❌

Normal view

What Scams Look Like in Your State: A 50-State Breakdown

By: McAfee
29 September 2026 at 11:15

No matter where you live in the U.S., AI-driven scams and deceptive content are increasingly filling our feeds, alerts, and inboxes with moments that make us stop and ask: “Is this real?”

But the scams and threats Americans encounter aren’t the same everywhere. Where you live can shape the types of scams reaching your devices, how often you encounter them, and even how those experiences affect the way you behave online.

This 50-state breakdown combines McAfee consumer research with McAfee Labs data to show how Americans are experiencing scams, how those experiences are affecting trust and behavior online, and which text-based scams are reaching devices across the country.

The consumer findings come from a nationally representative survey of 5,000 U.S. adults, with 100 respondents in each state. The survey explores people’s exposure to scams, financial losses, changing online behaviors, concerns about AI and the mental effort involved in deciding what to trust online.

Alongside those findings, McAfee Labs analyzed text-based scam activity across the U.S. from May through July 2026. That data provides a view into the volume, concentration and types of scam texts McAfee observed in each state during the three-month analysis period.

Together, the two datasets offer different views of the same problem: what people say they are experiencing and how it affects them, alongside the scam activity McAfee is seeing in the wild.

Infographic - USA Map Dominant Scam Category by State

Alabama

Key takeaway: Alabama had the highest scam-text rate per device in McAfee’s analysis, while scam concerns are also changing how residents behave online.

  • 66% say figuring out what’s real online takes more mental energy than it did a year ago.
  • 60% check whether something online is legitimate at least weekly.
  • 19% say they do that checking several times a day.
  • 45% have encountered an AI-generated image presented as real.
  • 83% are concerned AI is making scams harder to recognize.
  • 64% have avoided an unfamiliar retailer because of scam concerns.
  • 42% have ignored a legitimate call, text or email because they feared a scam.
  • 41% have avoided trying a new app, website or service.
  • 39% have avoided clicking a legitimate message or link.
  • Investment and cryptocurrency scams were the leading text-scam category detected in Alabama.

McAfee detected 5.14 scam texts per device, the highest rate in the country.

Alaska

Key takeaway: Alaska has one of the widest gaps between rising trust fatigue and active checking: 54% report more mental effort, but only 44% verify online content at least weekly.

  • 54% say figuring out what’s real online takes more mental energy than a year ago.
  • 44% check online legitimacy at least weekly.
  • 13% say they check several times a day.
  • 44% have encountered an AI-generated image presented as real.
  • 82% are concerned AI is making scams harder to recognize.
  • 48% have avoided an unfamiliar retailer.
  • 39% have ignored a legitimate call, text or email.
  • 40% have avoided trying a new app, website or service.
  • 34% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams were the leading text-scam category detected in Alaska.

Arizona

Key takeaway: Arizonans are feeling a pronounced trust burden, with 65% saying it now takes more mental energy to decide what’s real online.

  • 65% report greater mental effort figuring out what’s real online.
  • 60% check online legitimacy at least weekly.
  • 17% check several times a day.
  • 41% have encountered an AI-generated image presented as real.
  • 81% are concerned AI is making scams harder to recognize.
  • 43% have avoided unfamiliar retailers.
  • 44% have ignored a legitimate call, text or email.
  • 31% have avoided trying a new app, website or service.
  • 39% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Arizona’s text-scam volume.

Arkansas

Key takeaway: Arkansas residents are relatively active verifiers: 64% check online legitimacy at least weekly even though only about half report greater mental strain.

  • 51% say figuring out what’s real online takes more mental energy.
  • 64% verify online content at least weekly.
  • 22% check several times a day.
  • 38% have encountered an AI-generated image presented as real.
  • 77% are concerned AI is making scams harder to recognize.
  • 46% have avoided unfamiliar retailers.
  • 42% have ignored a legitimate call, text or email.
  • 32% have avoided trying a new app, website or service.
  • 32% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Arkansas text-scam volume.

California

Key takeaway: California has one of the heaviest trust burdens in the survey: 72% say figuring out what’s real online now takes more mental energy.

  • 72% report greater mental effort deciding what’s real online.
  • 58% verify online content at least weekly.
  • 20% check several times a day.
  • 41% have encountered an AI-generated image presented as real.
  • 83% are concerned AI is making scams harder to recognize.
  • 49% have avoided unfamiliar retailers.
  • 43% have ignored a legitimate call, text or email.
  • 32% have avoided trying a new app, website or service.
  • 38% have avoided clicking a legitimate message or link.
  • Among Californians surveyed who lost money to scams, 72% recovered none of it.

Investment and cryptocurrency scams led California’s  text-scam volume. 

Colorado

Key takeaway: Colorado’s clearest signal is concern about AI-enabled scams, shared by 85% of residents surveyed.

