FTC: Americans lost over $2.1 billion to social media scams in 2025

 The U.S. Federal Trade Commission (FTC) warned of a massive increase in losses from social media scams since 2020, exceeding $2.1 billion in 2025.

According to reports to the FTC's Consumer Sentinel Network, all age groups (except those 80 and over, who were mainly targeted via phone calls) lost more money to scams originating on Facebook than to any other social media platform.

Reports linked to WhatsApp and Instagram were distant second and third, and people reported losing far more money to Facebook scams alone than to text or email scams combined.

In all, as the Commission found, almost one in three Americans who lost money to scammers last year were contacted via a social media platform.

"In 2025, nearly 30% of people who reported losing money to a scam said that it started on social media, with reported losses reaching a staggering $2.1 billion. Social media scams produced far more in losses—an eightfold increase since 2020—than any other contact method used by scammers to reach consumers," the FTC warned today.

"Social media creates easy access to billions of people from anywhere in the world, making a scammer's job easier at very little cost. Scammers may hack a user's account, exploit what a user posts to figure out how to target them, or buy ads and use the same tools used by real businesses to target people by age, interests or shopping habits."

In response to this wave of scams targeting social media in general and its users in particular, Meta introduced new anti-scam protections across WhatsApp, Facebook, and Messenger last month. Among these new tools, Meta is testing warnings that flag suspicious Facebook friend requests based on signals such as a profile location that doesn't match the user's region or a small number of mutual connections.

It rolled out another set of tools in October to help users detect potential scams more easily, including a more advanced scam-detection system for suspicious chats that will warn when a new contact sends a potentially scammy message. Meta also introduced new WhatsApp warnings that alert users to only share their screen with people they trust when starting video calls with unknown contacts.

​In August, WhatsApp also added a security feature designed to help users spot potential scamswhen being added to a group chat by unknown contacts.

Meta removed over 159 million scam ads and took down over 10.9 million accounts on Facebook and Instagram linked to criminal scam operations in 2025.

In its 2025 Internet Crime Report, the FBI said it received over 1 million complaints through its Internet Crime Complaint Center (IC3) last year, linked to nearly $21 billion in losses from cyber-enabled crimes such as investment scams, business email compromise, tech support fraud, and data breaches.

To avoid getting scammed online, the FTC recommends limiting who can view your posts and contacts on social media and refraining from allowing someone you've only met through social media to influence investment decisions. Additionally, it's wise to research any company before making a purchase by searching for its name online along with terms like "scam" or "complaint."

Your ex has your Social Security number. Here’s what they can do with it.

This is pretty common in situations involving bad breakups, adult children, messy divorces or estranged family, where someone who once had full access to your life still has the paperwork to prove it.

Think about what details some people have about you. Your Social Security number. Your mother’s maiden name. Your birthday. Your childhood street. That’s not just personal history. That’s a key. 

Click here to read the article.

What I found out about the 'ELIZA effect' completely changed how I think about using AI chatbots

 For years, the big concern about tech has been that it's hijacking our attention with features like infinite scroll, autoplay and push notifications, which were all designed to keep us glued to our screens. But with AI, something has changed. It doesn’t just want your attention — it wants something much deeper: emotional connection.

Click here to read the article.

Urgent warning to all 1.8bn Gmail users over new email account takeover scam: 'Don't fall for it'

 Google has alerted all Gmail users that a warning sent to their phones about suspicious account activity may be fake and designed to hijack their phones. 

In February, a Reddit user revealed that they had received a message from 'Gmail from Google' telling them their email account was compromised and needed to be recovered.

Click here to read the article

Say “no, thanks” to unexpected offers to lower your credit card interest rate

 If a company calls you unexpectedly and offers to help lower your credit card interest rate, say “no, thanks.” It’s probably a scammer hoping you’ll pay them for shortcuts that don’t really exist. Here’s how to spot and avoid scams that promise to help lower your credit card interest rate.

Scammy debt relief companies promise to help reduce your debt, but what they really want is your money. They charge you an upfront fee before they help. But that’s illegal and along with getting little to no help, you could wind up in even more debt. Some scammers use information they already have — like the last four digits of your Social Security number, your zip code, or your exact credit card balance — to get you to trust them and share more information. Others say their rates are only available for a limited time, to rush you into deciding. This is all part of the scam.

