What is the best cybersecurity tool for everyday people? It’s a fair question, and the honest answer depends on where you’re starting from. Most cybersecurity advice is written for IT professionals, not for people who just want to keep their accounts, money, and data safe without going back to school. If you’ve ever searched for the best personal security software and landed on a comparison chart full of technical jargon and vendor acronyms, you know the frustration. This is our perspective at The Digital Resistance, and it shapes everything we recommend.

At The Digital Resistance, we evaluate consumer cybersecurity tools specifically for everyday Americans: small business owners, retirees, parents, and anyone who uses a laptop or smartphone without an IT department backing them up. This article cuts through the noise with a practical shortlist of 8 tools across 5 categories, each chosen because it works without requiring technical expertise. We’ll also tell you which one to install first.

Those five categories are password managers, two-factor authentication apps, antivirus software, VPN services, and backup plus breach monitoring. You don’t need all 8 by tomorrow. You need to start with one.

What is the best cybersecurity tool for everyday people? Start here.

Why a password manager is the highest-return tool you can install today

Most people don’t use one easy-to-guess password. They use one moderately clever password repeated across dozens of accounts, sometimes with a number swapped at the end. When a single company gets breached and your credentials are exposed, attackers test that same combination on your email, your bank, and your shopping accounts shortly after, often within the same day. Password reuse is the most common way accounts get taken over, and it has nothing to do with how tech-savvy you are.

Bitwarden is free, open-source, and widely trusted in the security community. It supports unlimited devices and passwords on the free tier, making it the best no-cost option for anyone on a budget. 1Password runs about $3 per month (check the provider’s site for current pricing) and earns its cost with a cleaner interface and a polished onboarding experience that walks you through setup step by step. For families or anyone who wants the smoothest possible start, 1Password is worth the small investment. If privacy is your top priority, Proton Pass is a solid alternative. It includes email alias features and is built by the same team behind ProtonMail.

You install the browser extension, create a master password (make it long and memorable, not clever), and let the manager start saving passwords as you log into your accounts. That’s it for day one. You don’t need to import anything or change all your passwords at once. The manager prompts you to update weak or reused ones over time, and autofill handles the rest.

Two-factor authentication: the one switch that blocks most account takeovers

Why SMS verification codes are better than nothing but not the strongest option

Text message codes add a real layer of protection, but they travel through your phone carrier’s network. That means an attacker can intercept or reroute them by convincing your carrier to transfer your number to a new SIM. This is called SIM swapping, and it’s a known, non-trivial risk. Text-based 2FA is still far better than no 2FA, but it’s not the finish line.

The best 2FA apps for people who have never used one before

Authenticator apps generate codes directly on your device, which eliminates carrier interception risk entirely. Google Authenticator is simple and widely supported. Microsoft Authenticator works seamlessly across Microsoft accounts and supports other account types too. Authy is often the strongest pick for beginners because it backs up your codes to the cloud, so you don’t lose everything if you switch phones. All three are free.

Which accounts to lock down first (and in what order)

Start with your email account. Your inbox controls password resets for every other account you own, which makes it the single most critical account to protect. After email, lock down banking and financial accounts, then move to social media and streaming services. For your Google account specifically, the setup path is: My Account, then Security, then 2-Step Verification, then Get Started. The process typically takes just a few minutes.

Antivirus software: free is often enough, and here is when it is not

Microsoft Defender: the capable free tool already on your Windows PC

If you run Windows 10 or Windows 11, you already have solid antivirus protection installed. Microsoft Defender runs in the background, scans in real time, and integrates directly with the Windows Security Center dashboard. Independent testing organizations such as AV-TEST and AV-Comparatives consistently rated it as a strong baseline for everyday home use heading into 2026. For most people practicing normal browsing habits and sticking to trusted downloads, Defender is a legitimate choice, not a placeholder.

When Bitdefender Free or Malwarebytes Free is worth adding

Bitdefender Free adds a third-party detection layer if you want a second set of eyes beyond what’s built into Windows. Independent performance testing generally categorizes it as lightweight, meaning it avoids the system slowdowns associated with larger security suites. Malwarebytes Free works best as an on-demand scanner: run it when something feels off, not as your primary real-time protection. Avast and AVG are technically capable free options, but their histories around user data practices make Bitdefender and Defender cleaner recommendations for most Americans.

What to skip: bloated security suites that slow your device down

The instinct to buy the biggest security suite available is understandable, but it often backfires. Many paid mega-suites bundle VPNs, password managers, identity tools, and cleanup utilities into one package that taxes older hardware and rarely improves core protection over a focused, lighter tool. Match the software to your actual habits, not to the longest feature list.

VPN services for home users: what they actually protect (and what they do not)

Where a VPN actually helps a non-technical user

A VPN is most useful in two specific situations: connecting to public Wi-Fi in a coffee shop, airport, or hotel, and masking your browsing activity from your internet provider. It does not make you anonymous online, and it does not protect you from phishing or malware. Knowing what a VPN does and doesn’t do helps you decide when you actually need one turned on.

Free VPN vs. paid VPN: where the line is for personal use

Free VPNs typically impose data caps, sometimes as low as a few hundred megabytes per month depending on the provider, which may be enough for occasional low-stakes browsing but falls short for regular banking on public Wi-Fi or remote work. For anything sensitive on a network you don’t control, a paid VPN from a reputable provider is the right call. Proton VPN and NordVPN are two well-regarded options with transparent privacy policies and apps built for non-technical users. Surfshark is worth considering if household budget is a concern, since it covers unlimited devices under one subscription.

Setting up a VPN for the first time without technical help

Modern VPN apps are built for one-tap use. You download the app, log in, select a server location (your home country works for most purposes), and tap Connect. There’s no configuration file or command line involved. The biggest barrier for most people isn’t the setup, it’s deciding to start. Once it’s installed, knowing when to toggle it on versus leaving it off becomes second nature quickly.

Backup and breach monitoring: the two tools most people skip until it is too late

The 3-2-1 backup rule explained in plain English

Three copies of your important files. Two stored on different types of media, such as your computer and an external hard drive. One copy stored somewhere separate, like a cloud service or a drive at a family member’s home. If ransomware locks your device or your hard drive fails, that off-site copy is what saves you. On Windows, File History handles local backups; OneDrive or Google Drive handles the cloud copy. Together, they give you a solid free 3-2-1 setup with no paid tools required.

Free breach monitoring tools that work right now

HaveIBeenPwned.com lets you enter any email address and instantly see whether it has appeared in a known data breach. It’s free, takes 30 seconds, and the results are often eye-opening. Google’s built-in password checkup, found in your Google account security settings, flags reused and compromised passwords automatically. CISA’s Secure Our World program offers additional no-cost resources backed by the federal government, written in plain language for everyday Americans rather than security professionals.

When paid dark web monitoring is worth it

Free breach monitoring alerts you after a breach becomes public knowledge. Paid dark web monitoring scans criminal forums where stolen data is bought and sold, which can surface exposure earlier than public breach disclosures, though no service can guarantee detection before information spreads. Norton 360 Deluxe and Bitdefender Total Security both include dark web monitoring in their paid tiers, which makes the upgrade easier to evaluate as a bundle rather than a separate line item in your budget.

Which tool to install first and how to build your protection from there

The priority order that gives you the most protection with the least effort

Start with a password manager. Then enable 2FA on your email and banking accounts. Confirm your antivirus is active, or install Bitdefender Free if you’re not on Windows. Add a VPN if you regularly use public networks. Set up your backup routine next, and finally enroll in breach monitoring. This sequence is deliberate: each step protects the foundation before building the next layer, so no effort is wasted.

How The Digital Resistance recommends everyday Americans get started

Our approach at The Digital Resistance is straightforward: start with what you already have, add one tool at a time, and never let the perfect setup stop you from building a good one. You don’t need to implement everything in a weekend. One tool installed today puts you ahead of the majority of people who never start. Our community resources are designed to walk you through each step without assuming any technical background.

A simple self-check to confirm you are covered

Before you close this tab, run through this quick checklist:

• Password manager installed and active in your browser

• 2FA enabled on your email and at least one banking account

• Antivirus confirmed active (Defender, Bitdefender, or another trusted option)

• Backup routine in place with at least one off-site copy

• Breach monitoring set up at HaveIBeenPwned.com

• VPN ready to activate when you connect to public Wi-Fi

You don’t need an IT team to protect yourself online

So, what is the best cybersecurity tool for everyday people? The honest answer: the one you actually install. Protecting your digital life comes down to five categories, password management, two-factor authentication, antivirus protection, a VPN for unsafe networks, and backup with breach monitoring. None of them require technical expertise. None require an expensive enterprise subscription. Most of the best options covered here are free or cost less than a monthly streaming service.

Start with a password manager. It’s the right first move for most people because it solves the most widespread vulnerability immediately. Once it’s running, the next step becomes obvious.

The Digital Resistance exists because everyday Americans deserve clear, practical guidance on personal cybersecurity without having to decode reviews written for security professionals. Explore more resources at The Digital Resistance. Join a community of people who take their digital safety seriously, one step at a time.

According to the FBI’s IC3 annual reports, internet crime complaints have reached into the hundreds of thousands each year, yet a significant share of fraud victims never file a single report. Many don’t know where to start, and some assume nothing will come of it. That silence is exactly what scammers count on. If you’ve been hit by an online scam, or you’re helping someone who has, knowing how to report internet fraud is one of the most direct actions you can take to fight back and protect yourself from further damage.

This guide walks you through the full process: what evidence to pull together before you file, which agency handles which type of fraud, how to complete the IC3 and FTC forms step by step, and what to do the moment you click submit. At The Digital Resistance, we’ve put together fraud response templates and checklists that pair with this guide, bookmark both before you start.

Collect your evidence before you file anything

Filing a strong complaint starts before you open a single government website. Investigators can only act on what you give them, and a well-documented report is far more likely to contribute to an active case than a vague summary submitted in frustration. Taking 20 minutes to organize your evidence before you file makes every report more actionable.

Screenshots and communications to save

Capture screenshots of every scam message, fraudulent website, social media profile, and text or chat log connected to the incident. When you take these screenshots, make sure the full browser window is visible, including the URL bar and your system clock. That timestamp and web address are what give the image evidentiary weight. Save files in their original format when possible, since compressed images can lose metadata.

How to pull your email headers

Email headers tell investigators where a message actually originated, which is rarely the address the scammer showed you. In Gmail, open the message, click the three-dot menu, and select “Show original.” In Outlook desktop, open the email and go to File, then Properties; the Internet headers box contains the raw data. Look for the “Received” fields and any “x-originating-ip” or “Client IP” lines. Those entries trace the message’s path from sender to your inbox and may reveal the actual IP address behind the scam.

Transaction records and financial documentation

Gather your bank statements, wire transfer confirmations, payment receipts, and gift card purchase records before you start filing. The IC3 form specifically asks for transaction date, amount, and counterparty details, so having these ready means you can complete the form in one session without hunting through your accounts mid-way. If cryptocurrency was involved, note the wallet addresses and transaction IDs from your exchange or wallet history.

How to Report Internet Fraud: Match Your Fraud Type to the Right Agency

Filing with the wrong agency wastes time and delays any chance of recovery. Different agencies have different jurisdictions, and the type of fraud you experienced determines where your report will do the most good. In many cases, filing with more than one agency is the right call.

When the FBI’s IC3 is the right call

IC3 handles internet-facilitated crimes: phishing, business email compromise, ransomware, romance scams, online investment fraud, tech support scams, and non-delivery of goods. It’s especially important when there’s a financial loss or a multi-state element to the fraud. Filing with IC3 as quickly as possible after the fraud gives investigators the best chance of tracing or freezing funds before they move further. The direct URL is ic3.gov, and everything goes through the online form since IC3 does not accept phone reports.

When to report fraud to the FTC

The FTC tracks consumer fraud patterns and uses complaint data to build enforcement cases and issue public warnings. It’s the right channel for impersonation scams, shopping fraud, prize and sweepstakes schemes, and spam-based fraud. The Department of Justice’s own reporting guidance points to both IC3 and the FTC for internet fraud, so filing with both agencies is often the smart move when financial loss is involved.

State attorney general and local police situations

State attorney general offices handle locally concentrated fraud and violations of state consumer protection laws. Local police become essential when you know the suspect, the crime has a physical connection to your area, or you need an official police report number for your bank or insurance company. Some financial institutions require a police report before they’ll initiate a fraud dispute or chargeback, so don’t skip this step if you’re pursuing account recovery. For elder fraud specifically, the DOJ’s National Elder Fraud Hotline is available at 1-833-372-8311.

