The 2011 Mw9.1 Tohoku, Japan, earthquake is the paradigmatic example of an earthquake anticipated by a significant foreshock activity, with a Mw7.3 earthquake occurred two days before, within about 10 km 1. Recent results 2 show that statistically relevant changes can be found in the magnitude distribution after the Mw7.3 foreshock but the discrimination between normal and foreshock activity still remains a scientific challenge 3. Here we show that the envelope of the ground velocity recorded after the Mw7.3 foreshock presents an atypical sawtooth profile very different from the one observed after other earthquakes 4. We interpret this profile as the consequence of the locked state of the mainshock fault which reduces the possibility of the foreshock to trigger its own aftershocks. We find a similar sawtooth profile after other Mw6+ foreshocks followed within 10 days by a larger earthquake, as in the case of the 2014 Mw8.1 Iquique, Chile, sequence. This observation allows us to define a level of concern, simply extracted from the first 45 minutes of the recording waveform, associated to the occurrence of a larger earthquake. A test of the method for 47 Mw6+ worldwide earthquakes gives precise warning in time and space after all the 10 earthquakes followed by a larger one with only 2 false alerts.