Follow these steps to avoid scams:

• Don’t share personal information with anyone who calls you unexpectedly. Once a scammer has your information, they might use it to commit other crimes.
• Never pay up front. It’s illegal for a debt relief company to charge you before they help you. That includes paying in advance for services to lower your credit card’s interest rate.
• Make a plan to avoid scams. Print this Action Plan and keep it nearby to help you spot the scams more easily and get real help if you need it.

While there are no guarantees, you might be able to get a lower credit card interest rate by asking yourself. Contact your credit card company directly and ask how to qualify for a lower interest rate. Learn more about scams and identity theft at consumer.gov. If you spot a scam, tell the Federal Trade Commission at ReportFraud.ftc.gov.

Topics

 

Credit, Loans, and Debt

 

Credit and Debt

Scams

 

Debt and Credit Scams

There is no such thing as "FOREVER" except on the Internet (e.g. Facebook even after you pass on)

 The U.S. Patent Office handed Meta the legal right to simulate you after you’re gone. Your posts, comments and voice messages are the training data. Here’s what you need to do about it today.

Click here to read the article.

On April 14, 2026, Microsoft began rolling out the April 2026 Security Update (KB5083769) for Windows 11, introducing several visual changes, improvements, and fixes. However, as with previous updates, some users are running into issues after installation.

Microsoft has confirmed a specific BitLocker-related problem that can cause affected devices to boot directly into the BitLocker recovery screen, preventing access to the desktop.

Click here to read the article.

This old-school scam is still working...

 When we read about this new malware tactic, or that novel social engineering approach, it’s easy to forget that there are scammers out there making a living from ancient methods.

Recently, one of our researchers received this variation on the good old Nigerian advance-fee scam.

Click here to read the article.

New Booking.com data breach forces reservation PIN resets

Booking.com has confirmed in a statement to BleepingComputer that hackers accessed some users' data from booking information associated with their reservations.

The company took immediate action, forced PIN resets for existing and past reservations, and informed impacted users directly via email.

Booking.com is one of the largest online travel platforms in the world, allowing users to book accommodation, flights, car rentals, airport taxis, and travel experiences. The service acts as a middleman between travelers and hospitality providers.

As a major player, the service lists millions of properties worldwide and handles hundreds of millions of bookings per year.

Over the weekend, multiple users reported receiving emails from the official noreply@booking.com address, warning of a cybersecurity incident that may have exposed personal information to unauthorized parties. The compromised data types include:

Full names

Email addresses

Postal addresses

Phone numbers

Communications shared with the property providers

The same notification included an updated PIN for a given reservation number, and urged users to be cautious of suspicious emails and phone calls, reminding them that the service will never ask for sensitive information or bank transfers.

"At Booking.com, we are dedicated to the security and data protection of our guests. In that spirit, we're writing to inform you that unauthorized third parties may have been able to access certain booking information associated with your reservation," reads the company's notification.

Caution is also advised when receiving emails that appear to come from the booked property or Booking.com itself, as the service recommends not clicking any links in such messages.

However, users who received these messages did not receive alerts in the Booking.com app, creating confusion about their legitimacy.

Responding to our requests for comment and information about the incident, Booking.com’s communications lead, Sage Hunter, confirmed the security breach incident via the following statement:

“At Booking.com, we are dedicated to the security and data protection of our guests. We recently noticed some suspicious activity involving unauthorized third parties being able to access some of our guests’ booking information. Upon discovering the activity, we took action to contain the issue. We have updated the PIN number for these reservations and informed our guests” - Sage Hunter, Booking.com

The company did not answer our questions about the number of impacted users, but assured us that everyone will be notified individually. The company also underlines that customer support services in multiple languages are available 24/7.

Some users on Reddit reported over the weekend that they are being targeted by scammers who appear to have private reservation information. However, it is unclear if these reports are related to the latest security breach that Booking.com disclosed.

Microsoft April 2026 Patch Tuesday fixes 167 flaws, 2 zero-days

 Today is Microsoft's April 2026 Patch Tuesday with security updates for 167 flaws, including 2 zero-day vulnerabilities.

