Scams don't start with the message. They start with your data.
Modern fraud is an industry. It runs on harvested personal data, automated targeting, and psychological pressure engineered to bypass ordinary caution. This page explains how that machine works, what it costs real people, and the specific habits that break the chain.
- Investment scams
- $5.7B
- Imposter scams
- $2.95B
- Government impersonation
- $789M
- Job & employment scams
- $501M
- Text-message scams
- $470M
Reported U.S. losses, 2024. Job-scam losses grew from $90M in 2020; text-scam losses are five times their 2020 level.
Bank transfers and cryptocurrency together account for more reported losses than every other payment method combined — because both are fast, final, and effectively irreversible.
- Bank transfers
- $2.09B
- Cryptocurrency
- $1.42B
The Identity Theft Resource Center found that at least 196 of 2024's breaches — and more than 1.2 billion victim notices — could have been avoided with basic protections like multi-factor authentication or passkeys. Four of the six largest breaches of the year traced back to stolen credentials that those measures would have blocked.
- Most-reported channel
- Highest median loss
- Phone calls
- Fastest-growing channel
- Text messages
- Largest total dollars lost
- Social media
FTC Consumer Sentinel, 2024. The channel that generates the most complaints is not the one that drains the most money — a reminder that volume and severity are different problems.
Adults in their twenties and thirties report losing money more often than older adults — they are contacted constantly and click quickly. But when an older adult is caught, the amount lost per incident is far larger, so the total dollars stolen concentrate heavily among seniors. Both facts are true at once, and scam scripts are tuned to exploit whichever weakness fits the target.
FTC Consumer Sentinel, 2024.
Collection
Your details leak from more places than you authorize. Breached companies spill credentials and account records. Public records expose property, voter, and court filings. Apps and ad trackers report location and behavior. Quizzes, sweepstakes, and warranty cards harvest answers that double as security questions.
Aggregation
Data brokers merge those fragments into a single dossier: age, current and former addresses, phone numbers, estimated income, purchase history, employer, and mapped family relationships. In the United States there is no comprehensive federal privacy law governing this industry, so these profiles can be bought by nearly anyone.
Segmentation
Profiles get sliced into targeting lists — recent homebuyers, people in financial distress, older adults living alone, holders of specific professional licenses. Criminals buy the segment that best matches the story they intend to tell, then cross-check it against social media to confirm the details are still current.
Weaponization
The message arrives already knowing things about you. It cites a real former address, the name of an actual relative, a genuine recent purchase. That accuracy is the entire point: it converts a generic phishing attempt into something that feels like a legitimate institution and shuts down the instinct to verify.
Pressure
Once credibility is established, urgency does the rest. A deadline, a threatened arrest, a frozen account, a limited window on an opportunity. The goal is to move you to an irreversible payment before you have time to check with anyone who would tell you to stop.
Knowing your address, your bank, or your mother's maiden name proves nothing about who is contacting you — that information is for sale. Treat accurate personal details as a neutral fact, never as proof of legitimacy. Verification has to come from you reaching out through a number or address you looked up independently.
Not every profile contains every field — but each one that is present makes the eventual message more convincing.
The United States has no comprehensive federal privacy law governing data brokers, and hundreds of them compete to sell the same records. In bulk, a detailed profile can change hands for a fraction of a cent. The economics are the whole problem: when your information costs almost nothing to acquire, criminals can afford to contact millions of people to find the few who respond.
Cutting off that supply is more durable than dodging individual messages — see our privacy partners for bulk broker removal.
Fake package delivery
A carrier — usually "USPS" — reports a problem with a delivery and asks for a small redelivery fee. The payment page exists to capture your card number and, often, your Social Security number.
A real carrier will not text you a payment link over a few dollars.
Task and job scams
Easy remote work rating products or "optimizing" listings. Small earnings appear on a dashboard, then you are told you must deposit your own money to unlock the next tier or withdraw a balance.
No legitimate employer requires you to pay in order to get paid.
Fake fraud alerts
A warning about a suspicious charge from your bank or a large retailer, followed by a call from a "fraud department" that instructs you to move your balance to a safe account for protection.
No bank will ever ask you to transfer money to keep it safe. That instruction is the scam.
Bogus toll notices
An unpaid balance from a tolling program you may genuinely use. The link goes to a convincing clone built to harvest card and identity details.
Go to the tolling agency site you already know. Never use the link in the message.
"Wrong number" openers
A friendly misdirected text. The conversation continues over days or weeks, sometimes turning romantic, before pivoting to a crypto or trading platform where the balance can never be withdrawn.
A stranger who reached you by accident and later mentions investing is running a script.