How to Report Internet Fraud to IC3: A Step-by-Step Walkthrough

IC3 is the FBI’s primary channel for internet crime reporting, and the form is more straightforward than most people expect. Go to ic3.gov and click “File a Complaint.” Accept the terms and conditions, then work through the seven sections. Complete the form in one sitting if you can, the form may not save progress between sessions.

The 7-step IC3 complaint form

1. Who is filing: Indicate whether you were directly affected or filing on behalf of someone else.

1. Complainant information: Your name, address, phone number, and email address.

1. Financial transactions: Transaction amount, date, account details, how the money was sent, and your total loss.

1. Subject information: Any known details about the scammer, including name, email, phone, website, or IP address.

1. Description of the incident: A clear, factual account of what happened in your own words.

1. Other relevant information: Anything else that connects to the incident.

1. Privacy and signature: Type your name as a digital signature and submit.

What happens after you submit

IC3 reviews the report and may refer it to federal, state, or local law enforcement. You won’t receive a case-by-case status update in most situations. IC3 will contact you only if additional information is needed. That’s not a reason to skip filing. Your complaint feeds into broader investigations, helps analysts identify patterns, and contributes to enforcement actions that affect many victims beyond your own case.

How to Report Fraud to the FTC

FTC reporting is the consumer-protection layer that IC3 doesn’t fully cover. These reports help the FTC identify fraud trends, take enforcement action against bad actors, and alert the public to emerging scams. The process is straightforward:

1. Go toreportfraud.ftc.govand click “Report Now.”

1. Answer the screening questions to categorize your fraud type.

1. Describe what happened in detail, including names, dates, and amounts.

1. Submit. The FTC allows partial reporting, so you can share as much or as little personal detail as you’re comfortable with.

What to include and what to leave out

Include the names of people involved, phone numbers, websites or email addresses connected to the scam, the date it happened, and how much money you sent and how you paid. Paste relevant text from scam emails or messages directly into the description field, since the FTC form does not accept file attachments. Do not include your Social Security number, date of birth, or full bank account numbers in the FTC complaint form. Per FTC guidance, those details aren’t needed for the fraud report, keep them out of general web complaint forms unless a form explicitly requires them. If you need to speak with someone directly, the FTC helpline is 1-877-382-4357.

Report to your state attorney general and local police

Many fraud victims skip this step entirely, and it often costs them when they try to recover funds through their bank or insurance company. State and local reports serve a different purpose than federal filings: they create documentation that financial institutions and insurers actually ask for.

How to find your state attorney general’s complaint form

Every state AG office runs a consumer fraud complaint portal. Search for “[your state] attorney general consumer fraud complaint” and the official portal will surface at the top of the results. State AGs prioritize locally concentrated cases and violations of state consumer protection statutes. If you or someone you’re helping is a senior who was targeted, contact the DOJ’s National Elder Fraud Hotline at 1-833-372-8311 in addition to your state AG office.

Why a local police report is worth your time

Banks and credit card companies often require a police report number before they’ll process a fraud dispute or initiate a chargeback, and insurance policies frequently have the same requirement. Contact your local non-emergency police line, or check whether your city or county offers an online report portal for financial crimes. The report itself may not trigger an immediate investigation into an internet crime, but the documentation it creates is practically valuable when you’re fighting to get money back through your financial institution.

What to do immediately after you’ve filed

Filing reports matters, but it doesn’t stop the bleeding on its own. The moment your reports are submitted, shift your focus to containing the damage and locking down your accounts.

Protect your accounts and limit further damage

Contact your bank or credit union immediately to dispute transactions and freeze or close any compromised accounts. If identity theft is part of the picture, place a fraud alert or credit freeze with Equifax, Experian, and TransUnion. Change passwords on every account connected to the compromised information, starting with email and financial accounts. If a wire transfer was involved, call your bank the same day you file your IC3 report: speed is the single most important factor in wire recovery, and the window closes fast once funds move to the receiving account.

Where to find templates, checklists, and next steps

Government forms get your reports filed. What comes next, evidence organization, account recovery sequencing, and follow-up documentation for your bank, requires a more detailed playbook. The Digital Resistance offers downloadable evidence collection templates, post-reporting checklists, and step-by-step guides built around common scam types including romance fraud, tech support scams, and business email compromise. After you’ve filed, that’s your next stop for practical follow-up support.

Take action now, not later

Knowing how to report internet fraud doesn’t require legal expertise or a technical background. It requires the right steps in the right order. Gather your evidence first, match your fraud type to the correct agency, file with IC3 and the FTC, loop in your state attorney general and local police when needed, and lock down your financial accounts immediately after submitting.

Every report you file contributes to a larger picture that helps investigators identify patterns, build cases, and ultimately disrupt the operations behind these schemes. The scammers behind these schemes count on silence. Don’t give them that. File quickly, file completely, and don’t wait to see if the situation resolves itself.

Visit The Digital Resistance for fraud response resources, reporting checklists, and guides built around the scam types IC3 and the FTC flag most frequently. The tools are there. Use them.

Quick reference: reporting contacts

• IC3 (FBI): ic3.gov

• FTC: reportfraud.ftc.gov| 1-877-382-4357

• Elder Fraud Hotline (DOJ): 1-833-372-8311

• State attorney general: Search “[your state] attorney general consumer fraud complaint”

• Local police: Call your non-emergency line or check for an online report portal

How do I recognize a phishing attempt versus a phone scam? It’s a question worth asking before the attack arrives, not after. You open your inbox to find an urgent email: your bank account has been locked and you need to verify your identity immediately. Forty minutes later, your phone rings. A man identifies himself as an IRS agent and tells you that your Social Security number has been suspended due to suspicious activity. Two separate attacks. One goal: make you act before you think.

Most people know phishing and phone scams exist. The harder part is recognizing them in real time, when the pressure is on and the message looks convincing. These tactics are engineered to bypass your instincts, not trigger them. The guidance here comes from the same practical, plain-language framework The Digital Resistance uses to help everyday Americans fight back against social engineering scams without needing a technical background. This article breaks down the specific red flags for each threat, walks you through a quick verification process, and gives you the exact steps to take if you’ve been targeted.

What phishing emails look like when they’re trying to fool you

The anatomy of a phishing email is almost always the same, even when the branding changes. Attackers dress up a fake bank alert, a shipping notification, or a password reset request to look like the real thing. The details that give it away are there, but they require you to slow down and look.

The sender address and subject line are almost always a tell

The display name in your inbox might say “Chase Bank Alerts,” but the actual sending address is something like alerts@chase-secure-login.com. The domain is wrong. Legitimate companies send email from their own verified domains, not lookalike variations with extra words or hyphens. There are occasional exceptions, some companies use third-party marketing platforms or partner subdomains, but any domain you don’t recognize warrants a closer look. Always expand the sender field to see the full address, especially when the email is asking you to take any action.

Phishing email subject lines are designed to spike anxiety fast. Common examples from 2026 include “Your account has been suspended,” “Unusual login detected, verify now,” “Password expires in 24 hours,” and “Payment failed, action required.” HR-themed lures like “Vacation Policy Update” and “Acknowledge Your Appraisal” are also widely used because they blend into a normal workday. Urgency is the engine behind all of them. If a subject line is pushing you to act before you think, that’s the first red flag.

What the link, attachment, or request is actually asking for

Before you click any link in a suspicious email, hover over it. The destination URL that appears at the bottom of your browser should match the company’s official domain exactly. If it points somewhere else, including a redirect through a shortened URL, close the email. Unexpected attachments, especially ZIP files, HTML forms, or invoice PDFs you didn’t request, are another major warning sign.

Any email that asks you to provide your password, a one-time verification code, a card number, or gift card payment details is a hard stop. No legitimate bank, government agency, or major company sends that kind of request by email. If you genuinely owe money or need to verify your account, go directly to the company’s website from a fresh browser tab, never follow a link from the message itself.

What a vishing call sounds like when you pick up

Voice phishing, commonly called vishing, uses live phone calls to run the same manipulation that phishing emails rely on, but with one key advantage: a human voice creates real-time pressure that a text on a screen doesn’t. You can leave a suspicious email in your inbox and investigate later. A caller demands a response right now.

The IRS impersonation call script and why it works

The IRS impersonation script has been one of the most common vishing formats in the U.S. for years, and it keeps working because it hits several psychological levers at once. The caller claims your Social Security number has been “suspended” due to suspicious activity, tells you a warrant has been issued, and says local police will arrive unless you pay immediately by gift card or wire transfer. The tone shifts between official-sounding formality and escalating threat within the same call, creating genuine confusion about what’s real.

The IRS does not call taxpayers to demand immediate payment, threaten arrest, or require gift card payments. It sends notices by mail first. Any caller making those demands is running a scam, regardless of how official they sound. Other phone scam red flags include instructions not to hang up, orders not to tell anyone else about the call, and requests to install remote-access software on your device.

Caller ID spoofing and the pressure tactics that follow

The number displayed on your screen is not proof of who is calling. Caller ID spoofing allows scammers to display any number they choose, including numbers that appear to belong to the IRS, your actual bank, or a local area code that makes the call feel familiar. That displayed number is meaningless as a trust signal. Do not rely on it.

Legitimate banks and government agencies will never object to you ending a call to verify their identity independently. If a caller tells you not to hang up, pressures you to keep the conversation secret, or insists on a specific payment method, those aren’t coincidental quirks. They are deliberate tactics designed to keep you isolated and acting fast. Smishing, scam texts sent to your phone, bridges both worlds: the delivery method is your phone, but the mechanics mirror a phishing email, typically with a short link and a spoofed sender name.

The tactics both share and what actually makes them different

Whether the attack arrives in your inbox or over the phone, the underlying mechanism is identical. Both rely on urgency, fear, and manufactured authority. Both impersonate institutions you already trust, banks, the IRS, Medicare, tech companies. Both ask you to take one specific action before you have time to evaluate it clearly.

The meaningful difference is your verification window. A suspicious email sits in your inbox while you investigate the sender, inspect the links, and cross-check the message against your account. A phone call gives you no such window unless you create one by hanging up. Industry observers note that vishing can be more effective in many cases because the caller controls the pace and applies live pressure, you have to break that control deliberately, and that takes conscious effort most people aren’t prepared for.

How do I recognize a phishing attempt versus a phone scam? Start with verification.

Verification is the skill that neutralizes both threats. Following these steps greatly reduces your risk in most cases, and knowing them in advance is what separates a close call from a successful attack.

Checking an email before you click anything

Expand the sender address and confirm the domain matches exactly, not approximately. Hover over every link in the message and compare the destination URL to the company’s official domain. If the email asks you to log in, open a fresh browser tab, type the company’s address yourself, and check for any alerts there. Many email clients display warnings for SPF or DKIM authentication failures, which indicate the message may be coming from a spoofed sender, though not all email clients surface these results in the same way. A failure on either authentication check is a strong reason to treat the message as fraudulent.

Verifying a caller without trusting the call itself

Hang up. That’s the first step. Then find the company’s official phone number from its website, the back of your card, or a recent account statement, and call that number directly. A real bank or government agency will have a record of any legitimate contact they’ve made with you. They will not pressure you for hanging up to verify, and they will not object to the process.

Never read a one-time verification code back to a caller, even if they claim to have sent it for your protection. That code is the key to your account. A caller who asks for it is attempting to take over your access in real time.

What to do immediately after spotting either threat

If the threat came by email

1. Do not click links, open attachments, reply, or use the unsubscribe option in the message.

1. Report it using your email provider’s phishing or spam reporting tool.

1. If you already clicked something, change your password from a clean device, enable multi-factor authentication (MFA), and monitor your accounts for unusual activity.

1. If you shared payment or card details, contact your bank immediately to freeze the account or card.

If the threat came by phone

1. Hang up without providing any information or following any instructions from the caller.

1. Do not call back using any number the caller provided.

1. If you shared personal information, freeze your credit through Equifax, Experian, and TransUnion, the FTC’s IdentityTheft.gov walks through exactly how and when to place a freeze, and notify your bank.

1. Document the call: the number shown, what was claimed, and the time. You’ll need this when you report it.

Where to report it and how to stay ahead of new tactics

Reporting scams is not just paperwork. The data you submit helps federal agencies track organized fraud operations and gives carriers the signals they need to block abusive numbers. Use these channels:

• FTC: File anyphishing or vishing reportatReportFraud.ftc.gov. This is the primary intake point for consumer fraud in the U.S. If you received an unwanted scam call but didn’t lose money, useDoNotCall.govinstead.