This Patch Tuesday also addresses eight "Critical" vulnerabilities, 7 of which are remote code execution flaws and the other is a denial of service flaw.

Click here to read the article.

A booby-trapped PDF can take over your computer. Adobe just fixed it. Update now!

 Hackers have been exploiting a flaw in Adobe Acrobat Reader since December. Opening a single PDF is all it takes. Here’s the two-minute fix.

⚡ TL;DR

• A zero-day flaw in Adobe Acrobat Reader has been exploited since December 2025.
• Opening a single PDF is all it takes for hackers to get in your device. No clicks, no downloads.
• Adobe released an emergency patch. Update before you open another file.

Click here to read the article.

10 Microsoft account settings I wish I had checked sooner...

In summary:

• PCWorld reveals essential Microsoft account settings that users often overlook, including privacy controls, subscription management, and security features that significantly impact data protection.
• Key discoveries include Microsoft’s default data sharing with third parties for personalized ads, automatic activity tracking, and accumulated recurring charges for services like Xbox Game Pass.
• Regular review of sign-in activity, clearing browsing history, and revoking third-party app access can enhance security and prevent unauthorized account access or unexpected billing.

Click here to read the article

Your router may be vulnerable to Russian hackers, FBI warns: 5 steps to take now

Key takeaways 

• The FBI and NSA are warning of new threats targeting routers.
• Attacks from Russian hackers can compromise your router.
• Update the firmware and tighten your router password.

---

When was the last time you updated or restarted your router? As long as your internet is working, you may set up your router and then forget about it. But based on new alerts from US federal agencies, that's not such a good idea. 

In new advisories published this week, both the FBI and NSA warned of Russian hackers targeting vulnerable routers around the world to steal sensitive information. Though the attackers are mostly interested in military and government secrets, home and small office users are also at risk. That's because the attackers will hijack SOHO (small office, home office) routers from which they can stage their attacks.

Click here to read the article.

Got a text about expiring reward points? Look closer!

 By BCP Staff

April 7, 2026

If you’re signed up for a rewards program, you may have gotten texts warning that your points are expiring soon. A message like that may catch your attention, but people are reporting to the FTC that some of those messages aren’t real — and come from scammers. So how can you tell which messages are real and which are phishing scams?

Here’s how these scams work: Scammers say you need to click on a link to save your points or they’ll expire today. But if you click, they’ll try to steal your personal information (like your Social Security or credit card number) or download harmful software on your phone. 

If you get a text like this, resist the urge to click. Check it out first. Go to the company’s website or app, but find it yourself. Don’t use any links from the text. Then check your rewards points. Are they really expiring?

Here are some other ways to protect yourself from phishing scams:

Turn on filters on your phone. Adjust your settings, use carrier tools, or try a call-blocking app (some also help with texts) to limit how many unwanted texts you get.

Update your phone’s software regularly. Updates often include critical patches and protections against security threats. These can come in handy if you accidentally do click on a phishing link.

Report spam. Whether you have an Apple or Android phone, there are steps to report junk or spam. 

6 April 2026 FBI REPORT - Cryptocurrency and AI Scams Bilk Americans of Billions

 April 6, 2026

Cryptocurrency and AI Scams Bilk Americans of Billions

FBI releases annual internet crime complaint report

The FBI’s 2025 Internet Crime Report shows cyber-enabled crimes defrauded Americans of nearly $21 billion, with cryptocurrency and artificial intelligence-related complaints among the costliest.

The Internet Crime Complaint Center (IC3) received 1,008,597 total complaints, an increase from 859,532 in 2024. Phishing/spoofing, extortion, and investment schemes were the most frequently reported complaints. Americans over 60 reported approximately $7.7 billion in losses, up 37% from 2024.

The IC3 received approximately 453,000 cyber-enabled fraud complaints, with reported losses exceeding $17.7 billion. Investment fraud remains the primary driver, accounting for nearly 49% of all scam-related losses.