  • 59% report greater mental effort figuring out what’s real online.
  • 56% verify online content at least weekly.
  • 15% check several times a day.
  • 38% have encountered an AI-generated image presented as real.
  • 85% are concerned AI is making scams harder to recognize.
  • 42% have avoided unfamiliar retailers.
  • 45% have ignored a legitimate call, text or email.
  • 35% have avoided trying a new app, website or service.
  • 34% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Colorado’s text-scam volume.

Connecticut

Key takeaway: Connecticut residents report rising trust fatigue, yet fewer than half say they verify online content every week.

  • 57% say figuring out what’s real takes more mental energy.
  • 47% verify online content at least weekly.
  • 18% check several times a day.
  • 35% have encountered an AI-generated image presented as real.
  • 79% are concerned AI is making scams harder to recognize.
  • 33% have avoided unfamiliar retailers.
  • 36% have ignored a legitimate call, text or email.
  • 26% have avoided a new app, website or service.
  • 24% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Connecticut’s text-scam volume.

Delaware

Key takeaway: Delaware stands out for exposure to synthetic imagery, with 46% encountering an AI-generated image presented as real.

  • 53% report greater mental effort figuring out what’s real online.
  • 53% verify online content at least weekly.
  • 8% check several times a day.
  • 46% have encountered an AI-generated image presented as real.
  • 80% are concerned AI is making scams harder to recognize.
  • 47% have avoided unfamiliar retailers.
  • 34% have ignored a legitimate call, text or email.
  • 30% have avoided a new app, website or service.
  • 33% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Delaware’s text-scam volume.

Florida

Key takeaway: Floridians are active online reality-checkers, with 63% verifying messages, offers, websites or people at least weekly.

  • 56% report greater mental effort figuring out what’s real online.
  • 63% verify online content at least weekly.
  • 18% check several times a day.
  • 43% have encountered an AI-generated image presented as real.
  • 85% are concerned AI is making scams harder to recognize.
  • 43% have avoided unfamiliar retailers.
  • 37% have ignored a legitimate call, text or email.
  • 42% have avoided a new app, website or service.
  • 27% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Florida text-scam volume.

From our McAfee Labs Research: This shows approximate location of all the scams received
From our McAfee Labs Research: This shows approximate location of all the scams received

Georgia

Key takeaway: Georgia had the second-highest scam-text-per-device rate highlighted by McAfee, at 4.67.

  • 59% report greater mental effort figuring out what’s real online.
  • 60% verify online content at least weekly.
  • 25% check several times a day.
  • 33% have encountered an AI-generated image presented as real.
  • 80% are concerned AI is making scams harder to recognize.
  • 40% have avoided unfamiliar retailers.
  • 37% have ignored a legitimate call, text or email.
  • 27% have avoided a new app, website or service.
  • 35% have avoided clicking a legitimate message or link.
  • McAfee detected an average of 4.67 scam texts per device.

Investment and cryptocurrency scams led Georgia’s text-scam volume. 

Hawaii

Key takeaway: Hawaii had the country’s highest scam intensity among affected devices: those receiving at least one scam text averaged 8.45 over three months.

  • 56% report greater mental effort figuring out what’s real online.
  • 54% verify online content at least weekly.
  • 13% check several times a day.
  • 38% have encountered an AI-generated image presented as real.
  • 81% are concerned AI is making scams harder to recognize.
  • 47% have avoided unfamiliar retailers.
  • 38% have ignored a legitimate call, text or email.
  • 37% have avoided a new app, website or service.
  • 37% have avoided clicking a legitimate message or link.
  • Affected devices averaged 8.45 scam texts, the highest figure nationally.

Investment and cryptocurrency scams led Hawaii’s text-scam volume. 

Idaho

Key takeaway: Idaho shows a sizeable trust gap: 62% report greater mental effort deciding what’s real, while 49% verify online content weekly.

  • 62% report more mental effort figuring out what’s real online.
  • 49% verify online content at least weekly.
  • 13% check several times a day.
  • 43% have encountered an AI-generated image presented as real.
  • 82% are concerned AI is making scams harder to recognize.
  • 48% have avoided unfamiliar retailers.
  • 35% have ignored a legitimate call, text or email.
  • 40% have avoided a new app, website or service.
  • 38% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Idaho’s text-scam volume.

Illinois

Key takeaway: Two-thirds of Illinois residents say deciding what’s real online is taking more mental energy than a year ago.

  • 66% report more mental effort figuring out what’s real online.
  • 59% verify online content at least weekly.
  • 18% check several times a day.
  • 39% have encountered an AI-generated image presented as real.
  • 75% are concerned AI is making scams harder to recognize.
  • 40% have avoided unfamiliar retailers.
  • 26% have ignored a legitimate call, text or email.
  • 32% have avoided a new app, website or service.
  • 24% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Illinois text-scam volume.

Indiana

Key takeaway: Indiana’s scam anxiety is translating into caution: 81% are concerned about AI making scams harder to recognize and 60% verify online content weekly.

