Skip to content
The Cyber Security Place

People

Nothing was hacked

Every system worked exactly as designed, and the money is gone. This page is for the person it happened to rather than for the organisation.

Last reviewed August 30, 2026

People reported losing about $15.9bn in a single year, up from$12.5bn — a rise of some 27% — across roughly 3 million reports. Nearly half, around$7.9bn, went to investment scams, while the most reported category was impersonation at about$3.5bn and one report in 3. None of it involves breaking into anything: the systems behave correctly and a person is persuaded to act. The defence is therefore not a product but a habit —end the contact and re-establish it yourself — and the reason it fails is that every one of these attacks is built to make waiting feel unreasonable. Romance approaches now begin on social media around 60% of the time rather than on dating services. And the totals are a floor: they count only what was reported, and shame keeps most of it unreported.

Six that are working right now

Pick one. You will be shown what it says, and the check that undoes it — after a few seconds. The wait is deliberate and it is the whole lesson.

A call from your bank's fraud team

There is a payment leaving your account in the next few minutes. I can stop it if you move the money now.

The state it needs: Urgency, plus relief that somebody is helping.

What it asks for: A transfer to a safe account they will name.

The check: Hang up, wait two minutes, and call the number printed on your card.

What it reveals: No bank asks anybody to move money to a safe account, and the fraud team you were speaking to has no record of the call.

The two-minute wait matters technically as well as psychologically: on some lines a caller can hold the connection open, so redialling immediately can reach them again.

A friend's investment that is doing very well

Small returns first, withdrawable on demand, and a private group of people who all seem to be earning.

The state it needs: Trust borrowed from somebody you know, and the fear of missing out.

What it asks for: Larger deposits, then a fee to release the profits.

The check: Try to withdraw everything, not some of it, before adding another penny.

What it reveals: The withdrawal that worked last month was your own money returned to build confidence. A full withdrawal produces a fee, a delay, or a tax that must be paid first.

This category takes nearly half of all money lost, and the reason is that it does not feel like a scam at any point until the end.

Somebody who understands you

Months of daily conversation, a plausible reason never to meet, and eventually a crisis that money would solve.

The state it needs: Attachment, and a reluctance to insult somebody by doubting them.

What it asks for: Help with a hospital bill, a customs charge, or an investment they are letting you in on.

The check: Ask for a live video call at a moment you choose, not one they schedule.

What it reveals: A reason, then another reason. The refusal is the answer, and it arrives long before any money is requested.

Around three in five of these begin on social media rather than on a dating service, which is why avoiding dating apps is not the protection people assume.

A message from a government office

An unpaid fine, an unclaimed refund or a warrant, with a deadline measured in hours.

The state it needs: Fear of authority, and the sense that a mistake is possible.

What it asks for: Payment by an unusual method, or your identity details to confirm the record.

The check: Look up the office yourself and ring them; never use a number, link or address from the message.

What it reveals: Departments do not demand immediate payment by transfer or gift card, and the reference number in the message does not exist.

The most reported category of all, and the one whose losses have grown fastest, because impersonating an institution now costs nothing to do convincingly.

A warning that your computer is infected

An alarming page that will not close, a telephone number, and a technician who confirms the worst.

The state it needs: Alarm, plus deference to somebody who appears to know more than you.

What it asks for: Remote access to your machine, and then a payment for the repair.

The check: Close the browser entirely — force it if necessary — and see whether anything is actually wrong.

What it reveals: The warning was a web page, not your computer, and it disappears with the tab. Nothing was infected before the call and something may be after it.

Older people are targeted disproportionately for this one, and the damage is often the remote access rather than the payment.

Your child, from a new number

Hello, this is me, I have broken my phone and I need to pay something urgently.

The state it needs: Protectiveness, and the awkwardness of asking your own family to prove who they are.

What it asks for: A transfer, quickly, before you can speak to them.

The check: Call the number you already have for them, or ask something only they would know.

What it reveals: Either they answer on the old number, or the question is deflected. Deflection is the answer.