• FBI IC3: For scams involving financial loss or identity theft, file a complaint atIC3.gov. Reports filed there can trigger cross-agency referrals and joint task force investigations into organized fraud networks.

• Phishing emails: Forward the message toreportphishing@apwg.orgto help improve detection across email platforms.

• Smishing and scam calls: Forward suspicious texts to 7726 (SPAM). U.S. carriers use thesescam call reportsto identify and block abusive senders.

• The impersonated company: Report directly to the fraud team of whoever was impersonated. They can warn other customers and pursue takedown actions against fake sites.

Scam scripts evolve quickly. IRS impersonation calls that pushed gift cards a few years ago now increasingly direct victims toward cryptocurrency and peer-to-peer payment apps, a shift the FTC has documented in its Consumer Sentinel data. Relying on last year’s playbook to recognize this year’s threats is exactly what scammers count on. The Digital Resistance resource hub at thedigitalresistance.com offers downloadable phishing checklists and community-reported scam alerts so you’re tracking what’s active now, not what made headlines two years ago.

Frequently asked questions: How do I recognize a phishing attempt versus a phone scam?

What is the fastest way to tell if an email is a phishing attempt?

Expand the sender’s full address and confirm the domain is exact, not a lookalike. Then hover over any links without clicking. If the sending domain or link destination doesn’t match the company’s official website, treat the message as fraudulent and report it.

What is vishing, and how is it different from a regular phone scam?

Vishing is voice phishing, a phone call designed to extract sensitive information or payment using social engineering. It differs from a casual fraud attempt in its structure: callers use scripted authority claims, escalating threats, and manufactured urgency to prevent you from hanging up or thinking clearly. The defense is the same either way: hang up and call back using a number you find independently.

What is smishing?

Smishing is phishing delivered by text message. The message typically includes a short link and a spoofed sender name designed to look like your bank, a delivery service, or a government agency. Apply the same rules as email: don’t click the link, don’t reply, and forward the text to 7726 to report it to your carrier.

How do I report a scam call?

File a report at ReportFraud.ftc.gov if you lost money or shared information. Use DoNotCall.gov for unwanted calls where no loss occurred. For significant financial loss or identity theft, file additionally with the FBI at IC3.gov. Forward suspicious texts to 7726 to report them directly to your carrier.

The takeaway: slow down before you act

Recognizing a phishing email versus a phone scam comes down to one principle: urgency is the weapon, and pausing is the defense. Phishing emails leave a trail you can inspect, the sender address, the link destination, the attachment type. Phone scams create real-time pressure that demands a different response: hang up and verify through a channel you control.

Two habits cover most situations. Verify every unexpected request through a separate channel you initiate yourself, and never provide credentials or one-time codes over any channel you didn’t start. If something felt wrong, report it, ReportFraud.ftc.gov, IC3.gov, and 7726 for suspicious texts should already be saved somewhere you can reach them quickly. Bookmark The Digital Resistance resource hub for updated checklists and community-reported scam alerts. The best defense is always knowing what’s coming before it lands in your inbox or rings your phone.

A finance employee joins a scheduled video call. Her CFO is there, along with three familiar colleagues. They walk through a sensitive but urgent transaction, everyone nods, and she authorizes 15 transfers totaling HK$200 million, roughly US$25 million, to five separate accounts. None of the people on that call were real. Every face and every voice had been synthetically generated using publicly available footage of the actual executives. That is deepfake fraud in action, and it is no longer an experimental threat. According to Sumsub’s 2025, 2026 Identity Fraud Report, deepfakes now account for roughly 11% of all fraudulent activity globally. Entrust’s 2024 Identity Fraud Report documented one deepfake identity attack occurring every five minutes throughout 2024, figures drawn from global telemetry across Entrust’s customer base.

That scenario is exactly what this guide is built around. At The Digital Resistance, we help everyday Americans and small businesses recognize AI-driven manipulation before it costs them. This article breaks down the three attack scenarios driving real losses right now: romance fraud, job scams, and executive impersonation. You will also get the specific red flags that expose these attacks and the practical habits that stop them cold.

How deepfake technology became a mainstream fraud tool

The scale of growth here is not subtle. Signicat and Consult Hyperion’s 2024 The Battle Against AI-Driven Identity Fraud report recorded a 2,137% increase in deepfake fraud attempts over three years, rising from 0.1% to 6.5% of all detected fraud between 2021 and 2024. A separate Gartner 2025 survey of security and risk management leaders found that 62% of organizations had dealt with a deepfake incident in the prior 12 months. These are not edge cases or proof-of-concept attacks. They are scaled, repeating operations running against real people every single day.

The reason for that scale is simple: creating a convincing voice clone or face swap no longer requires technical skill or expensive equipment. Open-source models such as RVC and SadTalker can clone a voice from an audio sample as short as a few seconds and run on a standard consumer GPU. Scammers harvest their raw material from LinkedIn videos, YouTube interviews, earnings calls, and social media profiles. Anyone with a public digital footprint is a potential target for deepfake scams, which means most Americans already qualify.

Romance scams and deepfake fraud built on AI-generated faces and voices

The mechanics of a deepfake romance scam follow a predictable pattern. A scammer builds a convincing digital persona using AI-generated photos and a cloned or synthesized voice. The fabricated “person” communicates through messaging first, then escalates to video calls using prerecorded deepfake footage or real-time face-swapping tools. Emotional trust builds over weeks or months, supported by fabricated job backgrounds, family stories, and future plans carefully tailored to match what the target most wants to hear.

Once that trust is in place, the ask arrives, a medical emergency, a business deal needing bridging funds, a visa fee, or a cryptocurrency investment opportunity. Documented celebrity impersonation cases involving Brad Pitt and Keanu Reeves, reported by outlets including BBC News and The Guardian, resulted in victims losing hundreds of thousands of dollars after months of AI-simulated relationship-building. In one widely reported case, a French woman handed over more than €800,000 to someone she believed was Brad Pitt. In another, a British widow lost £500,000 to a scammer using hyper-realistic AI videos to impersonate Jason Momoa. Deepfake fraud works in these scenarios because emotional investment makes skepticism feel disloyal.

The red flags worth memorizing for romantic video interactions are specific. Watch for calls that stay unusually short, lag noticeably, or cut out when you ask the person to turn sideways or move to different lighting. A face may look slightly wrong in motion even when static frames appear clean, this is called temporal incoherence, and it is one of the strongest signals of deepfake phishing activity. Any genuine person can wave at the camera, hold up a piece of paper with today’s date, or do something unscripted on demand. Many deepfake operators cannot replicate unscripted, real-time actions convincingly, though sophisticated real-time systems are improving, which is why pairing this test with other verification steps matters.

Job interview deepfake fraud and AI-enabled hiring schemes

The FBI has issued specific warnings about candidates using real-time deepfake overlays during video interviews to present a completely fabricated appearance. The goal is usually to obtain a remote position with access to sensitive systems or company funds, then exploit that access from inside. Companies have unknowingly hired impersonators who spent their time mapping internal systems, siphoning data, or positioning for larger attacks. HR teams that use video interviews as their primary identity verification are the most exposed, because the format provides no independent confirmation that the face on screen belongs to the person who applied.

The attack runs in reverse for job seekers. Fraudsters impersonate legitimate employers or staffing firms, conduct convincing video interviews using audio deepfakes or real-time overlays, extend fake job offers, and then request onboarding fees, equipment deposits, or sensitive personal information such as a Social Security number or bank account details for direct deposit. LinkedIn and Indeed are primary hunting grounds because career ambitions make targets susceptible to artificial urgency, particularly when the offer “expires Friday.” This form of deepfake fraud is growing precisely because it exploits people at a moment of genuine hope.

The verification steps for both sides are straightforward. Hiring managers should require government-issued ID verification through a separate channel before employment begins and should never treat a video interview alone as identity confirmation. Job seekers should verify recruiter identity by calling the company’s main published phone number directly, not any number provided in the offer email. Legitimate employers do not request payment at any stage of onboarding, if a fee appears before your first day, treat it as a definitive fraud signal and report it immediately.

CEO impersonation schemes and business payment fraud

The 2024 Hong Kong case stands as the clearest illustration of how this attack category works. A finance employee joined a multi-person video call where the CFO and several colleagues appeared live, engaged, and authoritative. Hong Kong police confirmed every participant other than the victim was a deepfake constructed from publicly available footage of the actual executives. The multi-person format manufactured social proof, when several familiar colleagues appeared to validate the request, independent verification felt unnecessary. The employee authorized 15 separate transfers before an out-of-band check revealed the fraud.

These scams are designed to exploit a fundamental trust shortcut. When you can see and hear someone you recognize, the brain treats that as confirmation of identity. Attackers amplify this by introducing urgency and secrecy, typically framing the request with language like “don’t mention this to legal yet, it’s sensitive.” That instruction prevents the one action that would stop the attack: an independent callback to a known number. A 2019 UK case demonstrated the same pattern with audio alone. A cloned CEO voice pushed a finance director to wire US$243,000 to a supposed supplier within minutes, no video required, just a convincing AI voice spoofing call.

The single most effective defense against this entire category of deepfake fraud is the out-of-band callback rule. Many high-profile cases that were averted shared a common factor: someone placed an independent call to the supposed requester using a number already saved in their contacts, not one provided in the suspicious communication. Industry guidance from organizations including CISA and SANS consistently recommends mandatory callbacks as a simple, cost-free control. Organizations that build this into their payment approval workflows can significantly reduce successful fraud attempts, according to financial crime guidance published by the Association of Certified Fraud Examiners (ACFE).

Red flags that reveal manipulated video and audio

Video inconsistencies to watch for

For video, the most reliable indicators are not static oddities but motion-based inconsistencies. Lip-sync drift is the strongest signal: the mouth shapes, jaw movement, and spoken phonemes don’t fully align, especially during fast speech or consonant-heavy words like “probably” or “bamboo.” Watch the edges of the face too. The hairline, jawline, and teeth border may blur, flicker, or show a subtle seam between generated and real regions. Lighting is another strong tell, shadows and highlights that don’t match the background light source, or that shift unnaturally between cuts, indicate a composited image rather than a real face in a real room.

Blinking behavior is worth a focused look. Blinks that are too infrequent, too regular, or that don’t involve the surrounding facial muscles naturally are a persistent weakness of video synthesis. Synthetic media detection tools like Reality Defender use frame-level analysis to flag exactly these kinds of motion-based anomalies across multiple channels simultaneously.

Audio red flags and AI voice spoofing signals

For audio, the clearest signals are prosody that sounds too smooth or emotionally flat, missing environmental acoustics such as room reverberation and ambient noise, and transitions between phrases that are slightly too long or too perfectly timed. Real voices carry micro-variations in rhythm, emphasis, and breath placement that AI synthesis consistently irons out. Audio deepfakes and AI voice spoofing attempts often pass a casual listen but reveal themselves under deliberate attention, slow the playback or listen for the space between words.

One blurry frame or one awkward pause is not enough to act on alone. Real video calls have compression artifacts, and real people have bad days. What distinguishes synthetic media is the combination of multiple inconsistencies occurring together. Lip-sync drift plus lighting mismatch plus unnaturally smooth audio is a strong composite signal. Train yourself to pause and catalog what feels off, note the specific combination, not just a single oddity, before drawing a conclusion. Forensic tools like Sensity AI’s frame-level inspection and Pindrop’s live call defense capabilities are built for exactly this kind of synthetic media detection at scale.

How to protect yourself before becoming a victim

For individuals, the most immediately useful step is establishing a code word with family members that can be used in any suspected impersonation scenario. This is especially valuable when a scammer impersonates a grandchild in distress or a spouse stranded somewhere. Never send money, share sensitive data, or make commitments based solely on a video call or voice message tied to an unusual or unexpected request, regardless of who appears to be asking. For romantic contacts, verify identity by controlling the video call prompts yourself: ask for something unscripted, specific, and impossible to prerecord.

On the organizational side, specific controls need to be in place before the first incident, not after it. Start with these:

• Dual-authorization controls for all financial transfers above a defined threshold, configured so they cannot be bypassed by a single approver

• A mandatory out-of-band callback policy for any payment instruction or account change received via email, chat, or phone

• Regular deepfake fraud awareness training for finance, HR, and customer-facing staff as a recurring practice, not a one-time onboarding session

• Enterprise detection tools for higher-risk environments: Pindrop for live call defense against AI voice spoofing, Reality Defender for multi-modal synthetic media detection, or Sensity AI for forensic file inspection and video impersonation fraud analysis

The Digital Resistance exists specifically to close the gap between sophisticated AI-driven threats and the people those threats target most aggressively: small business owners, everyday consumers, seniors, and non-technical professionals who don’t have an IT team standing between them and the next attack. The movement provides plain-language guidance, practical frameworks, and community-driven education built for people who need to act on what they learn, not just read about it.