  • 62% report more mental effort figuring out what’s real online.
  • 60% verify online content at least weekly.
  • 18% check several times a day.
  • 46% have encountered an AI-generated image presented as real.
  • 81% are concerned AI is making scams harder to recognize.
  • 38% have avoided unfamiliar retailers.
  • 41% have ignored a legitimate call, text or email.
  • 35% have avoided a new app, website or service.
  • 35% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Indiana text-scam volume.

Iowa

Key takeaway: Iowa residents report relatively restrained checking behavior: 47% verify online content at least weekly despite 55% reporting greater mental effort.

  • 55% report more mental effort figuring out what’s real online.
  • 47% verify online content at least weekly.
  • 17% check several times a day.
  • 33% have encountered an AI-generated image presented as real.
  • 81% are concerned AI is making scams harder to recognize.
  • 43% have avoided unfamiliar retailers.
  • 32% have ignored a legitimate call, text or email.
  • 33% have avoided a new app, website or service.
  • 34% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Iowa text-scam volume.

Kansas

Key takeaway: Kansas has one of the bleakest recovery pictures in the survey: 75% of scam victims who lost money recovered none of it.

  • 61% report more mental effort figuring out what’s real online.
  • 51% verify online content at least weekly.
  • 10% check several times a day.
  • 40% have encountered an AI-generated image presented as real.
  • 80% are concerned AI is making scams harder to recognize.
  • 42% have avoided unfamiliar retailers.
  • 39% have ignored a legitimate call, text or email.
  • 40% have avoided a new app, website or service.
  • 32% have avoided clicking a legitimate message or link.
  • 75% of victims who lost money said they recovered none of it.

Investment and cryptocurrency scams led Kansas text-scam volume.

Kentucky

Key takeaway: Kentucky is the standout verification state: 76% say they check whether online content is legitimate at least weekly.

  • 62% report more mental effort figuring out what’s real online.
  • 76% verify online content at least weekly.
  • 19% check several times a day.
  • 41% have encountered an AI-generated image presented as real.
  • 83% are concerned AI is making scams harder to recognize.
  • 46% have avoided unfamiliar retailers.
  • 30% have ignored a legitimate call, text or email.
  • 39% have avoided a new app, website or service.
  • 25% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Kentucky text-scam volume.

Louisiana

Key takeaway: Louisiana combines comparatively low trust fatigue with severe financial consequences: 73% of victims who lost money recovered none of it.

  • 45% report more mental effort figuring out what’s real online.
  • 54% verify online content at least weekly.
  • 13% check several times a day.
  • 35% have encountered an AI-generated image presented as real.
  • 75% are concerned AI is making scams harder to recognize.
  • 43% have avoided unfamiliar retailers.
  • 37% have ignored a legitimate call, text or email.
  • 32% have avoided a new app, website or service.
  • 30% have avoided clicking a legitimate message or link.
  • 73% of victims who lost money said they recovered none of it.

Investment and cryptocurrency scams led Louisiana text-scam volume.

Maine

Key takeaway: Maine is one of only two states where toll and traffic scams, rather than investment and crypto scams, ranked first in McAfee’s text telemetry.

  • 64% report more mental effort figuring out what’s real online.
  • 59% verify online content at least weekly.
  • 13% check several times a day.
  • 39% have encountered an AI-generated image presented as real.
  • 81% are concerned AI is making scams harder to recognize.
  • 46% have avoided unfamiliar retailers.
  • 34% have ignored a legitimate call, text or email.
  • 34% have avoided a new app, website or service.
  • 30% have avoided clicking a legitimate message or link.

Toll and traffic violation scams were Maine’s leading text-scam category.

Maryland

Key takeaway: Marylanders show particularly high concern about AI-enabled fraud, with 86% saying AI is making scams harder to recognize.

  • 65% report more mental effort figuring out what’s real online.
  • 60% verify online content at least weekly.
  • 25% check several times a day.
  • 45% have encountered an AI-generated image presented as real.
  • 86% are concerned AI is making scams harder to recognize.
  • 46% have avoided unfamiliar retailers.
  • 45% have ignored a legitimate call, text or email.
  • 37% have avoided a new app, website or service.
  • 44% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Maryland text-scam volume.

Infographic - How Scams Are Affecting Americans 2

Massachusetts

Key takeaway: Massachusetts has a striking trust gap: 65% report more mental effort deciding what’s real, but only 48% verify online content at least weekly.

  • 65% report more mental effort figuring out what’s real online.
  • 48% verify online content at least weekly.
  • 15% check several times a day.
  • 46% have encountered an AI-generated image presented as real.
  • 86% are concerned AI is making scams harder to recognize.
  • 47% have avoided unfamiliar retailers.
  • 35% have ignored a legitimate call, text or email.
  • 37% have avoided a new app, website or service.
  • 38% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Massachusetts text-scam volume.