Cloned voices have made the telephone version convincing, which raises the value of a question over a voice — and of a family agreeing on one in advance.

The 6 scripts have nothing in common technically and everything in common structurally. Each manufactures a state in which checking feels like an insult, a delay or a risk, and each collapses the moment somebody breaks contact and re-establishes it independently. That is why learning to spot particular scams is a losing strategy — the costumes are rewritten every season — and why learning to notice the feeling is not.

Where does the money actually go?

Two numbers describe the shape of this, and they point in different directions. Investment scams take about $7.9bn, roughly 50% of everything reported lost. Impersonation takes about $3.5bn but accounts for around one report in 3, which makes it by far the commonest and nothing like the most costly.

The divergence matters because it decides what advice is worth giving to whom. Most people will meet an impersonation attempt this year and lose either nothing or a few hundred; a much smaller number will meet an investment scheme and lose their savings, a pension, or a house. Warning everybody equally about everything wastes the attention of the many and fails the few.

The investment version deserves separate treatment because it does not feel like fraud at any point until the end. It typically involves small early returns that can genuinely be withdrawn, a group of apparently ordinary people who are also earning, and an introduction from somebody the victim actually knows and who is also being defrauded. Nothing about the experience resembles the warnings, which describe a stranger in a hurry.

And the totals are floors rather than measurements. They count reports, and most of this is never reported: people who lose money to a scam frequently tell nobody at all, including their families, which is a rational response to how these events are discussed and a serious problem for anybody trying to size the harm.

Why does it work on careful people?

The comfortable explanation is that victims were careless, credulous or old, and it survives because it is reassuring to everybody who has not been targeted yet. It is also contradicted by the casework: engineers, accountants, lawyers and people who work in security lose money to these every year, and the ones who write about it afterwards describe the same thing.

What they describe is a state rather than a mistake. Something arrives that engages fear, urgency, attachment, protectiveness or hope, and in that state the act of verifying stops feeling sensible and starts feeling like an obstacle — rude to the person you are speaking to, dangerous given the deadline, insulting to somebody you trust. The deception is not of the intellect. It is of the priority ordering.

The people running these are professionals with scripts refined against thousands of attempts, and the scripts include the objections. The bank impersonator has an answer for "let me call you back". The investment introducer has an explanation for the withdrawal fee. Anybody imagining they would simply see through it is imagining an encounter with an amateur.

Which is why the useful defence is not knowledge of scams but a rule that operates without judgement. Not "I will spot it", which fails on the day you are tired and it is convincing, but "I do not move money during the conversation in which I am asked to", which works when you have spotted nothing at all.

Why this industry has almost nothing to sell you

The security business is organised around organisations, and reasonably so: that is where the budgets are. The consequence is that the enormous, growing harm falling on individuals attracts a fraction of the attention, and the products that do exist for consumers mostly address the previous decade's problem.

Consider what is actually sold. Antivirus, which addresses software running on your machine when nothing is running on your machine. Password managers, which are genuinely valuable and irrelevant to somebody who typed their own password into their own bank and then moved the money themselves. Identity monitoring, which tells you after the fact that data about you is circulating, which was true before you subscribed and will remain true afterwards.

None of that is fraudulent and most of it is worth having for the problems it does address. But the mismatch is stark: the losses in this area are dominated by persuasion, and there is no persuasion product — which is also why training people to spot things improves the click rate and not the outcome. What helps is a rule, a habit and a conversation with your family, none of which has a business model attached, which is also why you will not see them advertised.

There is one honourable exception worth naming, and it is free. Password managers, strong factors and automatic updates all reduce the chance that a scam which starts as persuasion escalates into an account takeover, which is how a single loss becomes a month of untangling. They do not stop the transfer and they do limit what follows it, which is a smaller claim than the advertising makes and a true one. Judge any consumer security product by that test: ask which specific harm it removes, and treat a vendor who answers by describing how frightening the internet is as somebody who has just declined to answer. The good products survive that question comfortably and the bad ones cannot be asked it twice, which makes it the most efficient consumer advice available and the least likely to appear in a review. It also works on the advice itself, including everything above: a rule you cannot picture yourself following at nine on a bad evening is not a rule at all, however sensible it sounds on a quiet afternoon when nothing whatever is happening. It is a wish wearing the clothes of a policy, and it will be treated as one.