The habits that close the door on deepfake fraud

Deepfake fraud is sophisticated in its technology but predictable in its psychology. Every major case in this article relied on the same combination: urgency, the appearance of a trusted face or voice, and a target who had no simple verification habit in place. Romance fraud, job scams, and executive impersonation all exploit the same shortcut the brain takes when it sees or hears a familiar presence. Closing that shortcut doesn’t require technical tools. It requires deliberate habits applied consistently.

Romance fraud, hiring scams, and CEO impersonation all share one common thread: the moment a request involves money or sensitive data, verification through a separate, independently confirmed channel becomes non-negotiable. That single habit, applied before acting, is what stops deepfake-based fraud regardless of how convincing the synthetic media is.

Share this article with someone who wouldn’t recognize these red flags. Then visit The Digital Resistance for resources, frameworks, and community-driven guidance on protecting yourself and your organization from synthetic media fraud and deepfake scams. The attacks are getting better. Build your defenses before you need them.

How do I recognize a phishing attempt versus a phone scam? It’s a question worth asking before the attack arrives, not after. You open your inbox to find an urgent email: your bank account has been locked and you need to verify your identity immediately. Forty minutes later, your phone rings. A man identifies himself as an IRS agent and tells you that your Social Security number has been suspended due to suspicious activity. Two separate attacks. One goal: make you act before you think.

Most people know phishing and phone scams exist. The harder part is recognizing them in real time, when the pressure is on and the message looks convincing. These tactics are engineered to bypass your instincts, not trigger them. The guidance here comes from the same practical, plain-language framework The Digital Resistance uses to help everyday Americans fight back against social engineering scams without needing a technical background. This article breaks down the specific red flags for each threat, walks you through a quick verification process, and gives you the exact steps to take if you’ve been targeted.

What phishing emails look like when they’re trying to fool you

The anatomy of a phishing email is almost always the same, even when the branding changes. Attackers dress up a fake bank alert, a shipping notification, or a password reset request to look like the real thing. The details that give it away are there, but they require you to slow down and look.

The sender address and subject line are almost always a tell

The display name in your inbox might say “Chase Bank Alerts,” but the actual sending address is something like alerts@chase-secure-login.com. The domain is wrong. Legitimate companies send email from their own verified domains, not lookalike variations with extra words or hyphens. There are occasional exceptions, some companies use third-party marketing platforms or partner subdomains, but any domain you don’t recognize warrants a closer look. Always expand the sender field to see the full address, especially when the email is asking you to take any action.

Phishing email subject lines are designed to spike anxiety fast. Common examples from 2026 include “Your account has been suspended,” “Unusual login detected, verify now,” “Password expires in 24 hours,” and “Payment failed, action required.” HR-themed lures like “Vacation Policy Update” and “Acknowledge Your Appraisal” are also widely used because they blend into a normal workday. Urgency is the engine behind all of them. If a subject line is pushing you to act before you think, that’s the first red flag.

What the link, attachment, or request is actually asking for

Before you click any link in a suspicious email, hover over it. The destination URL that appears at the bottom of your browser should match the company’s official domain exactly. If it points somewhere else, including a redirect through a shortened URL, close the email. Unexpected attachments, especially ZIP files, HTML forms, or invoice PDFs you didn’t request, are another major warning sign.

Any email that asks you to provide your password, a one-time verification code, a card number, or gift card payment details is a hard stop. No legitimate bank, government agency, or major company sends that kind of request by email. If you genuinely owe money or need to verify your account, go directly to the company’s website from a fresh browser tab, never follow a link from the message itself.

What a vishing call sounds like when you pick up

Voice phishing, commonly called vishing, uses live phone calls to run the same manipulation that phishing emails rely on, but with one key advantage: a human voice creates real-time pressure that a text on a screen doesn’t. You can leave a suspicious email in your inbox and investigate later. A caller demands a response right now.

The IRS impersonation call script and why it works

The IRS impersonation script has been one of the most common vishing formats in the U.S. for years, and it keeps working because it hits several psychological levers at once. The caller claims your Social Security number has been “suspended” due to suspicious activity, tells you a warrant has been issued, and says local police will arrive unless you pay immediately by gift card or wire transfer. The tone shifts between official-sounding formality and escalating threat within the same call, creating genuine confusion about what’s real.

The IRS does not call taxpayers to demand immediate payment, threaten arrest, or require gift card payments. It sends notices by mail first. Any caller making those demands is running a scam, regardless of how official they sound. Other phone scam red flags include instructions not to hang up, orders not to tell anyone else about the call, and requests to install remote-access software on your device.

Caller ID spoofing and the pressure tactics that follow

The number displayed on your screen is not proof of who is calling. Caller ID spoofing allows scammers to display any number they choose, including numbers that appear to belong to the IRS, your actual bank, or a local area code that makes the call feel familiar. That displayed number is meaningless as a trust signal. Do not rely on it.

Legitimate banks and government agencies will never object to you ending a call to verify their identity independently. If a caller tells you not to hang up, pressures you to keep the conversation secret, or insists on a specific payment method, those aren’t coincidental quirks. They are deliberate tactics designed to keep you isolated and acting fast. Smishing, scam texts sent to your phone, bridges both worlds: the delivery method is your phone, but the mechanics mirror a phishing email, typically with a short link and a spoofed sender name.

The tactics both share and what actually makes them different

Whether the attack arrives in your inbox or over the phone, the underlying mechanism is identical. Both rely on urgency, fear, and manufactured authority. Both impersonate institutions you already trust, banks, the IRS, Medicare, tech companies. Both ask you to take one specific action before you have time to evaluate it clearly.

The meaningful difference is your verification window. A suspicious email sits in your inbox while you investigate the sender, inspect the links, and cross-check the message against your account. A phone call gives you no such window unless you create one by hanging up. Industry observers note that vishing can be more effective in many cases because the caller controls the pace and applies live pressure, you have to break that control deliberately, and that takes conscious effort most people aren’t prepared for.

How do I recognize a phishing attempt versus a phone scam? Start with verification.

Verification is the skill that neutralizes both threats. Following these steps greatly reduces your risk in most cases, and knowing them in advance is what separates a close call from a successful attack.

Checking an email before you click anything

Expand the sender address and confirm the domain matches exactly, not approximately. Hover over every link in the message and compare the destination URL to the company’s official domain. If the email asks you to log in, open a fresh browser tab, type the company’s address yourself, and check for any alerts there. Many email clients display warnings for SPF or DKIM authentication failures, which indicate the message may be coming from a spoofed sender, though not all email clients surface these results in the same way. A failure on either authentication check is a strong reason to treat the message as fraudulent.

Verifying a caller without trusting the call itself

Hang up. That’s the first step. Then find the company’s official phone number from its website, the back of your card, or a recent account statement, and call that number directly. A real bank or government agency will have a record of any legitimate contact they’ve made with you. They will not pressure you for hanging up to verify, and they will not object to the process.

Never read a one-time verification code back to a caller, even if they claim to have sent it for your protection. That code is the key to your account. A caller who asks for it is attempting to take over your access in real time.

What to do immediately after spotting either threat

If the threat came by email

1. Do not click links, open attachments, reply, or use the unsubscribe option in the message.

1. Report it using your email provider’s phishing or spam reporting tool.

1. If you already clicked something, change your password from a clean device, enable multi-factor authentication (MFA), and monitor your accounts for unusual activity.

1. If you shared payment or card details, contact your bank immediately to freeze the account or card.

If the threat came by phone

1. Hang up without providing any information or following any instructions from the caller.

1. Do not call back using any number the caller provided.

1. If you shared personal information, freeze your credit through Equifax, Experian, and TransUnion, the FTC’s IdentityTheft.gov walks through exactly how and when to place a freeze, and notify your bank.

1. Document the call: the number shown, what was claimed, and the time. You’ll need this when you report it.

Where to report it and how to stay ahead of new tactics

Reporting scams is not just paperwork. The data you submit helps federal agencies track organized fraud operations and gives carriers the signals they need to block abusive numbers. Use these channels:

• FTC: File anyphishing or vishing reportatReportFraud.ftc.gov. This is the primary intake point for consumer fraud in the U.S. If you received an unwanted scam call but didn’t lose money, useDoNotCall.govinstead.

• FBI IC3: For scams involving financial loss or identity theft, file a complaint atIC3.gov. Reports filed there can trigger cross-agency referrals and joint task force investigations into organized fraud networks.

• Phishing emails: Forward the message toreportphishing@apwg.orgto help improve detection across email platforms.

• Smishing and scam calls: Forward suspicious texts to 7726 (SPAM). U.S. carriers use thesescam call reportsto identify and block abusive senders.

• The impersonated company: Report directly to the fraud team of whoever was impersonated. They can warn other customers and pursue takedown actions against fake sites.

Scam scripts evolve quickly. IRS impersonation calls that pushed gift cards a few years ago now increasingly direct victims toward cryptocurrency and peer-to-peer payment apps, a shift the FTC has documented in its Consumer Sentinel data. Relying on last year’s playbook to recognize this year’s threats is exactly what scammers count on. The Digital Resistance resource hub at thedigitalresistance.com offers downloadable phishing checklists and community-reported scam alerts so you’re tracking what’s active now, not what made headlines two years ago.

Frequently asked questions: How do I recognize a phishing attempt versus a phone scam?

What is the fastest way to tell if an email is a phishing attempt?

Expand the sender’s full address and confirm the domain is exact, not a lookalike. Then hover over any links without clicking. If the sending domain or link destination doesn’t match the company’s official website, treat the message as fraudulent and report it.

What is vishing, and how is it different from a regular phone scam?

Vishing is voice phishing, a phone call designed to extract sensitive information or payment using social engineering. It differs from a casual fraud attempt in its structure: callers use scripted authority claims, escalating threats, and manufactured urgency to prevent you from hanging up or thinking clearly. The defense is the same either way: hang up and call back using a number you find independently.

What is smishing?

Smishing is phishing delivered by text message. The message typically includes a short link and a spoofed sender name designed to look like your bank, a delivery service, or a government agency. Apply the same rules as email: don’t click the link, don’t reply, and forward the text to 7726 to report it to your carrier.

How do I report a scam call?

File a report at ReportFraud.ftc.gov if you lost money or shared information. Use DoNotCall.gov for unwanted calls where no loss occurred. For significant financial loss or identity theft, file additionally with the FBI at IC3.gov. Forward suspicious texts to 7726 to report them directly to your carrier.

The takeaway: slow down before you act

Recognizing a phishing email versus a phone scam comes down to one principle: urgency is the weapon, and pausing is the defense. Phishing emails leave a trail you can inspect, the sender address, the link destination, the attachment type. Phone scams create real-time pressure that demands a different response: hang up and verify through a channel you control.

Two habits cover most situations. Verify every unexpected request through a separate channel you initiate yourself, and never provide credentials or one-time codes over any channel you didn’t start. If something felt wrong, report it, ReportFraud.ftc.gov, IC3.gov, and 7726 for suspicious texts should already be saved somewhere you can reach them quickly. Bookmark The Digital Resistance resource hub for updated checklists and community-reported scam alerts. The best defense is always knowing what’s coming before it lands in your inbox or rings your phone.

Scammers in 2026 don’t pick victims by chance. They run systematic, data-driven operations that mirror the infrastructure powering legitimate digital marketing. Most Americans have no idea their personal information is already inside those pipelines, sorted and available on gray-market channels for anyone willing to pay for a profile.

That’s the gap The Digital Resistance was built to about. The awareness layer, the part that explains how you end up in a scammer’s crosshairs before the first fake text arrives, gets skipped by most of the industry because it doesn’t move product. But it’s exactly what everyday Americans need. This article breaks down the full targeting cycle, from data harvesting and psychological profiling to the attack itself, so you know what you’re up against before it reaches your door.

How do scammers target people online in 2026: building a profile before making contact

How data brokers feed the scammer pipeline

Data brokers are companies that legally aggregate and sell personal information: your name, address, phone number, income estimate, health interests, and family relationships. They pull this data from public records, retail purchases, app permissions, and browsing behavior, then package it into consumer profiles sold to marketers, lenders, and anyone else willing to pay. Investigative reporting and gray-market analyses have documented that consumer profiles can be acquired through illicit channels for remarkably little money.