Michigan

Key takeaway: Michigan joins Maine as the only state where toll and traffic scams outranked investment and cryptocurrency scams.

  • 71% report more mental effort figuring out what’s real online.
  • 52% verify online content at least weekly.
  • 21% check several times a day.
  • 43% have encountered an AI-generated image presented as real.
  • 71% are concerned AI is making scams harder to recognize.
  • 40% have avoided unfamiliar retailers.
  • 35% have ignored a legitimate call, text or email.
  • 34% have avoided a new app, website or service.
  • 32% have avoided clicking a legitimate message or link.

Toll and traffic violation scams were Michigan’s leading text-scam category.

Minnesota

Key takeaway: Minnesota records the highest AI-scam concern in the state crosstabs, at 91%.

  • 60% report more mental effort figuring out what’s real online.
  • 59% verify online content at least weekly.
  • 10% check several times a day.
  • 47% have encountered an AI-generated image presented as real.
  • 91% are concerned AI is making scams harder to recognize.
  • 44% have avoided unfamiliar retailers.
  • 44% have ignored a legitimate call, text or email.
  • 38% have avoided a new app, website or service.
  • 34% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Minnesota text-scam volume.

Mississippi

Key takeaway: Mississippi had one of the heaviest scam-text loads in McAfee’s analysis, averaging roughly 4.64 scam texts per device.

  • 55% report more mental effort figuring out what’s real online.
  • 54% verify online content at least weekly.
  • 17% check several times a day.
  • 32% have encountered an AI-generated image presented as real.
  • 82% are concerned AI is making scams harder to recognize.
  • 43% have avoided unfamiliar retailers.
  • 34% have ignored a legitimate call, text or email.
  • 34% have avoided a new app, website or service.
  • 35% have avoided clicking a legitimate message or link.
  • McAfee detected roughly 4.64 scam texts per device.

Investment and cryptocurrency scams led Mississippi text-scam volume.

Missouri

Key takeaway: Missouri residents show a confidence problem around AI scams: 13% said they were not at all confident spotting AI-created or AI-enhanced fraud.

  • 63% report more mental effort figuring out what’s real online.
  • 60% verify online content at least weekly.
  • 16% check several times a day.
  • 41% have encountered an AI-generated image presented as real.
  • 85% are concerned AI is making scams harder to recognize.
  • 43% have avoided unfamiliar retailers.
  • 40% have ignored a legitimate call, text or email.
  • 39% have avoided a new app, website or service.
  • 35% have avoided clicking a legitimate message or link.
  • 13% said they’re not at all confident they could spot a scam enhanced by AI

Investment and cryptocurrency scams led Missouri text-scam volume.

Montana

Key takeaway: Montana has the highest reported exposure to AI-generated images presented as real, at 51%.

  • 63% report more mental effort figuring out what’s real online.
  • 49% verify online content at least weekly.
  • 11% check several times a day.
  • 51% have encountered an AI-generated image presented as real.
  • 84% are concerned AI is making scams harder to recognize.
  • 47% have avoided unfamiliar retailers.
  • 44% have ignored a legitimate call, text or email.
  • 43% have avoided a new app, website or service.
  • 37% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Montana text-scam volume.

Nebraska

Key takeaway: Nebraska’s strongest signal is AI concern: 87% say AI is making online scams harder to recognize.

  • 56% report more mental effort figuring out what’s real online.
  • 50% verify online content at least weekly.
  • 8% check several times a day.
  • 43% have encountered an AI-generated image presented as real.
  • 87% are concerned AI is making scams harder to recognize.
  • 41% have avoided unfamiliar retailers.
  • 35% have ignored a legitimate call, text or email.
  • 40% have avoided a new app, website or service.
  • 29% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Nebraska text-scam volume.

Nevada

Key takeaway: Nevada has the broadest reported scam exposure in the survey, with 95% encountering at least one type of scam in the past year.

  • 60% report more mental effort figuring out what’s real online.
  • 66% verify online content at least weekly.
  • 18% check several times a day.
  • 43% have encountered an AI-generated image presented as real.
  • 82% are concerned AI is making scams harder to recognize.
  • 45% have avoided unfamiliar retailers.
  • 33% have ignored a legitimate call, text or email.
  • 32% have avoided a new app, website or service.
  • 33% have avoided clicking a legitimate message or link.
  • 95% encountered at least one type of scam in the past year.

Investment and cryptocurrency scams led Nevada text-scam volume.

New Hampshire

Key takeaway: New Hampshire shows another trust gap: 59% report more mental effort figuring out what’s real, while 46% verify online content weekly.

  • 59% report more mental effort figuring out what’s real online.
  • 46% verify online content at least weekly.
  • 10% check several times a day.
  • 48% have encountered an AI-generated image presented as real.
  • 85% are concerned AI is making scams harder to recognize.
  • 50% have avoided unfamiliar retailers.
  • 34% have ignored a legitimate call, text or email.
  • 37% have avoided a new app, website or service.
  • 33% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led New Hampshire text-scam volume.