Impersonated authority
Government impersonation alone accounted for $789M in reported losses in 2024. Agencies, utilities, and police are all impersonated, usually with a threat attached.
Federal agencies do not demand payment by gift card, wire, or crypto — and do not threaten immediate arrest by phone.
Romance and "pig-butchering"
A warm relationship builds over weeks on a dating app or social platform, then the new partner introduces a can-not-miss crypto or trading opportunity on a platform that shows fake gains until you try to withdraw.
A romantic interest you have never met in person who steers you toward any investment is running the longest, most lucrative con there is.
Tech support and account lockout
A pop-up, email, or call warns that your computer is infected or your account is compromised. "Support" asks for remote access or has you read out codes, then empties accounts while you watch the screen.
Real companies do not cold-call about a virus, and no support agent needs remote control of your device to fix an account.
Family emergency and voice cloning
A panicked call or message from a grandchild, child, or friend in trouble — an accident, an arrest, a stranded trip — needing money wired immediately. A few seconds of audio scraped online is now enough to clone the voice.
Hang up and call the person back on their real number. Agree a family code word that never appears online for exactly this moment.
Payment-app "accidental" transfer
Money lands in your Zelle, Venmo, or Cash App account "by mistake," followed by an urgent request to send it back. The original funds are stolen and get clawed back, leaving your real money gone.
Do not return money you did not expect. Report it to the app and let them reverse the original transfer.
Different costumes, one script: unsolicited contact, a story that explains why you must act right now, and a push toward a payment you cannot reverse. Recognize the shape and the specific disguise stops mattering.
What victims report feeling
Global survey of 21,000 adults, LSEG. Researchers note the severity of the psychological response tracks the sense of betrayal and manipulation more closely than the size of the financial loss.
Why the real numbers are worse
- Most fraud is never reported. The FTC states plainly that reported losses represent a fraction of the true total. Shame and self-blame are a documented barrier to coming forward.
- Older adults report least. Only about 21% of reports filed by people aged 80+ mention a loss at all — the lowest of any group — yet their median loss is the highest. The gap is under-reporting, not safety.
- The harm outlasts the transaction. Clinical literature links fraud victimization to sustained anxiety and depression, with the loss of trust in institutions and in one's own judgment persisting well after any money is recovered.
- Being hit once marks you. Victim details circulate. Follow-up "recovery" offers that promise to retrieve lost funds for an upfront fee are a well-documented second wave aimed at the same people.
If this has happened to you: falling for one of these is not a failure of intelligence. These scripts are refined against millions of targets and designed specifically to defeat careful people by manufacturing time pressure. The single most useful thing a victim can do — for themselves and for everyone else — is report it.
The second wave: recovery scams
Once someone has been defrauded, their details are resold on so-called sucker lists. A new contact then appears — posing as a lawyer, a government recovery unit, or a private investigator — promising to retrieve the lost money for an upfront fee. It is the same crime aimed at the same person a second time, and it works precisely because the victim is desperate to undo the first loss.
The cost that is never invoiced
Beyond the dollar figure sits a second ledger nobody totals: lost sleep, strained marriages and friendships, a corrosive distrust of ordinary phone calls and emails, and the hours family members spend cleaning up the aftermath. For older adults, a single incident can trigger a loss of independence when relatives conclude they can no longer manage money alone.
Lock the account layer first
- Turn on passkeys or an authenticator app everywhere they are offered — email and banking first. This is the single highest-value change you can make; it would have prevented over a billion breach notices in 2024 alone.
- Avoid SMS codes where you have a choice. They are better than nothing but vulnerable to SIM-swap attacks.
- Use a password manager so every account has a unique password. One reused password turns any single breach into a breach of everything.
- Lie on security questions and store the answers in your manager. Your mother's maiden name and your first street are both purchasable.
- Protect the email account hardest. It is the reset key to everything else you own.
Put friction on the money
- Freeze your credit at all three bureaus. It is free, it is reversible in minutes, and it blocks new accounts being opened in your name.
- Treat any request to move money to a "safe account" as fraud. Without exception. No real institution does this.
- Refuse gift cards, wires, and crypto as payment to anyone who contacted you first. These are chosen precisely because they cannot be reversed.
- Verify out of band, always. Hang up and call the number on your physical card or the official site you typed in yourself — never a number from the message.
- Set up transaction alerts so unexpected movement reaches you within minutes rather than at month end.
Shrink what is available about you
- Opt out of data brokers. This attacks the supply chain rather than the symptom. Removal can be done manually broker by broker, or through a service that handles it in bulk — see our privacy partners.
- Use alias emails and masked numbers for signups, so a breach at one merchant cannot be linked back to your real identity.