Scammers use this data to filter for the most profitable victims: retirees with investment accounts, recent homebuyers flush with equity, small business owners managing payroll. Data brokers generally aggregate legally available sources, though breaches and illicit activity can also expose that same data to bad actors. The problem is that the same infrastructure powering ad targeting also powers fraud targeting, and there is currently no comprehensive federal law that stops that handoff.

What your social media reveals to bad actors

A public social media account is a free intelligence file. Posts, check-ins, family tags, employer information, and life-event announcements give scammers the context they need to make their approach feel personal and credible. AI-powered scraping tools can process thousands of profiles in minutes, flagging targets by age, recent life events like retirement or divorce, and stated interests.

Scammers cross-reference multiple platforms before making first contact. By the time a call or message reaches you, they may already know your employer, your hometown, your spouse’s name, and the bank you use. That’s not a coincidence. That’s reconnaissance.

The main attack methods once a target is identified

AI voice cloning and deepfake impersonation

Voice cloning tools can generate a convincing replica of a familiar voice from as little as three seconds of clean audio pulled from a voicemail, a social video, or a podcast clip. Criminals use that clone to call family members claiming an emergency, impersonate bank staff, or pressure employees into authorizing transfers. The voice sounds right because it’s built from the real person’s actual vocal patterns.

Deepfake video has crossed the threshold where it passes casual visual inspection. A fake video of a CEO authorizing an urgent wire transfer, or a scammer posing as a grandchild in visible distress, now looks convincing enough to fool people operating under pressure. Business email compromise has evolved into business video compromise, and many organizations still lack robust verification protocols before acting on a video call, a gap that fraud networks exploit deliberately.

Phishing, smishing, and vishing in 2026

AI now writes phishing emails that are grammatically flawless, contextually relevant, and personalized to your known employer, bank, or subscription services. The grammar errors that used to signal a scam are gone. Smishing (SMS phishing) and vishing (voice phishing) exploit the same urgency mechanics but through channels people instinctively trust more than email.

Fake QR codes, known as quishing, are spreading through physical mail, parking meters, and printed menus. Scanning one redirects you to a credential-harvesting page styled to look exactly like your bank’s login screen. The attack starts on paper and ends online, which makes it harder to catch with digital filters alone.

Romance and fake persona scams

Scam networks build AI-generated identities complete with synthetic photos, detailed backstories, and consistent messaging patterns designed to establish emotional trust over weeks or months. These aren’t lone operators running one scheme at a time. Fraud networks now manage hundreds of simultaneous relationships using AI chat assistance to keep each target engaged on a personalized script.

The eventual goal is always money, crypto, gift cards, or sensitive personal data. But the lead-up is engineered to feel entirely human, because patience and specificity are what separate romance scams from every other fraud method. By the time a financial request arrives, the victim has already been conditioned to trust the person asking.

The psychological levers scammers pull every single time

Why urgency is the scammer’s most reliable weapon

Every successful scam creates a reason to act right now, before you can verify anything. The emotion blocks the rational check. Common triggers include account suspension, a missed delivery, a family emergency, tax debt, an expiring investment window, or a compromised password. These triggers all mimic how legitimate institutions sometimes communicate: fast, authoritative, with a clear action required.

Scammers study which emotional hooks convert fastest and retool their scripts accordingly. When you feel urgency, the instinct to verify goes quiet. That’s not a character flaw; that’s how human psychology responds to perceived threats. Scammers have built an entire industry around exploiting exactly that response.

How algorithm-driven advertising amplifies their reach

Fraud networks buy targeted ads on social platforms using the same demographic and behavioral filters legitimate advertisers use. A fake investment ad can be shown exclusively to adults aged 55 and older who have expressed interest in retirement planning, reaching the right victims at scale for minimal cost. The platform’s algorithm optimizes for engagement, not for honesty.

Fake celebrity endorsements built from AI-generated video layer false credibility onto these campaigns. Scammers rotate disposable accounts and burner pages to stay ahead of moderation. By the time a campaign is flagged and removed, it has already reached its intended audience and collected its first round of victims.

The numbers that show how serious this has become

The FBI’s Internet Crime Complaint Center recorded over $20.8 billion in reported U.S. cybercrime losses in 2025, up 26% from the prior year. Investment fraud alone accounted for $8.65 billion of that total. The FTC separately reported $15.9 billion in total fraud losses in 2025, up from $12.5 billion in 2024. Broader consumer estimates place the real annual figure closer to $148 billion when unreported losses are included.

According to Norton’s Cyber Safety Insights Report, nearly 174 scam attempts occur every second worldwide, a volume that reflects the scale of AI-powered automation driving modern fraud. F-Secure’s 2026 Threat Intelligence Report found that 52% of scam victims reported a monetary loss, up from 22% the year prior. Among adults aged 65 to 74, that figure hit 60%, the highest of any age group. One in three American adults reported being targeted by a scam in 2025, and one in four of those targeted said they fell for it.

Social media is now the leading contact channel for fraud losses across nearly every age group. These aren’t isolated incidents affecting a small slice of the population. They are mass-scale targeting operations hitting millions of Americans every year, and the numbers keep climbing.

Red flags that tell you a scammer has found you

Signs a contact or account may be AI-generated or fake

Watch for messages that feel fluent and polished but oddly generic; they reference your name without specific details from your actual conversation. Profile photos that look too perfect, have limited posting history, or reverse-image-search to a different person are a reliable signal. A phone call where the “familiar” voice sounds slightly flat, doesn’t respond naturally to unexpected questions, or pushes back hard when you ask to call a different number deserves immediate skepticism.

Warning signs specific to romance, impersonation, and urgency scams

Regardless of the delivery method, most scams share the same behavioral fingerprints, recognizing the pattern matters more than identifying the specific script being used.

• Declarations of trust or affection that escalate faster than any real relationship would

• Pressure to move from a public platform to a private messaging app early on

• Requests to keep the conversation secret from family or friends

• Any ask for money, crypto, gift cards, wire transfers, or personal documents

• An urgent problem that requires action before you can verify who you’re actually speaking to

Isolation and urgency together are the clearest signal that a scam is in progress. If someone is working to separate you from your support network while applying time pressure, stop and verify through a completely separate channel before doing anything else.

What to do the moment you suspect you’re being targeted

Immediate steps to contain the damage

Stop all communication with the suspected scammer immediately. Don’t reply, click links, or return calls. Then work through these steps in order:

1. Contact your bank, card issuer, or payment app to freeze accounts and dispute any unauthorized transactions.

1. Change your email password first, then banking and financial accounts; enable multi-factor authentication (MFA) on every account that supports it.

1. Run a security scan if you clicked any links or downloaded files, and check for unfamiliar browser extensions or connected apps.

1. Place a fraud alert or credit freeze with the three major credit bureaus if you shared any personal identifying information.

Speed is your most valuable asset in the first hour. Every minute of delay gives the scammer more time to move funds, lock accounts, or cover their tracks. Don’t wait to be certain before acting. Err on the side of containment.

How and where to report an online scam in the U.S.

Reporting matters because it helps law enforcement identify patterns and shut down networks faster. Every report you file protects the next potential victim, even when your own situation can’t be reversed. Use these official channels:

• FTC: reportfraud.ftc.gov handles most consumer fraud and shares data with law enforcement agencies nationwide.

• FBI IC3: ic3.gov is the primary reporting channel for internet crime, especially investment fraud and business email compromise.

• IdentityTheft.gov: If personal documents were exposed, this site provides a personalized step-by-step recovery plan.

Report fake accounts and phishing messages directly to the social media platform using its built-in tools. It takes less than a minute and removes the content for the next person who might encounter it. The Digital Resistance maintains regularly updated guidance on emerging scam tactics and community warning resources you can share with family members and neighbors who may not yet know what to watch for, visit the site directly for the current materials.

How do scammers target people online in 2026? Now you know exactly how it works

Scammers in 2026 run data-driven targeting operations with the same discipline as a professional marketing team. They profile, segment, approach, and manipulate at scale. The targeting doesn’t start when the message arrives. It starts weeks or months earlier, in data pipelines most people don’t know exist.

The Digital Resistance exists because technical software alone doesn’t protect people who don’t recognize what they’re looking at. Awareness is the first firewall. Understanding how do scammers target people online in 2026, from the data broker feed to the AI voice clone to the urgency trigger, is what keeps you from becoming another number in next year’s FBI report.

Forward this to someone in your family who doesn’t yet know what to watch for. The targeting doesn’t stop, but now you know exactly how it works.

What are the most common AI scams targeting Americans right now? According to the FBI’s Internet Crime Complaint Center, Americans lost $893.3 million to AI-enabled scams in 2025 alone. When you factor in unreported fraud, broader industry estimates from the Consumer Federation of America push that figure to $6.3 billion. These aren’t statistics from some distant future, they’re the results of attacks that happened last year, to real people, using technology now widely accessible through consumer web services and low-cost tools that require no technical background to operate.

AI scams are no longer a niche threat that only affects corporations or the extremely wealthy. They’re showing up in grandparents’ phone calls, small business inboxes, and customer service chats. Reported AI-related fraud incidents rose sharply year over year through 2025, and the scammers behind them are getting harder to spot with every passing month.

At The Digital Resistance , our mission is to make sure everyday Americans have the same information that security professionals do, in plain language they can actually use. This article is that kind of resource. By the time you finish reading, you’ll know which AI scams are most active right now, what to watch for in the moment, and exactly what to do if one finds you.

What Are the Most Common AI Scams Targeting Americans?

How deepfake impersonation calls actually work

Scammers harvest audio and video of real people from publicly available sources: social media posts, YouTube interviews, company websites, and even TikToks. That material gets fed into cloning software that learns the person’s voice and generates entirely new speech. Real-time AI video tools have advanced far enough that a scammer can now produce a convincing live video feed of a fabricated person during an active call, a form of synthetic media fraud that security researchers have documented extensively in recent years.

The impersonation targets are usually someone you trust immediately: a company executive, a government official, or a family member. That instant trust is the entire point. The technology doesn’t need to be perfect; it only needs to be convincing enough that you don’t stop to question it before you act.

Voice cloning fraud and the “family emergency” setup

The most common consumer-facing version of voice cloning fraud is the grandparent scam. A scammer pulls a few seconds of audio from a relative’s social media account, clones the voice using publicly available platforms, and calls a parent or grandparent claiming the relative has been arrested. The request that follows is always urgent: wire money, buy gift cards, or send crypto before the situation gets worse. The person on the line sounds exactly like someone they love.

This same technique scales up for corporate targets. Instead of a grandchild, the cloned voice belongs to a CEO or CFO. Instead of $6,500, the requested transfer runs into the tens of millions. The emotional mechanics are identical: familiarity, urgency, and pressure to act before anyone else finds out.

AI-generated phishing emails and why they’re harder to ignore

Traditional phishing emails were relatively easy to spot. Bad grammar, generic greetings like “Dear Customer,” and mismatched sender addresses were common giveaways. Generative AI has eliminated most of those tells. A 2024 security industry study found that AI-written phishing achieves a 54% click-through rate compared to 12% for traditional phishing, because these messages are grammatically clean, contextually relevant, and tailored to the individual recipient.

Spear-phishing takes this further. Attackers scrape your name, employer, recent activity, and professional relationships from public sources, then craft an email that references your actual context. It might look like a message from your accountant about a document you actually discussed, or a follow-up from a vendor you just started working with. That specificity is what makes the modern version so effective.

Fake AI customer service bots and tech support fraud

Fraudulent chatbots and voice-response systems now convincingly impersonate legitimate brands: banks, Amazon, Microsoft, Medicare, and other organizations Americans interact with regularly. These systems are designed to harvest login credentials, payment card numbers, or remote access to your device. What makes this scam particularly effective is that many victims initiate the contact themselves by clicking a fake ad or calling a spoofed number that appeared in a search result.

By the time the person realizes something is wrong, they’ve already handed over sensitive information to a system built from the start to collect it. Before engaging any customer service chatbot for a sensitive issue, confirm you reached it through the company’s official website, not through an ad or a search result link.

What the financial damage data actually shows

Investment fraud leads at $632 million in losses

The FBI’s Internet Crime Complaint Center (IC3) reported $893.3 million in AI-scam losses for 2025, and investment fraud alone accounted for $632 million of that total. Scammers use AI-generated content to build fake trading platforms, fabricate glowing testimonials, and produce deepfake video endorsements featuring celebrities or financial advisors who never agreed to appear. The platforms look professional, the returns look real, and victims often don’t discover the fraud until they try to withdraw funds.

That $632 million also reflects only what was formally reported to the IC3. Investment fraud is widely underreported, researchers note that victims frequently avoid filing complaints out of embarrassment or uncertainty about where to report, which means the actual losses are almost certainly higher than official figures suggest.