New Jersey

Key takeaway: New Jersey residents report unusually frequent scam exposure, with 30% saying they encounter four or more scam attempts on a typical day.

  • 61% report more mental effort figuring out what’s real online.
  • 61% verify online content at least weekly.
  • 18% check several times a day.
  • 43% have encountered an AI-generated image presented as real.
  • 82% are concerned AI is making scams harder to recognize.
  • 49% have avoided unfamiliar retailers.
  • 34% have ignored a legitimate call, text or email.
  • 37% have avoided a new app, website or service.
  • 36% have avoided clicking a legitimate message or link.
  • 30% report encountering at least four scam attempts on a typical day.

Investment and cryptocurrency scams led New Jersey text-scam volume.

New Mexico

Key takeaway: New Mexico has one of the toughest scam-recovery pictures: 72% of victims who lost money recovered none of it.

  • 65% report more mental effort figuring out what’s real online.
  • 59% verify online content at least weekly.
  • 16% check several times a day.
  • 39% have encountered an AI-generated image presented as real.
  • 79% are concerned AI is making scams harder to recognize.
  • 42% have avoided unfamiliar retailers.
  • 48% have ignored a legitimate call, text or email.
  • 38% have avoided a new app, website or service.
  • 44% have avoided clicking a legitimate message or link.
  • 72% of victims who lost money said they recovered none of it.

Investment and cryptocurrency scams led New Mexico text-scam volume.

New York

Key takeaway: New York’s most striking behavioral signal is comparatively low retailer avoidance: 33% have stayed away from unfamiliar sellers because of scam concerns.

  • 59% report more mental effort figuring out what’s real online.
  • 58% verify online content at least weekly.
  • 19% check several times a day.
  • 41% have encountered an AI-generated image presented as real.
  • 78% are concerned AI is making scams harder to recognize.
  • 33% have avoided unfamiliar retailers.
  • 37% have ignored a legitimate call, text or email.
  • 27% have avoided a new app, website or service.
  • 27% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led New York text-scam volume.

Displays the number of scams seen per unique device
Displays the number of scams seen per unique device

North Carolina

Key takeaway: North Carolina stands out on recovery: 42% of scam victims who lost money said they recovered all of it.

  • 53% report more mental effort figuring out what’s real online.
  • 65% verify online content at least weekly.
  • 17% check several times a day.
  • 33% have encountered an AI-generated image presented as real.
  • 69% are concerned AI is making scams harder to recognize.
  • 38% have avoided unfamiliar retailers.
  • 38% have ignored a legitimate call, text or email.
  • 29% have avoided a new app, website or service.
  • 29% have avoided clicking a legitimate message or link.
  • 42% of victims who lost money reported recovering all of it.

Investment and cryptocurrency scams led North Carolina text-scam volume.

North Dakota

Key takeaway: North Dakota had the country’s highest concentration of scams in analyzed text traffic, at 2.8%.

  • 61% report more mental effort figuring out what’s real online.
  • 55% verify online content at least weekly.
  • 13% check several times a day.
  • 46% have encountered an AI-generated image presented as real.
  • 83% are concerned AI is making scams harder to recognize.
  • 48% have avoided unfamiliar retailers.
  • 40% have ignored a legitimate call, text or email.
  • 40% have avoided a new app, website or service.
  • 37% have avoided clicking a legitimate message or link.
  • 2.8% of analyzed text traffic was classified as scams, the highest share nationally.

Investment and cryptocurrency scams led North Dakota text-scam volume.

Ohio

Key takeaway: Ohio stands out for financial harm: 41% of respondents say they lost money to an online scam in the past year.

  • 59% report more mental effort figuring out what’s real online.
  • 63% verify online content at least weekly.
  • 20% check several times a day.
  • 46% have encountered an AI-generated image presented as real.
  • 73% are concerned AI is making scams harder to recognize.
  • 44% have avoided unfamiliar retailers.
  • 33% have ignored a legitimate call, text or email.
  • 33% have avoided a new app, website or service.
  • 30% have avoided clicking a legitimate message or link.
  • 41% report losing money to an online scam in the past year.

Investment and cryptocurrency scams led Ohio text-scam volume.

Oklahoma

Key takeaway: Oklahoma consumers are feeling the mental load of navigating AI-powered scams: 85% are concerned AI is making scams harder to recognize, while half say figuring out what’s real online requires more mental effort.

  • 56% verify online content at least weekly.
  • 19% check several times a day.
  • 47% have encountered an AI-generated image presented as real.
  • 85% are concerned AI is making scams harder to recognize.
  • 50% have avoided unfamiliar retailers.
  • 46% have ignored a legitimate call, text or email.
  • 39% have avoided a new app, website or service.
  • 43% have avoided clicking a legitimate message or link.
  • 10% say they never spend time checking whether online content is legitimate.

