The warnings are everywhere these days. Don’t click this. Don’t open that. Don’t scan this. Don’t download that. These messages of caution, however well-intended, are so ubiquitous and constant that it should come as no surprise that people—some people anyway—have started to ignore them.
How many people? About one in three, according to a recent study by the cybersecurity company Malwarebytes.
But this is exactly the wrong time to stick one’s head in the proverbial sand, and here’s why:
Even as some people seem to be lowering their guard, scammers are finding new ways to target them. If this were a war—and in many ways, it is—the primary theater of battle is mobile.
Phones give scammers multiple ways to target people, from text messages and calls to social media posts. According to a 2022 Federal Communications Commission report, texting is a more common communication method than voice or email.
Criminals appear to be taking advantage of that fact. Consumers lost $470 million to text scams in 2024, up 26% from $373 million the year before and five times the amount reported in 2020. The FTC cites estimates that text message open rates run as high as 98%, compared to just 20% for email. People’s tendency to open and read their texts helps explain their appeal to scammers.
Meanwhile, AI is making scams harder to detect, but better at stealing money, passwords, and identity.
Voice phishing was a vanishingly small category of crime just a few years ago, but AI has made it considerably more convincing. AI-synthesized audio fraud doubled in the first half of 2026, according to CrowdStrike's 2026 Threat Hunting Report. Meanwhile, 16% of adults in the Malwarebytes survey said they had received a voice-cloned phone call impersonating someone they knew in the past year.
The Malwarebytes data show how effective these attacks are becoming: 85% of people now say it’s hard to tell a scam from the real thing, up from 66% a year ago. Eighty-four percent say convincing video evidence no longer suffices as the kind of rock-solid proof it once was.
Here are five ways to protect yourself:
Reported losses to text scams in 2024 were more than five times the amount reported in 2020, reports the FTC, likely because people tend to open and read text messages. But legitimate institutions generally know better than to ask for payment or personal information through unsolicited texts. And if the message is marked “urgent,” all the more reason to bin it. Instead, go directly to the company’s official website and inquire there.
This is one of the most effective things you can do to keep your phone safe. Security updates patch vulnerabilities that malware takes advantage of. Malwarebytes’ threat research found Android malware detections rose 151% in the first half of 2025. On both iPhone and Android, automatic updates help decrease risk.
AI-generated images and videos are making it harder to tell what’s real online. If a video, photo, or social media post asks you to send money, click a link, or share personal information, don’t rely on what you see as proof that it’s legitimate. If it appears to come from a company or organization, go directly to its official website or app to verify the information. If the content involves someone you know, contact them directly to make sure it’s really them.
This is the hardest one to get your head around, but also one of the most dangerous and fastest-growing. AI-synthesized audio fraud doubled in the first half of 2026. Agree on voice passwords with family members and friends in case of doubt or emergency. If the caller is a bank, for example, hang up and call back on a number you look up independently.
Fraudsters place fake sticker overlays on top of legitimate QR codes. Palo Alto Networks’ Unit 42 said it detects more than 11,000 malicious QR codes per day. A legitimate QR code, at a parking meter, for example, is printed directly onto the housing or protected under laminate. A peelable sticker placed over the original spells trouble. (This scam is morphing so fast that the FBI issued an alert in January about North Korean hackers using QR codes to target think tanks and government officials.) If you’re out of options, don’t scan. Instead, manually enter the organization’s web address.
One final bonus piece of advice — turn on two-factor authentication, also called 2FA, for all your apps that allow it. This one step makes it harder for criminals who have your information to gain access to accounts on your phone.
This story was produced by Malwarebytes and reviewed and distributed by Stacker.
