A few years ago, I was sitting with a woman in her seventies who had just received a call from someone claiming to be from "Microsoft's cloud infrastructure division." They told her her device had been "flagged for a critical SSL certificate failure" and that her "endpoint was compromised."

She didn't hang up. She handed them remote access to her computer.

When I asked her why, she said something I've never forgotten: "I didn't understand a word they said, but they sounded like they knew what they were talking about. I figured I should listen."

That's not a failure of intelligence. That's a failure of language. And it's not an accident.

I want to be careful here. I'm not saying every tech company sat in a boardroom and decided to confuse people on purpose. Most jargon starts as shorthand between engineers. It's faster to say "endpoint" than "the specific device connecting to a network." It's easier to say "SSL certificate" than "the thing that verifies a website is who it claims to be."

But here's what happens over time: the shorthand becomes the standard. The industry stops translating. And the gap between people who understand the language and people who don't gets wider every year.

That gap has consequences. Real ones.

When you don't understand the words, you can't evaluate the claim. You can't tell the difference between a legitimate warning and a fabricated one. You can't push back. You can't ask the right questions. You're left with two options: trust completely, or disengage entirely.

Both of those outcomes benefit the wrong people.

Once you start to see it, you can't unsee it.

The words are technical enough to sound authoritative. They're vague enough that you can't easily verify them. And they almost always come attached to urgency: act now, call immediately, don't close this window.

That combination of authority, vagueness, and urgency is the formula. The jargon is the authority part. It signals expertise. It signals that the person using it knows something you don't. And when you feel like you don't know something, the instinct is to defer.

The people behind these calls know this. They study it. They practice it.

Everything in the decoder below comes back to this.

If someone uses technical language to create urgency — especially in an unsolicited call, email, or pop-up — slow down. Ask them to explain what they mean in plain language. A legitimate technician will do this without hesitation. Someone running a scheme will double down on the jargon, escalate the urgency, or get frustrated.

That reaction tells you everything. Keep it in mind as you read what follows.

"Your device has been compromised." This means someone is claiming your computer, phone, or tablet has been accessed or damaged by an outside party. It may or may not be true. What matters is this: legitimate companies don't call you unsolicited to tell you this. If you see it in a pop-up, close the browser. If someone says it on the phone, hang up.

Ask: I didn't contact you. How did you get my number? I'm going to hang up and call the company back on the number listed on their official website. If this is real, they'll have a record of it.

"SSL certificate error" or "certificate expired." An SSL certificate is what makes the padlock appear in your browser's address bar. It tells your browser that the website is who it claims to be. An expired certificate is a real thing, but it's a website's problem to fix, not yours. No one will ever call you about it.

Ask yourself: Is this warning appearing inside my browser on a specific website I navigated to, or did it arrive as a pop-up, a phone call, or a separate window? If it's anything other than your browser on a site you opened yourself, close it. That's the whole answer.

"Your IP address has been flagged." Your IP address is a number that identifies your internet connection, roughly like a return address on a letter. It can be seen by websites you visit. It can't be "flagged" in a way that requires you to call a phone number or pay a fee. This phrase is almost exclusively used in fraud.

Ask: What's the name of the agency or organization you're calling from? What's the case number so I can call your main line and verify this independently? Watch what happens next. A legitimate caller answers both questions without hesitation.

"We detected suspicious activity on your account." This one is tricky because legitimate companies use it too. The difference: a real alert comes from a company you have an account with, arrives through a channel you set up, and asks you to log in through the normal website. It doesn't ask you to call a number or click a link in the message itself.

Ask: I'm going to log in directly through the website and check this myself. Don't click the link in the message. Don't call the number in the message. If the alert is real, the activity will be visible when you log in on your own terms. If the person contacting you pushes back on that, you have your answer.

"Two-factor authentication" or "2FA." A second step when you log in, usually a code sent to your phone or generated by an app. It's a good thing. It means that even if someone has your password, they still can't get in without that second code. If someone asks you to read them your 2FA code over the phone, they're trying to get into your account right now. No legitimate company will ever ask for this.

Ask: You just asked me for a code that was sent to my phone. That code is the only thing standing between you and my account. Why would I give that to someone who called me? Then hang up.

"End-to-end encryption." A message or file scrambled so that only the sender and recipient can read it. Not the company, not the government, not anyone in between. It's a meaningful privacy protection, but it doesn't mean a service is safe from every threat, and it doesn't mean the person you're communicating with is trustworthy. Encryption protects the channel, not the conversation.

Ask: If my messages are private and only I can read them, how exactly did you detect a problem with them? That question has no good answer. A real technician won't claim to have read your encrypted messages.

"Phishing." An attempt to trick you into handing over something valuable — a password, a credit card number, a Social Security number — by pretending to be someone you trust. Usually arrives by email or text. What most people don't realize is that the technique works best on careful, skeptical people. The message is crafted to look exactly like something you were already expecting. The trust being exploited isn't naivety. It's normalcy.

Ask yourself: Did I expect this message? Does the sender's actual email address match the company they claim to be from, or is it slightly off? Is there urgency pushing me to act before I think? Slow down. The message will still be there in five minutes. If it won't, that's the answer.

"Malware." Short for malicious software. Any program designed to damage, disrupt, or gain unauthorized access to a device. Viruses are one type. So are the programs that lock your files and demand payment (ransomware). So are the programs that quietly record what you type (keyloggers). You don't have to do anything obviously wrong to get it. Sometimes just visiting the wrong website is enough.

Ask: What's the exact name of the program you detected, and how do I look it up independently? I'm going to hang up and call you back on the number listed on your company's website. A real technician doesn't need you to stay on the line. Someone who does need you to stay on the line is telling you something important.

I'm not suggesting you need to become a technology expert. You don't need to understand how SSL certificates work at a cryptographic level. You don't need to know what an IP address really is under the hood.

What you need is enough familiarity to recognize when a word is being used to create fear rather than communicate information.

"Your endpoint has been compromised" and "your computer may have a problem" are the same claim. One sounds like it requires immediate expert intervention. The other sounds like something you could look into at your own pace.

The jargon is doing work. It's raising the stakes, narrowing your options, and pushing you toward a decision before you've had time to think.

Recognizing that pressure is the skill. The specific words will change. The formula behind them won't.