Americans who submitted complaints involving cryptocurrency reported the highest losses, with 181,565 complaints totaling more than $11 billion. In 2024, the FBI launched Operation Level Up, a proactive initiative to identify and notify people who are currently falling victim to cryptocurrency investment fraud. Since its inception, the initiative has surpassed 8,000 total victims notified and reduced losses by more than $500 million. In 2026, the FBI launched Operation Winter SHIELD, highlighting concrete steps organizations can take to bolster their digital security.

Costly tactics used by scammers also include compromised corporate e-mails, tech support fraud, and personal data breaches. For the first time in its nearly 25-year history, the IC3 report features a section on artificial intelligence, which accounts for 22,364 complaints, costing Americans nearly $893 million. Scammers rely on pressure techniques to defraud Americans while deploying fake social profiles, voice clones, identification documents, and believable videos depicting public figures or loved ones.

The FBI urges everyone to “Take a Beat” to identify the red flags of a potential scam. Resist pressure to act quickly and assess the situation before turning over money or personal information.

IC3 receives nearly 3,000 complaints per day. If you believe you or someone you know may have been a victim of a fraud or scam, contact your local FBI office or submit a complaint at ic3.gov as soon as possible. You should document the name of the scammer/company, methods of contact, dates of contact, methods of payment, where funds have been sent, and a thorough description of the interactions.

FBI warns against using Chinese mobile apps due to privacy risks

 The U.S. Federal Bureau of Investigation (FBI) warned Americans against using foreign-developed mobile applications, particularly those created by Chinese developers.

In a public service announcement (PSA) issued via its Internet Crime Complaint Center (IC3) platform this Tuesday, the FBI warned of privacy and data security risks associated with these apps.

"As of early 2026, many of the most downloaded and top-grossing apps in the United States are developed and maintained by foreign companies, particularly those based in China," the bureau warned.

Click here to read the article.

WhatsApp on Windows users targeted in new campaign, warns Microsoft

Microsoft researchers found a campaign that abuses WhatsApp attachments to sneak a script onto Windows machines which will lead to the attacker gaining remote control.

WhatsApp offers a desktop application for Windows and macOS, which users can synchronize with their mobile devices. Desktop versions of WhatsApp are generally used as extensions of mobile apps rather than primary platforms. So, while wide usage of these apps exists, their adoption rate is likely significantly lower when compared to mobile platforms.

Last year, we wrote about Meta closing a vulnerability that allowed an attacker to run arbitrary code on a Windows system which existed in all WhatsApp versions before 2.2450.6.

The attacks found by Microsoft however are based solely on social engineering. The target receives a WhatsApp attachment that looks harmless enough, but it is actually a .vbs (Visual Basic Script) file that Windows can execute.

If the attacker manages to convince the victim to run the file on Windows, the script copies built‑in Windows tools into a hidden folder and gives them misleading names so they look harmless at first glance.

And the tools themselves are legitimate ones, but they’re abused to download malware. A classic living off the land (LOTL) technique which uses what’s already on the system instead of introducing malware binaries that would get picked up in a scan.

The next scripts are pulled from popular cloud providers, so network traffic looks like normal access to AWS, Tencent Cloud, or Backblaze instead of some shady server that would raise red flags.

To turn off other possible alarms, the malware keeps trying to elevate itself to administrator, then tweaks UAC (User Account Control) prompts and registry settings so it can silently make system‑level changes and persist across reboots.

At the end of the infection chain, an unsigned MSI (Microsoft Installer) sets up remote‑access software and other payloads, giving the attacker ongoing, hands‑on access to the machine and data.

How to stay safe

For home users and small businesses, there are some practical steps to stay safe:

• Do not open unsolicited attachments until you have verified with a trusted source that they are safe.
• Turn on View File name extensions in Explorer so that a file claiming to be picture but ending in .vbs or .msi can be identified as such.
• Use an up-to-date real-time anti-malware solution to stop unwanted connections and identify malicious files.
• Download software only from the vendor’s official site and check that installers are signed.
• Don’t ignore warning signs. Unexpected UAC prompts, new software suddenly appearing, or your machine becoming sluggish after opening a WhatsApp attachment are all reasons for an anti-malware scan and, if needed, be prepared to restore from a clean backup.
• Keep Windows and all other applications current to prevent from exploiting known vulnerabilities.