Investment and cryptocurrency scams led Oklahoma text-scam volume.

Oregon

Key takeaway: Oregon scam concerns are spilling into ordinary digital life, with 45% avoiding new apps, websites or services.

  • 57% report more mental effort figuring out what’s real online.
  • 49% verify online content at least weekly.
  • 17% check several times a day.
  • 41% have encountered an AI-generated image presented as real.
  • 85% are concerned AI is making scams harder to recognize.
  • 52% have avoided unfamiliar retailers.
  • 45% have ignored a legitimate call, text or email.
  • 45% have avoided a new app, website or service.
  • 39% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Oregon text-scam volume.

Pennsylvania

Key takeaway: Pennsylvania has one of the heavier trust burdens in the survey, with 67% saying figuring out what’s real takes more mental energy.

  • 67% report more mental effort figuring out what’s real online.
  • 54% verify online content at least weekly.
  • 14% check several times a day.
  • 39% have encountered an AI-generated image presented as real.
  • 85% are concerned AI is making scams harder to recognize.
  • 48% have avoided unfamiliar retailers.
  • 38% have ignored a legitimate call, text or email.
  • 37% have avoided a new app, website or service.
  • 31% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Pennsylvania text-scam volume.

Rhode Island

Key takeaway: Rhode Island scam concerns are affecting legitimate online behavior: 42% have avoided clicking a real message or link.

  • 58% report more mental effort figuring out what’s real online.
  • 57% verify online content at least weekly.
  • 11% check several times a day.
  • 45% have encountered an AI-generated image presented as real.
  • 84% are concerned AI is making scams harder to recognize.
  • 40% have avoided unfamiliar retailers.
  • 37% have ignored a legitimate call, text or email.
  • 36% have avoided a new app, website or service.
  • 42% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Rhode Island text-scam volume.

South Carolina

Key takeaway: South Carolina has a confidence problem around AI scams: 13% say they are not at all confident identifying AI-created or AI-enhanced fraud.

  • 57% report more mental effort figuring out what’s real online.
  • 47% verify online content at least weekly.
  • 12% check several times a day.
  • 44% have encountered an AI-generated image presented as real.
  • 79% are concerned AI is making scams harder to recognize.
  • 43% have avoided unfamiliar retailers.
  • 42% have ignored a legitimate call, text or email.
  • 38% have avoided a new app, website or service.
  • 39% have avoided clicking a legitimate message or link.
  • 13% say they are not at all confident identifying AI-created or AI-enhanced fraud.

Investment and cryptocurrency scams led South Carolina text-scam volume.

South Dakota

Key takeaway: South Dakota’s scam response is relatively restrained compared with many states, with 35% avoiding unfamiliar retailers and 29% avoiding legitimate links.

  • 55% report more mental effort figuring out what’s real online.
  • 52% verify online content at least weekly.
  • 11% check several times a day.
  • 41% have encountered an AI-generated image presented as real.
  • 78% are concerned AI is making scams harder to recognize.
  • 35% have avoided unfamiliar retailers.
  • 37% have ignored a legitimate call, text or email.
  • 38% have avoided a new app, website or service.
  • 29% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led South Dakota text-scam volume.

Tennessee

Key takeaway: Tennessee residents report rising trust fatigue without matching verification habits: 59% feel more mental strain, but 48% verify weekly.

  • 59% report more mental effort figuring out what’s real online.
  • 48% verify online content at least weekly.
  • 15% check several times a day.
  • 40% have encountered an AI-generated image presented as real.
  • 80% are concerned AI is making scams harder to recognize.
  • 48% have avoided unfamiliar retailers.
  • 33% have ignored a legitimate call, text or email.
  • 35% have avoided a new app, website or service.
  • 37% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Tennessee text-scam volume.

Texas

Key takeaway: Texas is one of the more active verification states, with 62% checking online legitimacy at least weekly.

  • 61% report more mental effort figuring out what’s real online.
  • 62% verify online content at least weekly.
  • 22% check several times a day.
  • 46% have encountered an AI-generated image presented as real.
  • 81% are concerned AI is making scams harder to recognize.
  • 41% have avoided unfamiliar retailers.
  • 30% have ignored a legitimate call, text or email.
  • 32% have avoided a new app, website or service.
  • 30% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Texas text-scam volume.

Infographic describing state-by-state threat data

Utah

Key takeaway: Utah has one of the highest levels of exposure to AI-generated imagery, with 49% seeing an AI image presented as real.

  • 58% report more mental effort figuring out what’s real online.
  • 50% verify online content at least weekly.
  • 8% check several times a day.
  • 49% have encountered an AI-generated image presented as real.
  • 85% are concerned AI is making scams harder to recognize.
  • 43% have avoided unfamiliar retailers.
  • 40% have ignored a legitimate call, text or email.
  • 43% have avoided a new app, website or service.
  • 32% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Utah text-scam volume.

