnshire Poacher" was last heard on 2 July 2008.

Agree a code word and a duress phrase before you need them

Ask for Angela, begun in 2016, lets someone in trouble at a bar ask staff for help discreetly. In a BBC test of 25 London venues reported in 2024, staff at more than half did not know it.

A secret channel is only as safe as the person carrying it

In 1586 Mary, Queen of Scots, sent letters out of Chartley hidden in a beer barrel. The courier worked for Walsingham, whose codebreaker read and resealed every letter.

Signals, in practice

Every signal in this file worked because it was agreed in calm and meant one thing. Every failure came from a channel someone else controlled.

The Sentry

The breach and the street: how accounts and pockets are actually emptied, and the few rules that stop most of it.

BREACH

Few breaches need clever code. A found drive, a reused password or a convincing call will do.

Never plug in a drive you did not buy

Researchers dropped 297 USB drives around a university campus. 98% were picked up, files were opened on 45%, and the first was plugged in within six minutes.

Almost every dropped drive was picked up

Nearly half ended up opened on someone's computer. The first went in within six minutes of being dropped.

Give every account its own password

In June 2016 a group took over Mark Zuckerberg's Twitter, LinkedIn and Pinterest accounts. It said his password came from a LinkedIn breach four years earlier.

Do not let a text message be the key to your money

In 2018 the investor Michael Terpin lost about $24 million in cryptocurrency after thieves had his phone number moved to a SIM card they controlled.

Change the password on every device that came with one

The Mirai botnet tried a list of 62 factory usernames and passwords on cameras, routers and video recorders. At its peak it held about 600,000 devices.

Bank details never change by email

From 2013 to 2015 a Lithuanian man posed as an Asian hardware supplier, sent forged invoices, and got two US internet companies to wire over $120 million.

If a caller wants access, hang up and call back

In September 2023 an attack disrupted MGM Resorts' US systems. MGM estimated the cost to its September earnings at about $100 million.

Turn on two-step login everywhere, starting with email

Colonial Pipeline, which carries nearly half the fuel used on the US East Coast, was hit by ransomware in May 2021 through an old VPN account that needed only a password.

A familiar face on a video call proves nothing

In January 2024 an Arup employee in Hong Kong made 15 transfers totalling HK$200 million after a video call with a faked finance chief and colleagues.

The fix for WannaCry was out 59 days before the attack

The machines it crippled were the ones that had not installed it, or were too old to receive it.

Three settings to change on your devices this week

The gift. In 1945 Soviet schoolchildren gave the US ambassador a carved Great Seal. It hung in his Moscow residence until 1952 with a listening device inside that needed no battery: a radio beam from outside switched it on (Crypto Museum, n.d.). A camera or speaker you did not set up yourself deserves a factory reset for the same reason.

The breach, in practice

Each row moves a decision out of the moment of pressure and into a calm moment beforehand. In Singapore, the ScamShield Helpline on 1799 answers at any hour if you are unsure whether a call or message is a scam (ScamShield, n.d.).

STREET

After any sudden contact: hands still, eyes down, walk on.

Keep your phone off the café table

London police call it "table surfing": a thief at a café or restaurant lays a newspaper or map over a phone or wallet on the table, and takes it.

When a stranger spills something on you, keep walking

Rome police arrested a three-man "mustard gang" in January 2014. One threw mustard over a tourist; the others took bags in the confusion. About €70,000 was stolen.

Street pickpockets usually work as a team

Each role has a name in the trade's own slang. You meet the stall. You never see the others.

Check your valuables with your eyes, not your skin

A thief taking a watch may first squeeze the wrist over the strap. The skin keeps feeling the pressure, so it reports a watch that is already gone.

Judge a stranger by the hands, not the clothes

George Barrington, "the prince of pickpockets", posed as a gentleman and as a clergyman. In 1775 he was caught taking a diamond snuffbox from Count Orlov.

Watch the crowd first, the show second

On 10 April 2013 the Louvre stayed shut after more than 100 staff stopped work over organised pickpocket gangs. It had 8.7 million visitors in 2024.

Ask the stranger at the door who they are here to see

UK government security guidance describes tailgaters who pose as colleagues, delivery drivers or maintenance staff, or simply ask for help with a heavy box.

A real police officer never needs to hold your wallet

In June 2026 Dutch police arrested three men who had posed as plainclothes officers near Amsterdam's Sloterdijk station, checked tourists' cash for counterfeit notes, and kept some.

Put your phone away while the train doors are open

In 2015 transit police in Washington, DC warned of phones snatched from riders' hands on trains standing at stations. The thieves ran off the train and out of the station.

The street, in practice

Each habit takes a second and costs nothing. Together they remove the two seconds a team needs.

Eleven rules, one for each file

Each standing order is the shortest form of its file. They are also the lines on the statement posters, so the wall and the book say the same thing.

“Never go against your gut.” Your gut is right about 54% of the time.

Both are true. Treat the gut as an alarm that tells you to check, never as the check itself.

Continue the long way home

Book Two, Dry Matches: fire, water, first aid and machines, and the instincts that fail when it matters.

Every entry in this guide is indexed, with its definition, at https://www.geraldajam.com/library/glossary/field-guides/loose-change.