Who else is paying the price: BEC, romance scams, and tech support

According to the same IC3 data, business email compromise accounted for $30.3 million in AI-related losses, with tech and customer support fraud at $19.5 million, confidence and romance scams at $19 million, and personal data breaches at $18.8 million. These numbers represent thousands of individual incidents, not a handful of large-scale corporate heists.

IC3 data shows that seniors and small business owners appear disproportionately in these figures. Older adults are frequently targeted because they’re less likely to be familiar with voice cloning technology. Small business owners are targeted because they often lack formal fraud verification procedures, which means a convincing impersonation call or email is more likely to result in an unauthorized transaction.

Red flags that reveal an AI scam before you act

What to listen and watch for on calls and video

On audio calls, listen for flat or robotic delivery that lacks normal human variation. Cloned voices often have unnatural pacing: pauses in the wrong places, sentences that rush or drag slightly, and missing filler words like “um,” “you know,” or a natural exhale before a difficult sentence. Mispronunciation of names, looped background noise, and an oddly polished quality to every word are also common signals.

On video calls, watch for lip-sync that doesn’t quite match the audio, limited or stiff facial movement, and lighting or shadows that look inconsistent with the stated environment. No single indicator is definitive, but when two or three appear together, something is worth investigating.

The pressure tactics scammers rely on

Across every AI scam type, the behavioral red flags follow the same pattern. Extreme urgency is the most reliable one: “don’t hang up,” “you need to do this before anyone else finds out,” “this has to happen in the next hour.” That urgency exists because scammers need to stop you from pausing long enough to verify anything.

Other consistent red flags worth memorizing include:

• Requests for secrecy (“don’t tell anyone about this”)

• Insistence on irreversible payment methods, wire transfers, gift cards, or crypto

• Resistance when you try to call back through a number you already know

• Contact through unexpected channels, like a personal WhatsApp message or an unfamiliar email address

The single most reliable test: a legitimate person or organization will nearly always tolerate a pause and a verification call. Scammers, in contrast, will push hard against that pause almost every time, because the moment you verify, the scheme collapses.

Real cases that show exactly how these attacks play out

Corporate deepfake heists: when your CFO isn’t your CFO

In early 2024, an employee at the engineering firm Arup’s Hong Kong office joined what appeared to be a legitimate video conference with the company’s CFO and several senior colleagues. According to reporting by the BBC and subsequent Hong Kong police statements, every person on that call was an AI-generated deepfake. The employee authorized 15 wire transfers totaling approximately $25.6 million (HK$200 million) before contacting headquarters and discovering the meeting had never happened. This case is the clearest documented example of how far real-time synthetic media fraud has already advanced.

An earlier case from the UK showed the same pattern at the audio level: a senior executive transferred approximately €220,000 after a phone call from what sounded exactly like the CEO of the parent company. Investigators later identified AI voice synthesis as the method used. These aren’t isolated incidents, they’re documented proof that the technology works well enough to deceive experienced business professionals.

Everyday Americans targeted with cloned family voices

In one documented case, a grandmother received a call from what sounded exactly like her grandson. He claimed he had been arrested and needed $6,500 immediately. She sent the money. Her real grandson was fine. The scammer had built the voice clone from a few seconds of audio scraped from the grandson’s social media account.

IC3 complaint data indicates this type of scenario occurs many thousands of times each year and hits older adults hardest, because many don’t know this technology exists at all. The emotional impact of hearing a family member’s voice in distress overrides the skepticism that might otherwise catch the deception. Awareness is the primary defense here, and sharing what you know with the people you care about is one of the most concrete things you can do.

What to do immediately if you’ve been targeted or already fell for it

Stop the bleed first: bank, cards, and payment apps

Stop all contact with the scammer immediately. Don’t respond, don’t click anything else, and don’t try to engage them further. Your next call is to your bank or payment provider, and it needs to happen as fast as possible. Ask them to freeze, hold, dispute, or attempt to reverse any transactions. For card payments, request a chargeback; for wire transfers, ask whether a recall is still possible. The window for reversal is narrow and closes fast.

For cryptocurrency, notify the exchange immediately and save every wallet address involved. Crypto recovery is rare, but the documentation matters for law enforcement and for any dispute you pursue. The faster you contact your financial institution, the better your odds of recovering anything.

Protecting your identity in the aftermath

Once you’ve contained the financial damage, change passwords for your email, banking, and any accounts the scammer may have accessed. Enable two-factor authentication on everything. If you think your phone number was compromised, call your mobile carrier and ask about SIM protection.

If you shared a Social Security number, ID documents, or sensitive personal data, place a fraud alert or credit freeze with Equifax, Experian, and TransUnion right away. Save everything: screenshots, emails, transaction IDs, call logs, and bank records. That documentation supports every step that follows, from bank disputes to law enforcement reports.

How to report AI fraud to the FTC and FBI IC3

File a complaint at reportfraud.ftc.gov with the FTC and submit a separate report to the FBI’s Internet Crime Complaint Center at ic3.gov. Both platforms walk you through the process with prompts; you’ll need dates, amounts, contact information for the scammer, and any supporting documentation you saved. If money was lost or identity theft occurred, file a local police report as well.

Reporting serves two purposes: it helps law enforcement identify patterns and build cases, and it creates an official record that can support fraud reversal requests with your financial institution. If the scam came through a specific platform, report it there too. Every report makes the next person a little harder to target.

Staying ahead as AI scam tactics keep evolving

Daily habits that make you a harder target

Set up a verbal safe word with your family right now. It’s a simple phrase only you and your close contacts know, and it’s what you ask for when something feels off on a call claiming to be a loved one. Verify any unexpected financial request through a known callback number, never the one provided by the caller. Treat unsolicited urgency as a red flag by default, regardless of who seems to be calling.

Use multi-factor authentication across all financial accounts, and be intentional about how much voice and video content you share publicly. Every audio clip you post is potential raw material for a cloning attempt. That’s not a reason to disappear from the internet; it’s a reason to be thoughtful about what you put out and where.

Where to stay current as these tactics keep shifting

The Digital Resistance exists precisely for this moment. It’s a people-first movement built for everyday Americans, small business owners, seniors, parents, and community organizations, who want plain-language updates on AI scam tactics without needing a cybersecurity background to understand them. These tactics are shifting faster than most people expect, and staying current is no longer optional.

Follow The Digital Resistance for real-time alerts on emerging scam patterns, free protective guidance, and a community that shares warnings as threats evolve. The goal is to keep you ahead of the next scam, not catching up after it’s already hit someone you know.

The bottom line

Understanding what are the most common AI scams targeting Americans comes down to recognizing one consistent pattern: impersonation, urgency, and pressure to skip verification. That pattern holds across all four scam types covered here, deepfake video calls, cloned voices on the phone, precision-crafted phishing emails, and fake customer service bots designed to harvest your credentials.

If something feels wrong, pause. Call back through a number you already trust. Give the other person the chance to tolerate that verification, because a scammer won’t. And if money has already moved, call your bank before you do anything else. Time is the variable that determines how much is recoverable.

That’s what this site is for. Bookmark it, share this article with someone who could use it, and take five minutes today to set up that family safe word. Those small steps are what the resistance is built on.

FAQ: What Are the Most Common AI Scams Targeting Americans in 2026?

What are the most common AI scams targeting Americans today?

The four most active types are deepfake video impersonation, voice cloning fraud (including the grandparent scam), AI-generated phishing emails, and fake customer service chatbots. Each exploits trust and urgency in different ways, but all share the same behavioral warning signs described above.

How much money have Americans lost to AI scams?

The FBI’s IC3 reported $893.3 million in verified AI-related scam losses for 2025. When accounting for underreporting, the Consumer Federation of America estimates the true figure is closer to $6.3 billion.

How can I tell if I’m talking to a deepfake or a cloned voice?

Listen for unnatural pacing, robotic delivery, and missing conversational filler. On video calls, watch for lip-sync mismatches and inconsistent lighting. Most importantly, ask for a pause to verify through a number you already have, a legitimate contact will accommodate that request without resistance.

Where should I report an AI scam?

Report to the FTC at reportfraud.ftc.gov and to the FBI at ic3.gov. File a local police report if money was lost. Report through the platform where the scam occurred as well.

If you’ve ever asked yourself, how do I create a cybersecurity plan for my small business?, you’re already asking the right question. Ransomware shows up in 88% of small business breaches, yet many small business owners still operate without a written cybersecurity plan. That gap between the threat and the preparation is exactly where attackers live, and they know it.

Many cybersecurity guides assume enterprise resources rather than the constraints of small businesses. They’re written for IT teams with dedicated budgets, specialized tools, and someone whose entire job is security. You’re the owner, the accountant, the customer service rep, and now apparently the CISO too. You need a plan that fits that reality, not a 60-page framework designed for a company with 500 employees.

This guide, produced by The Digital Resistance for small business owners across the United States, gives you a working cybersecurity plan you can act on today. No jargon. No technical background required. Just the steps that matter most, in the order that makes sense for a business your size.

Why small businesses are being targeted right now

The numbers are worth sitting with for a moment. Phishing accounts for 33 to 36% of confirmed small business breaches (Verizon Data Breach Investigations Report). Business email compromise causes $2.77 billion in annual losses and targets small businesses in 73% of cases (FBI IC3 Annual Report). Stolen or compromised credentials are the single most common entry point, appearing in 22% of all confirmed breaches.

According to SlashNext’s 2025 Phishing Intelligence Report, AI-generated phishing attacks increased 340% in 2025, and threat intelligence from the same period indicates that roughly 41% of small business incidents tracked in 2025 were AI-assisted. Attackers are scaling faster than most defenses can keep up with, and the financial consequences are severe: the average ransomware recovery cost for a small business runs between $638,000 and $1.5 million (Sophos State of Ransomware Report), and that figure doesn’t include the ransom itself.

The assumption that “we’re too small to be a target” is one of the most expensive beliefs a small business owner can hold. Attackers choose small businesses precisely because the defenses are usually thin, no dedicated IT team, weaker authentication, employees juggling multiple roles who are more likely to click a bad link under deadline pressure. One phishing email hitting the wrong inbox can trigger ransomware that shuts your operations down for days. A written, prioritized cybersecurity plan is your defense against that scenario.

How do I create a cybersecurity plan for my small business?

Creating a cybersecurity plan for your small business comes down to five practical steps: mapping your assets, locking down four foundational controls, training your team, writing a basic incident response plan, and pulling it all together with free tools. The sections below walk through each one in order. Start at the top and work your way through, you don’t need to complete everything in a single sitting.

Map what you have before you write a single policy

You can’t protect what you haven’t named. Before you write a single rule or policy, build a complete list of every device and account that touches your business data: laptops, phones, tablets, point-of-sale terminals, cloud storage accounts, payroll platforms, banking portals, and vendor portals. This asset inventory becomes the scope of your entire plan.

Next, identify the data that matters most. Customer payment information, employee records, contracts, banking credentials, and any regulated data in your industry all go on this list. For each asset, ask two questions: what is the realistic threat, and what is the business impact if that asset is compromised or lost? A compromised bank account matters more than a defaced website. Prioritize by business impact, not just by how likely an attack seems.

This exercise is your basic cyber risk assessment. The output is a one-page document that maps your assets, the likely threats against each, and the controls you’ll put in place. The Digital Resistance offers a free asset inventory and threat model template at thedigitalresistance.com to help you build this without starting from a blank page. Start there, and the rest of the plan builds naturally.

Four controls that stop most attacks without breaking your budget

You don’t need a large security budget to stop the most common attacks. Implement four foundational controls, in the right order, and make sure they’re actually working. These align with NIST’s small business cybersecurity guidance (NIST SP 1800-25) as a minimum viable control set for businesses with fewer than 50 employees.

1. Turn on multi-factor authentication for every account that matters

MFA is the single highest-return control available to a small business. It stops most credential-based account takeovers even when a password has already been compromised. Start with your email accounts, banking portals, cloud storage, VPN, payroll platforms, and any admin accounts. Many platforms include MFA at no additional cost, enabling it typically takes only a few minutes per account.

2. Enable automatic software updates and protect every device

Unpatched software is among the most common ways attackers get into small business systems. Enabling automatic OS and application updates closes known vulnerabilities with zero ongoing effort. Pair this with a business-grade antivirus or endpoint protection tool on every device, centrally managed if possible. Add a monthly calendar reminder to manually check anything that can’t auto-update, like older specialty software or legacy hardware.