- Delete accounts you no longer use. Dormant accounts still get breached and still hold your data.
- Audit app permissions — location and contacts especially. Much of the broker supply comes from apps you installed for something unrelated.
- Stop publishing the answers to your own security questions on social media: pet names, schools, birthdays, and the quizzes built to collect them.
Protect the people around you
- Agree a family code word. Voice cloning makes a distressed call from a relative trivially fakeable. A shared word that never appears online settles it in one question.
- Establish a "call me before you send anything" rule with older relatives. Removing the pressure to decide alone defeats the core tactic.
- Add a trusted contact to their bank account — most banks offer this, and it lets staff raise concerns before a transfer completes.
- Make it safe to say it happened. Reacting with blame guarantees the next incident stays hidden until it is much larger.
- Talk about specific playbooks, not vague warnings. "The bank will never ask you to move money" is actionable; "be careful online" is not.
Harden your devices and messages
- Turn on automatic updates for your phone, computer, and browser. Most exploited flaws are ones a patch already fixed.
- Enable free spam and scam filtering from your carrier and messaging apps. It quietly removes a large share of attempts before you ever see them.
- Never tap links in unexpected messages. Type the address yourself or use a saved bookmark — the link in the message is the part built to deceive you.
- Lock your SIM with a carrier PIN. It is the simplest defense against a SIM-swap that would hand an attacker your text codes.
- Check a suspicious link or message first. Paste it into our scanner before you act on anything that pressures you.
The ten-second check, before you click or pay
Unsolicited contact reverses the burden of proof. If they reached you, assume nothing they claim about their identity is true until you verify it independently.
Manufactured urgency is the most reliable single indicator of fraud. Legitimate organizations can wait while you check.
Wire, crypto, gift cards, or a transfer to a new account. Any pressure toward these is the moment to stop entirely.
Any single "yes" is reason enough to stop and verify. Two is reason to walk away.
Guides for the scams people ask about most
Each guide breaks down one type of scam — the warning signs, how to protect yourself, and a one-tap way to check a suspicious link, text, email, or message.
Phishing Link Checker
Check any suspicious link for phishing, malware, and fake login pages before you click.
Scam Text Checker
Paste a suspicious text or screenshot and find out instantly if it is a scam.
Scam Email Checker
Paste a suspicious email or its links to check for phishing, fraud, and impersonation.
Website Checker
Paste a web address to check whether an online store or site is legit or a scam.
Crypto Scam Checker
Check suspicious investment offers, crypto platforms, and "guaranteed returns" for fraud.
Job Scam Checker
Check suspicious job offers, recruiter messages, and work-from-home tasks for fraud.
Tech Support Scam Checker
Check fake virus pop-ups, "Microsoft/Apple" alerts, and support numbers for fraud.
Senior Scam Protection
A guide and checker for the scams that most often target older adults and their families.
What to do in the first hour
Speed matters most at the beginning, and the order below reflects that. Do not spend time deciding whether it was "bad enough" to report.
Do not send one more payment, including any fee framed as necessary to release or recover your funds. That is the follow-up scam.
Use the number on your physical card. Recent transfers can sometimes be recalled, but the window is short.
Start with email, then banking. Enable passkeys or an authenticator app while you are there.
Equifax, Experian, and TransUnion. Free, and it stops new accounts being opened in your name.
Where to report it
Reporting rarely recovers money on its own, but it is how patterns get detected and how cases get built. Report even if you lost nothing — attempts are useful data.
Federal Trade Commission — the primary U.S. reporting channel for any scam or attempted scam.
FTC — generates a personalized recovery plan if your identity or SSN was exposed.
FBI Internet Crime Complaint Center — for internet-enabled crime, especially larger losses.
The official free source for your credit reports — check for accounts you did not open.
833-372-8311 — U.S. Department of Justice case managers who assist adults aged 60+ and their families through the reporting process.
When something feels off, check it before you act
Paste the message, email, or link into Spidanest and get a threat score with a plain-English breakdown of exactly which signals were detected and why they matter. Verifying takes seconds. Recovering does not.
Sources
- Federal Trade Commission — Consumer Sentinel Network Data Book 2024
- FTC Data Spotlight — Top Text Scams of 2024
- FBI Internet Crime Complaint Center — 2024 Internet Crime Report
- Identity Theft Resource Center — 2024 Annual Data Breach Report
- LSEG Risk Intelligence — global survey of 21,000 adults on the impact of fraud
Figures are as reported by the cited organizations and refer to 2024 unless otherwise stated. Reported losses reflect only incidents that were formally reported and understate actual totals. This page is general education, not legal, financial, or security advice.