The news stories appear with alarming frequency and increasing variety: A professional loses thousands of dollars after an account hack; a real estate investor approves altered wiring instructions that funnel payments to a strange account; a grandparent sends money to a “good Samaritan” claiming to help a grandchild out of a jam; bad actors pretending to be law enforcement convince a retiree to hand over cash, gold, gift cards or cryptocurrency to avoid prosecution for made-up crimes. What do the examples have in common? The use of deception to prompt victims to provide key information and ultimately steal their money—sometimes in substantial amounts.

Supercharged by connectivity and new artificial intelligence capabilities, online fraud incidents are accelerating rapidly. According to the FBI, last year saw $20.9 billion in reported U.S. losses, up 26% from $16.6 billion in 2024. Of these, victims over 60 accounted for $7.7 billion, up 60% in a single year.

What accounts for the acceleration? In part, it’s a function of our current “online, all the time” culture, where many interactions—business and personal—take place electronically and without the natural slowing influences of manual paperwork and bureaucratic inertia. It has also been supported by advances in artificial intelligence, which is maximizing scammers’ speed of operation and making it harder to detect potential fraud attempts. Finally, it reflects a new marriage of technology and personal touch to capitalize on individual personal vulnerability.

Understanding the Trends

Amid the surge in fraud attempts, their nature and emphasis have changed significantly:

Shifting economics. Although companies have historically been the main focus of attacks, fraudsters have found that it can be more cost-efficient to target individuals. Meanwhile, the old “tells” of an email phishing attack are largely gone; typos, bad grammar and the use of a wrong logo, to name a few examples, can all be fixed almost at no cost by AI. Worse, the messages are now often tailored, because AI can assemble an array of information about a given person very quickly. To judge its authenticity, you can no longer rely on the fact that a message sounds real or that the sender knows where you went to college or where you vacationed last week.

Focus on the person. Criminals have recently shifted their focus from breaking into devices to gaining access to your accounts or persuading you to move the money yourself. The reason? It is far cheaper to convince you to make a transfer than to compromise your device and then figure out how to steal from you. What this means is that digital levers often do not constitute the attack, but rather the research and preparation that can make the attack successful. Through digital reconnaissance, criminals can build a sophisticated con—with an array of actors pretending to be, for example, a bank’s fraud department, a federal agent or a courier to pick up payment. While entry may come through digital means, the actual attack may rely on personal manipulation—an ironic twist in a technological era.

Stepping back, the net result is an environment where fraud can come from an array of angles, often via emails, texts and data theft, but also through more traditional means. The list below shows the sheer variety of threats to watch for.

What to Do

What can you do to protect yourself online and elsewhere? We’ve covered cybersecurity in the past,¹ and the good news is that many of our previous suggestions remain worthwhile. Keeping your computer software updated, using multifactor authentication, making passwords (and ideally passphrases) complex, being cautious about what you share online, avoiding clicking on strange email links, pausing before moving ahead with any “urgent” financial request, independently verifying communications from financial providers and more all make sense. However, given the technological advances and increasingly aggressive nature of fraudsters, there are some ideas we want to emphasize:

Limit your AI ‘attack surface.’ There’s a lot to like in AI, but to get the most out of it, people often input very personal financial information—from illness to tax details—and don’t worry about the impacts. Unfortunately, AI capability can outpace the tools that protect it; if you don’t want something to be retained somewhere else in the world, and then improperly used by others, don’t put it into AI.

Another issue relates to the authority you provide to AI agents to assist you in daily tasks. Such agents are often unable to distinguish your instructions from those that may be hidden by scammers in materials (such as emails) that they read on your behalf, and may even act upon them if allowed. The takeaway? Treat an AI agent as a capable but naïve assistant with no instinct for fraud. Research and drafting may be useful, but avoid giving the agent credentials on financial accounts or permission to complete payments without your review.

Verify communications independently, never through the channel where they arrived. Even if you think a communication is real, you should not interact with the email, text or phone number you were provided in the initial outreach, but go to the official source. For example, if you receive a call saying that your credit card was compromised, hang up and call the number on the back of the card. If a financial firm contacts you, go to its website and call the number shown there. Financial firms are frequently impersonated—fake offerings on social media, counterfeit websites, realistic documentation—and it often only comes to light after someone has an issue.