3. Set up backups you can actually restore from

Use the 3-2-1 rule: three copies of critical data, on two different media types, with one stored offsite or in the cloud. A backup only counts if you’ve tested the restore. Schedule a quarterly restore drill so you know your backup works before ransomware forces the question. Tested backups are one of the most important defenses against ransomware (Sophos State of Ransomware Report). Without them, recovery means paying the ransom or starting from zero.

4. Restrict access to only what each person needs

Apply the principle of least privilege: each employee and each account should only have access to the systems and data they actually need to do their job. Review admin accounts and remove access that’s no longer needed, especially for former employees. This single step significantly limits the damage an attacker can do if they compromise one account.

Turn your employees into your first line of defense

Phishing is the most common attack entry point for small businesses, and AI has made it significantly more dangerous. Attackers now generate convincing, personalized emails at scale. The old advice about looking for bad spelling no longer applies. Your employees need an updated, practical set of warning signs to watch for.

Train your team to recognize these red flags:

• Unexpected urgency or pressure to act immediately

• Requests for login credentials, wire transfers, or gift card purchases

• Sender domains that look slightly off (suppIier.com instead of supplier.com)

• Links where the displayed text doesn’t match the actual destination

• Requests from “executives” asking for unusual actions outside normal processes

Teach one simple verification rule: any request involving money, account access, or sensitive data gets confirmed through a separate channel before any action is taken. Always verify using a phone number from a known, trusted source, not the contact information in the suspicious email itself. A quick call to a known number stops most business email compromise attacks before they cause damage.

Frequency matters more than depth. A single annual training session doesn’t build habits. Short monthly reminders and periodic simulated phishing exercises are far more effective. CISA and NIST both offer free phishing awareness resources at their respective websites. Open-source tools like GoPhish and platforms like PhishDrills let you run simulated phishing campaigns for your team at low or no cost, though free tiers may carry some limitations. The goal isn’t to punish employees who click on a test email. The goal is to build a team that reports suspicious activity without fear, because that report often stops an attack before it escalates.

Write a basic incident response plan before you need one

An incident response plan answers one question: when something goes wrong, who does what and in what order? Writing this plan before an incident happens is the difference between a managed response and a panicked scramble that makes the damage worse.

Every small business incident response plan should follow this sequence: Detect, Triage, Contain, Eradicate, Recover, Notify, Review. The most critical rule in that sequence is to contain first and investigate second. If a device or account is suspected compromised, disconnect it from the network and disable the account before you try to understand what happened. Document everything as you go, timestamps, affected systems, and every action taken. This record matters for insurance claims, regulatory requirements, and the post-incident review.

Define roles before an incident happens. Who is the incident lead? Who is the backup if that person is unavailable? What is your IT provider or managed service provider’s emergency contact? Many cyber insurance policies require notification within 24 to 72 hours of discovery, check your policy language now rather than during the incident. Know which external parties need to be notified: customers if their data was exposed, FBI IC3 for cybercrime reporting, and any state regulators that apply to your industry. All 50 U.S. states have data breach notification laws, and most require notice within 30 to 60 days of discovery (National Conference of State Legislatures). Knowing your obligations in advance keeps a bad situation from becoming a compliance crisis on top of a security crisis.

Free tools, templates, and a community built around your defense

Building out your cybersecurity plan doesn’t have to start from a blank page, and most of the tools you need won’t cost anything. Federal agencies have invested heavily in free resources specifically for small businesses.

Three resources worth bookmarking right now:

• FCC Small Biz Cyber Planner 2.0:an interactive online tool that generates a customized cybersecurity plan based on your business type and size. Free, no technical background required, and the output is a practical planning guide you can act on immediately.

• CISA Small Business Resources: free vulnerability scanning, printable fact sheets, and the Cyber Resilience Review self-assessment. CISA also offers a free SMB Toolkit with starter steps and hands-on resources tailored to businesses without IT teams.

• NIST Small Business Cybersecurity Corner: over 70 free resources including quick-start guides, tip sheets,planning workbooks, and case studies. Downloadable directly from the NIST site.

These federal tools give you the framework. The real work is tailoring that framework to your business, your assets, and the risks that are actually relevant to you. That’s where a community makes the difference.

The Digital Resistance is built specifically for small business owners and non-technical Americans who are building their defenses without an IT team. At thedigitalresistance.com, you can download practical templates, including an asset inventory, an incident response plan, and a complete SMB cybersecurity checklist, and connect with other entrepreneurs going through the same process. The community shares threat warnings, tested tools, and real-world lessons from businesses that have been through an incident and rebuilt stronger. Solo business owners may not have an IT department, but they can have a community that functions like one.

Your cybersecurity plan starts today

Creating a cybersecurity plan for your small business doesn’t require a technical background or a large budget. It requires a clear starting point and the decision to act before something goes wrong. Work through the steps in this guide: build your asset inventory, implement the four foundational controls, train your team on current phishing tactics, define roles in your incident response plan, and use the free tools available to tie it all together.

Start with the asset inventory. Download the free SMB cybersecurity checklist from The Digital Resistance, list every device and account that touches your business data, and work through each section of this guide in order. The plan doesn’t need to be perfect to be useful. A written, working plan that you refine over time is exponentially more effective than no plan at all.

Every small business that builds a plan makes the whole network harder to breach. This is collective defense, and that decision is yours to make right now.

The call sounds official. A badge number, a case number, a warning that your Social Security number has been “suspended.” Your pulse jumps. That reaction is exactly what the scammer is counting on, they’ve spent years perfecting every word of the script to produce it. So what should you do if you get a fake government call? Hang up, document, verify, and report, in that order, and without hesitation.

According to the FTC’s Consumer Sentinel Network, government impersonation scams are consistently among the most reported fraud types in the United States. They work because they weaponize urgency and fear, two things that short-circuit rational thinking faster than almost anything else. At The Digital Resistance, we built this guide specifically so you know what to do before, during, and after one of these calls, giving the scammer zero chance to get what they came for.

This article walks you through every step: what to do while you’re still on the call, how to verify whether any government concern is real, where and how to report what happened, and what to do immediately if you accidentally shared information you shouldn’t have.

Why These Calls Feel So Convincing

How Caller ID Spoofing Fools Even Careful People

Scammers use VoIP tools to place outgoing calls while displaying any phone number they choose on your screen. That means your caller ID can show the actual published number for the IRS, the Social Security Administration, or the FBI, and the call is still coming from a fraudster in a call center thousands of miles away. Seeing an official-looking number on your screen is not a credential; it is a costume.

This technique is called caller ID spoofing, and it requires no advanced hacking skills. VoIP-based spoofing services and web interfaces that enable it are widely available to bad actors. Carriers use call-pattern analytics, spam labels, and authentication frameworks like STIR/SHAKEN (a federal call authentication standard) to flag suspicious calls, but these tools are imperfect and far from foolproof. A spoofed government number can still slip through looking completely clean. The most reliable step you can take is understanding that the displayed number proves nothing about who is actually calling, and independently verifying any agency contact using a number from that agency’s official website or a mailed notice.

The Fear Tactics Designed to Short-Circuit Your Judgment

Government impersonation scammers rely on three core psychological levers: urgency, authority, and consequences. In practice, they blend together fast. Urgency sounds like “you must act today or face arrest.” Authority sounds like “This is Agent Thompson, badge number 4471, calling from the Treasury Department.” Consequences sound like “your account will be frozen within the hour.” Rather than deploying these one at a time, callers layer all three inside the first 60 seconds, before you’ve had a moment to question anything.

Here’s what you need to know: no legitimate federal agency will threaten you with immediate arrest, demand same-day payment, or ask you to pay via gift card, wire transfer, cryptocurrency, or prepaid debit card. These are the tells. Any call that includes these demands is a fake government phone call, regardless of how convincing the caller sounds or what number appeared on your screen.

The Agencies They Most Commonly Impersonate

The IRS and Social Security Administration are the most frequently impersonated federal agencies, and FTC Consumer Sentinel Network data consistently puts them at the top of the list year after year. Medicare, U.S. Customs and Border Protection, and the FBI round out the most common targets. Knowing which agencies get impersonated most often helps you recognize the pattern instantly, because the script rarely changes much between callers.

What Should I Do If I Get a Fake Government Call, Immediate Steps

Hang Up Without Explaining Yourself

The single most important action you can take is also the simplest: end the call. You don’t owe the caller an explanation, a polite goodbye, or a chance to respond. Simply hang up. Engaging the caller, even to challenge their claims or call them out as a fraud, keeps you on the line and gives them more opportunities to pressure you.

According to IRS and SSA guidance, legitimate government agencies will not penalize you for hanging up and verifying a call through official channels. If there is a real issue with your taxes or benefits, it will still be there after you hang up. The scam only works if you stay on the line.

What Never to Do During the Call

Do not confirm your name, date of birth, or the last four digits of your Social Security number, even if the caller frames it as “just verifying your identity.” Do not agree to call them back at a number they provide, and do not stay on the line while you “look something up” or “check your records.” Scammers are skilled at using small confirmations to build a partial profile or to establish just enough trust to push for payment or more sensitive data.

Any caller who resists letting you hang up and verify through official channels is telling you exactly who they are. A real government employee will direct you to the agency’s official contact information; a scammer will insist you stay on the line or call only the number they gave you. That resistance is the tell.

Document Everything Immediately After Hanging Up

As soon as the call ends, write down everything you remember before doing anything else. Memory degrades fast under stress, and you’ll need these details for every report you file. Capture the date and time of the call, the number shown on your caller ID, any name or badge number the caller gave, the agency they claimed to represent, the exact demands they made, and any consequences they threatened.

Keep this documentation somewhere accessible. You’ll reference it when you file with the FTC, when you call a relevant agency’s watchdog, and potentially when you contact local law enforcement. Five minutes of note-taking now saves hours of frustration later.

How to Verify If the Call Could Actually Be Real

The One Rule: Find the Number Yourself

Real government contact is verifiable, but only through contact information you locate independently. Go to the agency’s official .gov website or look at any paper notice you already received in the mail, then call that number directly. For the IRS, the main line for individual taxpayers is 800-829-1040; you can also log in to your IRS Online Account at IRS.gov to check whether any notices or account issues are actually on file. For Social Security inquiries, use the contact information listed at SSA.gov.

Never call back a number the suspicious caller gave you, and never use a number from a text or email they referenced. If you need to look something up online, go directly to the agency’s official .gov site, not a search result that could surface fraudulent pages. The only numbers worth trusting are ones you found through a .gov website or a mailed government notice.

What Real Government Contact Actually Looks Like

The IRS almost always contacts taxpayers first by mail, not phone. The SSA may call, but will never threaten arrest or demand immediate payment. No federal agency will ask you to pay a debt using gift cards, wire transfers, cryptocurrency, or prepaid debit cards, and that rule holds without exception. If the caller’s story doesn’t hold up against even one of these benchmarks, the call was a government impersonation scam.

How to Report the Fake Call to the Right Agencies

Start With the FTC at ReportFraud.ftc.gov

Go to ReportFraud.ftc.gov, click “Report Now,” and select “Impersonator” as the scam category. Enter the details you documented: the caller ID number, any callback number they gave you, the agency they claimed to represent, the exact demands made, and whether any money or personal information was shared. Save the confirmation number you receive when the report is submitted. The FTC uses these reports to identify fraud patterns and pursue enforcement, so your report has real value beyond your own situation. Learning how to report a scam call correctly ensures your information actually reaches investigators.

Report to the Agency-Specific Watchdog

For IRS impersonation calls, report to TIGTA, the Treasury Inspector General for Tax Administration, which specifically investigates IRS impersonation fraud. You can reach TIGTA’s hotline at 800-366-4484. For Social Security impersonation calls, the correct reporting body is the SSA Office of Inspector General fraud hotline at 1-800-269-0271, staffed Monday through Friday from 10 a.m. to 2 p.m. ET; you can also file online through the SSA OIG’s fraud reporting form.

Have your documented call details ready when filing either report: the name the caller used, the number displayed on your caller ID, the date and time, and exactly what was demanded. These specifics are what allow investigators to connect your report to patterns they’re already tracking.

When to Also File With the FBI’s IC3

If you lost money or were coerced into making a payment, file a complaint at IC3.gov, the FBI’s Internet Crime Complaint Center. The IC3 handles financial fraud tied to phone scams, and a report there creates a federal fraud record that can support recovery efforts. Contact your local law enforcement as well if threats were made or if you need an official police report for insurance or banking purposes.