The institutions with the most leverage are the banks and the platforms, and both have been moved further by regulation than by anything else. Confirming that a payee name matches the account, delaying unusual first payments, and asking what a transfer is for are interventions that work, and they exist where somebody was obliged to build them rather than where somebody chose to.

The person is the minority of the coverage

732 entries here concern scams, fraud or the people they happen to. 163 use the word scam, 281 centre the victim or the consumer, and 134 discuss identity theft.

232014139201583201680201789201811020199620201072021

The solid portion is the share that centres the person rather than the method: about 35% across the first half of the period and roughly 41% across the second, and the minority throughout. Coverage peaks in 2015 with 139. Writing about this subject describes techniques because techniques are what the industry sells against, and the person on the other end of the telephone appears mostly as a figure in somebody else's argument. The earliest piece here using the word, Amazon scam email latest in ID theft worries, is already describing a method rather than a person.

What do you do in the first hour?

The first hour matters more than anything else and almost nobody spends it well, because the dominant feeling is not urgency but disbelief. There is a short list, and the order is not the obvious one.

Change the password on your email first, before the bank, before anything. Email is the account that can reset every other account you own, and if the person who took your money has it, everything else you do can be undone behind you. Then contact your bank and use the word fraud, because it routes the call differently; if a transfer has just been sent, minutes genuinely matter and recall is occasionally possible.

Then write down what happened while it is fresh: the numbers, the names, the times, the account details you were given. You will be asked for these repeatedly by people who do not talk to each other, and reconstructing them from memory a week later is painful and inaccurate. Screenshot everything before deleting anything, and delete nothing at all until it is recorded.

And expect the second approach. People who have lost money are contacted, often within weeks, by somebody offering to recover it for a fee — sometimes claiming to be from a law firm, a regulator or a police unit. Recovery services that ask for money up front are the same trade running its second act on the same list, and being approached is a sign your details are circulating rather than a sign of hope.

Why are the published figures too low?

Every total on this page is built from reports, and reporting is the exception. The reasons are consistent and human: people believe they will be judged, that nothing can be done, that they should have known better, or that a partner or an adult child will use it as evidence they can no longer manage their own affairs.

That last fear is the most consequential and the least discussed. An older person who loses money to a scam frequently faces a conversation about independence afterwards, and the entirely rational response is to say nothing — which means the scam succeeds twice, and the next one arrives against somebody who now cannot ask for help.

The way families talk about this therefore matters more than any technical measure available to them. A household where the response to a near miss is interest rather than alarm gets told about the next one early; a household where it is treated as a lapse gets told about nothing. That is not a soft consideration, it is the single variable most likely to determine whether an approach becomes a loss.

The same applies to how this is written about. Coverage that leads with how obvious the deception was, or how the victim ignored warnings, is enjoyable to read and actively harmful, because every reader learns that admitting to it is expensive. A published figure is only ever the part people were willing to say out loud.

One rule beats twenty warnings

Repeated warnings to a relative do not work and gradually become a source of irritation on both sides. What works is a single agreement, made in advance, that applies regardless of the story — because the agreement removes the need to judge the situation while inside it.

The strongest version is a family word. Anybody claiming to be a relative in trouble can be asked for it, and cloned voices, spoofed numbers and convincing details make no difference to whether they know it. Agree one at a meal, tell everybody including the teenagers, and never send it in writing to each other.

The second is a standing rule about money: nobody in this family moves funds during the conversation in which they are asked to. Not a delay of days, just the end of that contact and a call back on a number already known. It is simple enough to remember under pressure, which is the only property that matters, and it defeats almost every script on this page.