Create a safe word. This is a fix that parents often teach their children in a different context: “If a stranger shows up at school pickup saying your mother’s been in an accident, they have to know the word or you don’t get into the car.” That exact technique is now a defense against deepfakes. If someone claims to be a relative, but does not know the safe word, you should hang up. It may seem childish, but the technique works; AI can clone the voice, but won’t know the secret word. Never text that word or write it down.

Be wary of deepfake video and audio. AI can now clone a voice or face convincingly, so seeing or hearing someone is no longer proof of who they are. Be suspicious of any call or video meeting that presses you to send money, share account details or keep a request secret, even if the person looks and sounds right. Don’t count on spotting visual glitches; instead, hang up and call back on a number you trust, confirm information through a second channel and use your family safe word. Report any deepfake of you or a loved one to the platform involved and to the FBI at ic3.gov.

Assume your information is already out there. People don't like hearing this, but given the volume of breaches, you should assume that everything about you is effectively public. Many information-broker sites legally aggregate your addresses, phone numbers and relatives, but most offer removal. You can pay a service to take care of this or do it yourself, but the information may reappear online after the next breach. A better approach, in our view, is to spend your time securing what your information would be used to access—i.e., your accounts.

Freeze your credit. Widespread access to your information leads to another key point. In our view, everyone’s credit should be frozen via the credit bureaus (see “Resources”). This is free, and makes it very hard for anyone to open new credit in your name without the required credentials. Should you need to do so, you can un-freeze your credit temporarily, and then re-freeze it when the process is over.

Lock your SIM card. Major carriers typically offer what may be called a number lock, port lock or SIM lock—all help prevent your phone number from being moved to another SIM or carrier without your approval. This takes just a few minutes and adds an important layer of protection to any account that sends verification codes by text.

Email is your most valuable account. It’s where statements and notifications pile up, so it becomes the blueprint for everything you hold. It’s also the recovery path for every other account. Stockpiled emails are a vulnerability, but probably not worth all the time and energy needed to empty them. Search out the few things that could actually hurt you—tax documents, statements, anything with a Social Security or full account number—and move them out of your inbox to a secure location on your computer or offline. Then use a separate email address for financial accounts. Be sure to give your email account the strongest login protection you have and assure that you have the ability to recover it should something go wrong.

Device security still matters. Ransomware, where attackers take control of computers and require payment to unlock it, is a sizable industry; you can buy an attack on the dark web, with separate people taking on initial access, deployment and negotiating payment, each taking a fee. The process is largely offshore, in jurisdictions where U.S. law enforcement has limited reach. Although primarily focused on corporations, ransomware can affect individuals. So, keep your software current, leave the security tools enabled and maintain anti-phishing basics: Don’t click on links in unexpected messages, don’t open attachments you weren’t expecting, don’t reply to them and don’t fill in forms on sites you reached by clicking on something.

Keep passwords strong. As we’ve noted before, passwords need to be complex and different for every account, particularly when it comes to email and financial accounts. And in our view, password managers (aggregating all your passwords in one secure application) are still worth the trouble: They now can store your passkeys, too, which can make them work across different device brands. At the same time, keep your recovery or backup codes in a safe physical location so you can avoid getting locked out of accounts.

Protect your family. This is an article in itself, but the key point is to address the unique vulnerabilities of family members. Aging parents may benefit from a trusted contact whom providers can consult in the event of concerning activity; duplicate statements, read-only access for family members, and in some cases, a power of attorney may be appropriate. Children should be educated about the dangers of online activity; and, in general, the family should make it a practice to engage in digital “hygiene,” securing home networks, using effective passwords and limiting information provided on social media. Security should extend to vendors like an accountant or travel agency: Make sure that they engage in safe practices and that your communications of sensitive information are secure.

Conclusion: Building the Right Defenses

The task of securing your finances and identity involves compromises. It’s more convenient to simply click on a link than call a financial institution first; it’s easier to let your emails sit exposed than to cull them of sensitive information; and it’s simpler to keep your credit active than to freeze it with multiple credit bureaus. But all of these steps have incremental benefits that help insulate you and your family from bad actors, as can maintaining healthy caution and good digital habits generally. Of course, there’s always the chance that you will fall victim to a scam. In that case, we would argue that you should never be embarrassed or reluctant to share any issues with your trusted advisors or law enforcement. Such openness can help extricate you from difficult circumstances and hopefully foster more confidence as you navigate the more challenging “threatscape” that we encounter today.

Donna Borgogelli, Head of Supervision, contributed to this article.