How to stay safe, even when tech-savvy admins can’t tell the difference between a scam and the truth.