The third is permission. Say explicitly, before anything happens, that you will never be annoyed to be asked about something suspicious and never disappointed to hear that somebody nearly fell for one. That sentence costs nothing and it is the difference between hearing about the approach and hearing about the loss.

What the institutions could do and mostly do not

Individuals are being asked to defend themselves against organised operations, one person at a time, with no training and no equipment. It works about as well as that description suggests, and the parties with genuine leverage are the banks, the payment systems and the platforms where the contact begins.

Some of what helps already exists. Checking that the name on an account matches the name the payer typed defeats a whole family of invoice and impersonation frauds. Holding an unusual first payment for a short period gives doubt time to arrive. Asking what a transfer is for, and responding to the answer, catches the cases where the customer is repeating a story somebody gave them.

The platforms have been slower and their position is weaker than they claim. A substantial share of investment and romance approaches begin in advertising and messaging on services with sophisticated targeting, detailed knowledge of who is contacting whom, and long experience of detecting coordinated behaviour when it threatens their own revenue.

Where obligations have been imposed, behaviour has changed; where they have not, it largely has not. That is not a moral observation about anybody, it is a description of how costs move. As long as the loss lands entirely on the individual, the organisations positioned to reduce it carry none of it, and arguments about who should act will continue to be resolved by whoever is required to.

Common questions

How much do individuals actually lose?

Around $15.9bn was reported lost in a single year in the United States alone, up from about $12.5bn the year before — a rise of roughly 27%. That figure counts only what was reported, which makes it a floor rather than an estimate.

Which scams take the most money?

Investment scams, by a distance: some $7.9bn, or about 50% of everything lost. They are not the most frequently reported, which is the crucial distinction — a rare category can dominate the losses while a common one dominates the headlines.

Which are the most common?

Impersonation of a person or an institution, at roughly $3.5bn and about one in 3 of all fraud reports. Losses in that category have roughly tripled in five years, because impersonating a bank, a government office or a family member now costs almost nothing to do convincingly.

Are people who fall for these careless?

No, and the belief that they are is part of why it works. These are not tests of intelligence; they are attacks on a state of mind — urgency, fear, attachment, hope — engineered by people who do this professionally and refine their script against thousands of attempts.

What is the single most useful habit?

Ending the contact and re-establishing it yourself. Hang up and dial the number on your card. Close the message and log in the way you normally do. Almost every scam on this page fails at that step, because it depends on you continuing the conversation it started.

Why does waiting work so well?

Because the pressure is manufactured and cannot survive time. A genuine bank, employer or relative will still be there in ten minutes; a scam depends on you acting before the feeling fades. Anybody insisting that you cannot wait is telling you why you should.

Where do romance scams begin?

Increasingly not on dating services. Around 60% of people reporting a romance scam loss said the first contact came through social media, which means avoiding dating apps offers far less protection than most people assume.

Can I get the money back?

Sometimes, and only if you move quickly. Contact your bank immediately — within minutes if possible — because transfers can occasionally be recalled before they settle. After that the realistic prospects fall sharply, and anybody who contacts you promising recovery for a fee is running the second scam.

What should I do first if it has happened?

Tell your bank, change the password on your email before anything else, and write down what happened while you remember it. Email comes first because it is the account that can reset all the others, and it is the one most often overlooked in the panic.

Should I report it if the money is gone?

Yes, and this is the request most likely to be ignored. Reports are the only reason anybody knows the scale of this, they occasionally connect to an existing investigation, and the shame that stops people reporting is precisely what keeps the published figures below the real ones.

Does a password manager or antivirus help?

They help with different problems and are worth having. Neither touches this one, because nothing is being hacked: you are being persuaded to act, and every system involved does exactly what it was designed to do.

How do I protect an older relative?

Agree one rule together rather than warning them repeatedly. A family password for urgent requests, or a standing agreement that nobody ever moves money without a second conversation, works because it gives them permission to stop — which is what the scam is trying to remove.

Scams and fraud in the archive

732 entries, peaking in 2015 with 139.