Vermont

Key takeaway: Vermont has a sizeable trust-versus-action gap: 58% report more mental effort online while 47% verify content weekly.

  • 58% report more mental effort figuring out what’s real online.
  • 47% verify online content at least weekly.
  • 12% check several times a day.
  • 45% have encountered an AI-generated image presented as real.
  • 79% are concerned AI is making scams harder to recognize.
  • 47% have avoided unfamiliar retailers.
  • 28% have ignored a legitimate call, text or email.
  • 32% have avoided a new app, website or service.
  • 30% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Vermont text-scam volume.

Virginia

Key takeaway: Virginia reports comparatively low exposure to AI-generated images presented as real, at 34%, even as concern about AI scams remains high.

  • 58% report more mental effort figuring out what’s real online.
  • 54% verify online content at least weekly.
  • 15% check several times a day.
  • 34% have encountered an AI-generated image presented as real.
  • 83% are concerned AI is making scams harder to recognize.
  • 40% have avoided unfamiliar retailers.
  • 33% have ignored a legitimate call, text or email.
  • 39% have avoided a new app, website or service.
  • 30% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Virginia text-scam volume.

Washington

Key takeaway: Washington has one of the highest levels of AI-scam concern in the survey, at 86%.

  • 62% report more mental effort figuring out what’s real online.
  • 55% verify online content at least weekly.
  • 15% check several times a day.
  • 40% have encountered an AI-generated image presented as real.
  • 86% are concerned AI is making scams harder to recognize.
  • 50% have avoided unfamiliar retailers.
  • 36% have ignored a legitimate call, text or email.
  • 34% have avoided a new app, website or service.
  • 36% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Washington text-scam volume.

West Virginia

Key takeaway: West Virginia has one of the lower weekly verification rates in the survey, at 45%, despite a majority reporting greater trust fatigue.

  • 55% report more mental effort figuring out what’s real online.
  • 45% verify online content at least weekly.
  • 12% check several times a day.
  • 43% have encountered an AI-generated image presented as real.
  • 81% are concerned AI is making scams harder to recognize.
  • 41% have avoided unfamiliar retailers.
  • 25% have ignored a legitimate call, text or email.
  • 29% have avoided a new app, website or service.
  • 31% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led West Virginia text-scam volume.

Wisconsin

Key takeaway: Wisconsin shows relatively high exposure to synthetic imagery: 46% have encountered an AI-generated image presented as real.

  • 56% report more mental effort figuring out what’s real online.
  • 49% verify online content at least weekly.
  • 15% check several times a day.
  • 46% have encountered an AI-generated image presented as real.
  • 85% are concerned AI is making scams harder to recognize.
  • 39% have avoided unfamiliar retailers.
  • 35% have ignored a legitimate call, text or email.
  • 26% have avoided a new app, website or service.
  • 26% have avoided clicking a legitimate message or link.

Investment and cryptocurrency scams led Wisconsin text-scam volume.

Wyoming

Key takeaway: Wyoming has the most distressing scam-loss recovery story in the survey: 76% of victims who lost money recovered none of it.

  • 64% report more mental effort figuring out what’s real online.
  • 52% verify online content at least weekly.
  • 11% check several times a day.
  • 49% have encountered an AI-generated image presented as real.
  • 78% are concerned AI is making scams harder to recognize.
  • 44% have avoided unfamiliar retailers.
  • 41% have ignored a legitimate call, text or email.
  • 43% have avoided a new app, website or service.
  • 31% have avoided clicking a legitimate message or link.
  • 76% of victims who lost money said they recovered none of it.

Investment and cryptocurrency scams led Wyoming text-scam volume.

The post What Scams Look Like in Your State: A 50-State Breakdown appeared first on McAfee Blog.

Your State’s Scam Reality: What New Research Reveals Across All 50 States

29 September 2026 at 11:00

There is a small tax many of us pay in our everyday interactions without even realizing it.

A package notification arrives, and we stop to check whether we actually ordered something. A recruiter reaches out about a job, but before replying, we research the person and the company. A bank alert appears, and instead of tapping the link, we open the banking app ourselves.

These are sensible habits. But McAfee’s latest research suggests the effort behind them is increasing the average American’s every day mental load.

Nearly three-quarters of Americans (74%) say they feel the need to double-check most things online before trusting them. Sixty-two percent say figuring out what is real takes more mental energy than it did a year ago.

That growing burden is one reason McAfee is introducing a new brand and product experience built around a broader idea of what protection should do. Good security shouldn’t demand more of people’s attention. It should help give some of it back.

That’s why the new McAfee experience is designed to do more than protect individual devices. It helps protect the things people rely on every day, their personal information, connections, devices, and accounts, all while making it clearer what’s safe, what needs attention, and what McAfee can handle for them.