If You Already Gave Them Something, Do This Right Now

If You Shared Info: Call Your Bank and Card Issuers First

If you shared any account numbers, routing numbers, or card details, call your financial institution immediately. Use the number printed on the back of your card or on a prior statement, both are safe options. Avoid using a number from a search result, since fraudulent pages can surface for even major banks; stick to your physical card or a prior statement you already have on hand. Report the contact as fraud, ask the institution to flag the account, and request that any unauthorized transactions be reversed. Ask whether the account or card number needs to be replaced entirely. Minutes matter here.

Freeze Your Credit With All Three Bureaus

If you shared your Social Security number, date of birth, or other identity details, place a credit freeze with all three major bureaus right away. A freeze is free and blocks new credit from being opened in your name. Contact Equifax at 1-888-378-4329, Experian at 1-888-397-3742, and TransUnion at 1-888-909-8872. You must contact each bureau separately, and online or phone requests are typically processed within one business day.

According to FTC guidance, a credit freeze is one of the most effective single actions you can take against identity theft after a data exposure. Save the confirmation PIN or account login each bureau provides so you can lift the freeze later if you need to apply for legitimate credit. Set up fraud alerts as a secondary layer of protection on top of the freeze.

File an Identity Theft Report at IdentityTheft.gov

The FTC’s IdentityTheft.gov walks victims through a personalized recovery plan based specifically on what information was exposed. It generates an official Identity Theft Report that banks, credit bureaus, and other agencies will recognize and act on. If passwords were shared in the call, change them immediately across every account that uses the same credentials, and enable two-factor authentication wherever possible. Don’t wait on this step, credential reuse means one exposed password can unlock multiple accounts fast.

Keep This Phone Scam Checklist Ready Before the Next Call Comes

Download The Digital Resistance Government Scam Response Checklist

The Digital Resistance has put together a free downloadable Government Scam Response Checklist, a single-page reference covering exactly what to do in the first five minutes, what to document, and which agencies to contact. Keep it somewhere you can find it in seconds: print it, screenshot it, or drop it in your notes app. You don’t need to memorize this entire guide; you just need to know where that checklist lives when the call comes in.

Set Up Your Phone to Screen Suspicious Calls Before They Reach You

Enable built-in spam filtering on your phone. Both Android and iPhone have built-in options to label or silence calls from unknown numbers, and your carrier likely offers a call-labeling or blocking service as well. Setting unknown callers to go directly to voicemail is one of the most underused and effective filters available. According to FCC consumer guidance, legitimate agencies leave messages with callback information and reference numbers, scammers typically don’t, because a voicemail gives you time to think, and time is exactly what they don’t want you to have.

You Now Have a Plan

Now you know what to do if you get a fake government call: hang up immediately, document everything while the details are fresh, verify through official .gov numbers you find yourself, and report to the FTC at ReportFraud.ftc.gov plus the relevant agency watchdog. If anything was shared, call your bank, freeze your credit, and file at IdentityTheft.gov without delay. Government impersonation scams count on panic, and a plan is what takes panic off the table.

The scam works on fear. The fix is a plan.

Grab The Digital Resistance Government Scam Response Checklist and keep it somewhere you can find it in 10 seconds. Because the next call is coming, and now you’re ready for it.

Why scammers target Social Security specifically

Most adults in the United States either hold a Social Security number or are connected to someone who receives benefits. Whether you receive payments yourself, hold an SSN, or have a parent or spouse who depends on monthly checks, the SSA touches your life in some way. Scammers exploit that near-universal connection to create instant relevance. The goal is to make the threat feel personal before you have time to question it.

The emotional trigger is precise: a threat to your benefits or your freedom. The combination of a benefit threat and an arrest warning is not accidental, it is a tested script designed to bypass critical thinking and push you into compliance within seconds of answering the phone. That combination works because most people don’t know what the SSA is and isn’t permitted to do.

The multi-channel playbook fraudsters are running in 2026

The scam rarely arrives through one channel anymore. Victims often receive a text or WhatsApp message first, followed by a phone call, and sometimes a follow-up letter that appears to be official correspondence. Each channel reinforces the others, building a false sense of legitimacy through repetition. Researchers note that this cross-channel reinforcement wears down skepticism in a way that a single cold call never could.

Fraudulent emails in 2026 campaigns have included HTML attachments that open fake SSA portals asking for login credentials. Fake postal letters have claimed data breaches requiring recipients to email sensitive documents to “update” their records. Social media direct messages impersonating the SSA have requested payment information outright. The delivery method changes; the underlying pressure does not.

The Three Tactics Fraudsters Rely On Most

Benefit suspension threats and fake arrest warnings

The most common script goes something like this: a caller identifying themselves as an SSA agent tells you that your Social Security number has been “suspended” due to suspicious activity or an unpaid debt, and that law enforcement will arrest you unless you act immediately. Real scam call transcripts include phrases like “your Social Security number has been suspended for suspicion of illegal activity” and “if you do not contact us, your account will be deactivated.” That language is designed to terrify, not inform.

This script targets two fears at once, financial loss and legal jeopardy. It works because most people don’t know what the SSA is and isn’t permitted to do. Here’s the reality: the real SSA will never threaten arrest over the phone, and Social Security numbers cannot be suspended. When a caller says otherwise, you are speaking to a fraudster.

Fake SSA agent calls with spoofed caller ID

SSA impersonator scams use Voice over Internet Protocol systems to display any number they choose on your caller ID, including the real SSA customer service line at 1-800-772-1213. When that number appears on your screen, it looks like a legitimate government call. According to SSA guidance, fraudsters may also use real SSA employee names to add another layer of credibility, which is exactly why caller ID and a name alone cannot confirm the identity of the person on the line.

Federal programs like STIR/SHAKEN work to reduce caller ID spoofing, but they don’t eliminate it, especially through less-regulated VoIP paths. The practical takeaway is straightforward: a convincing caller ID proves nothing. Your response to any unsolicited SSA call should always be to hang up and verify through a number you look up yourself.

Gift cards, cryptocurrency, and wire transfers as payment demands

When a scammer asks for payment, they push specific methods: gift cards from major retailers, cryptocurrency transfers, wire transfers, prepaid debit cards, and mailed cash. These methods share one critical characteristic, they are nearly impossible to trace or reverse once completed. That is not a coincidence. It is the reason scammers insist on them even when a target pushes back.

The real SSA will never, under any circumstances, ask you to pay a debt, resolve a problem, or restore benefits using gift cards or cryptocurrency. If a caller directs you to purchase gift cards and read the numbers over the phone, you are being robbed in real time. Hang up immediately.

Red Flags That Give Every Social Security Scammer Away

The exact phrases and pressure tactics that reveal fraud

Scam calls and messages use a recognizable set of linguistic tells. Watch for phrases like “your benefits will be suspended today,” “you must act before 5 p.m.,” “do not hang up,” and “this is your final notice.” The urgency is manufactured, because a real government agency sends written notices and gives you time to respond through official channels.

A practical rule worth memorizing: any contact that presents a problem, sets a hard deadline, and demands an unusual payment method should be treated as a scam until proven otherwise. That three-part pattern is the clearest signal a contact is fraudulent. No legitimate government communication requires you to buy gift cards to fix your account.

What the real SSA will never do

These are the SSA’s own stated policies, not opinions. The SSA will not demand immediate payment, threaten arrest or legal action for nonpayment, or ask for payment by gift card, cryptocurrency, wire transfer, prepaid debit card, or mailed cash. It will not send unsolicited emails with attachments asking for login credentials. It will not contact you through WhatsApp, social media direct messages, or personal text threads.

If a caller claims to be from the SSA and does any of those things, the call is fraudulent. Knowing this removes the uncertainty that scammers depend on. You no longer have to wonder whether to comply, the answer is always no.

How to Verify Whether an SSA Contact Is Actually Real

Simple steps to confirm a legitimate SSA communication

Hang up or ignore the message. Do not click any link and do not call back any number given to you by the suspicious contact. Go directly to ssa.gov or call the real SSA hotline at 1-800-772-1213, using the number you look up independently, and ask whether there is any issue with your account. If a message claims there’s an urgent problem, contacting the SSA directly will quickly confirm whether that’s true.

Initiating the contact yourself through a verified channel breaks the scam, because fraudsters depend entirely on keeping you inside their pipeline. The moment you hang up and verify through official sources, their leverage disappears.

Where The Digital Resistance fits in

The Digital Resistance is a resource hub for Americans who want clear answers about scams and digital threats without wading through technical jargon. The site includes plain-language guides on government impersonation scams, including SSA and IRS fraud, along with resources on how to flag and report suspicious contacts. It functions as a community-driven safety net, not a product, because protecting people from fraud works better when communities share knowledge together.

What to Do Right Now If You Were Targeted or Shared Your Information

If you haven’t shared anything yet

If you recognized the scam before giving anything up, hang up or delete the message, block the number or sender, and don’t respond. No personal data was exchanged at this stage, but reporting the attempt still matters. The FTC and SSA OIG use data from even failed scam reports to track active campaigns, identify patterns, and issue public Social Security scam alerts.

If you already gave out your SSN or financial details

Act within the first 24 to 48 hours. Speed matters here, the faster you move, the more limited the damage. Work through these steps in order:

1. Freeze your credit with all three major bureaus separately. Equifax: 1-800-525-6285 orequifax.com. Experian: 1-888-397-3742 orexperian.com. TransUnion: 1-800-680-7289 ortransunion.com. A freeze blocks most new credit accounts from being opened in your name and is free by law.

1. Visit IdentityTheft.govto file an identity theft report and receive a personalized recovery plan, including the letters and forms needed to dispute any fraudulent accounts.

1. Call the IRS Identity Protection Hotline at 1-800-908-4490 if your Social Security number could be used to file a fraudulent tax return.

1. Contact your bank and financial institutions to flag potentially compromised accounts.

1. Change passwords on your email and financial accounts from a clean device.

Where and How to Report a Social Security Scam

Reporting to the SSA OIG and the FTC

The SSA Office of Inspector General is the primary agency for reporting Social Security fraud. File a report online at oig.ssa.gov or call the OIG fraud hotline at 1-800-269-0271 (Monday through Friday, 10 a.m. to 2 p.m. Eastern). When you report, include the source of the contact, the content of the message, any phone numbers or website links involved, and screenshots or copies of any text, email, or mail you received. The more detail you provide, the more useful your report is to investigators.

The FTC handles broader fraud reports at ReportFraud.ftc.gov. Even if you didn’t lose money, submitting a report matters. The FTC’s Consumer Sentinel database pulls data from millions of individual reports to identify patterns, map scam campaigns, and support law enforcement actions. A report you file today may protect someone else next week.

Local law enforcement and follow-up steps

If money was lost or accounts were opened fraudulently in your name, file a report with your local police department. Some credit dispute and identity recovery processes require a police report or FTC report as supporting documentation. Keep copies of everything, confirmation numbers from credit bureaus, agency reference numbers, and any correspondence with financial institutions.

Reporting is not just about your individual case. When communities share information about scam attempts, including ones that didn’t succeed, they build a collective defense. That’s the core principle behind The Digital Resistance: protecting people from fraud works better as a shared effort than as a solo one.

You Now Have the Advantage

Social Security scams are built on a simple assumption: that you don’t know the SSA’s actual policies. Now you do. The real SSA never threatens arrest, never demands gift cards or cryptocurrency, and never contacts you through WhatsApp or personal text messages. When something feels off, hang up and verify through official channels. That single habit dismantles the scam before it can cause harm.

Staying informed is your most effective defense against this kind of fraud. Visit The Digital Resistance for ongoing plain-language guides on how to protect Social Security benefits, recognize government impersonation scams, and navigate the full range of digital threats targeting everyday Americans. Use them. Sharing what you know is one of the most effective things you can do.

Frequently Asked Questions About Social Security Scams

What is a Social Security scam alert and how do I recognize one?

A Social Security scam alert is an official warning issued by the SSA or FTC about active fraud campaigns targeting Americans. You can check for current alerts at ssa.gov/antifraud. In general, any unsolicited contact, by phone, text, email, or mail, claiming your benefits are suspended or that you face arrest is a scam. The real SSA contacts you primarily by mail and never demands immediate payment.

How do I report a Social Security scam?

Report Social Security scams to the SSA Office of Inspector General at oig.ssa.gov or by calling 1-800-269-0271. Also file a report with the FTC at ReportFraud.ftc.gov. If you lost money or your identity was compromised, contact local law enforcement and visit IdentityTheft.gov for a step-by-step recovery plan.

Can a Social Security scam affect my benefits if I don’t respond?

No. Ignoring a scam call, text, or email has no effect on your actual Social Security benefits. Your benefits are managed exclusively through the SSA’s official systems, and a scammer has no ability to alter or suspend them. If you’re concerned, call the SSA directly at 1-800-772-1213 to confirm your account status.