New McAfee Experience - iPhone Mockup

Get quick alerts and easily update protections in McAfee’s app

That matters at a moment when attention is already stretched thin. AI is everywhere, and it has made it easier to produce convincing content at an enormous scale, adding to an already crowded attention economy. Increasingly, ordinary moments come with an extra question: Is this real?

And those questions have consequences. Our research found that 82% of Americans have changed how they behave online because of scams. Some have stopped buying from unfamiliar retailers. Others have ignored communications that turned out to be legitimate. Eighteen percent say scam concerns have even caused them to avoid responding to a job opportunity.

“I’ve accused my doctor’s office of being an AI,” says McAfee Threat Researcher Charles McFarland, recounting a time when even he thought something legitimate was fraudulent. “I had to apologize.”

Financial losses remain a serious part of the picture. Nearly one-third of Americans (31%) reported losing money to a scam in the past year. But measuring scams only in dollars misses something important. Scams are also making trust more expensive.

This report examines that growing cost: the attention Americans are spending figuring out what to trust, how the scam experience differs across all 50 states, and what protection should look like when staying safe increasingly competes for the same limited time and attention as everything else we do online.

Infographic - USA Map Dominant Scam Category by State

Key Findings

McAfee’s research combines a nationally representative survey of 5,000 U.S. adults, with 100 respondents in every state, and McAfee Labs analysis of text-based scam activity across the U.S.

Together, the findings show how scams are affecting not only Americans’ wallets, but also their attention, trust and behavior online.

Scams are placing a growing burden on Americans’ attention. Nearly three-quarters (74%) say they feel the need to double-check most things online before trusting them, while 62% say figuring out what is real takes more mental energy than it did a year ago. (Survey)

That uncertainty is changing legitimate online behavior. Eighty-two percent say scam concerns have changed something they do online. Forty-four percent have avoided buying from an unfamiliar retailer, 37% have ignored a legitimate call, text or email, 34% have avoided a new app, website or service, 33% have avoided a legitimate link and 25% have abandoned an online purchase. (Survey)

Scams can make real opportunities harder to trust. Twenty-seven percent encountered a fake recruiter or job opportunity in the past year. At the same time, 18% say scam concerns have caused them to avoid responding to a job opportunity. (Survey)

Financial losses are widespread, and getting money back can be difficult. Nearly one-third of Americans (31%) report losing money to a scam in the past year. Among those who lost money, 53% recovered none. In Wyoming, Kansas, Louisiana, California and New Mexico, more than 70% of victims who lost money recovered nothing. (Survey)

Investment and cryptocurrency scams dominate text-based scam activity. McAfee Labs found them to be the leading scam-text category by volume in 47 of 50 states from May through July 2026. Maine, North Dakota and Michigan were the exceptions. In Maine and North Dakota, toll and traffic scams ranked first. Meanwhile, in North Dakota, loan and investment scams ranked first. (McAfee Labs)

The volume and intensity of scam texts varies considerably by state. Alabama averaged 5.14 scam texts per device, the highest in McAfee’s analysis. In North Dakota, scams represented 2.8% of analyzed text traffic, the highest concentration nationally. In Hawaii, devices receiving at least one scam text averaged 8.45 scam messages during the three-month analysis period. (McAfee Labs)

Some states experience especially high exposure or financial consequences. Ninety-five percent of Nevada respondents encountered at least one type of scam in the past year. In Ohio, 41% reported losing money to a scam. Thirty percent of New Jersey respondents say they encounter four or more scam attempts on a typical day. North Carolina stood out in the other direction: 42% of victims who lost money said they recovered all of it. (Survey)

Many scam texts are designed to begin a conversation rather than complete the scam immediately. Joining or clicking through to a WhatsApp group was the most common requested action in the scam texts McAfee analyzed, driven largely by investment and cryptocurrency schemes. The initial message may be only the first step in a longer attempt to build trust before asking for money. (McAfee Labs)

Displays the number of scams seen per unique device

Displays the number of scams seen per unique device

The New Scam Landscape

Scams no longer occupy some separate, obviously suspicious corner of the internet. Increasingly, they imitate the ordinary business of being online.

In its analysis of U.S. text-based scams from May through July 2026, McAfee Labs identified 49 leading scam topics across 23 broader categories. They touched nearly every part of daily life: package deliveries and bank accounts, job offers and investments, shopping and subscriptions, health and utilities, relationships and family emergencies.

Example of one of the many types of delivery text scams consumers face Example of one of the many types of delivery text scams consumers face

The full list spans Cloud Storage & Payment; Package & Delivery; Banking & Financial; Toll & Traffic Violation; Tax & IRS; Legal Threat & Law Enforcement; Government Impersonation; Tech Support & Security; Prize & Lottery; Romance & Relationship; Employment & Job Offer; Subscription & Service; Account Verification & Account Alerts; Investment & Cryptocurrency; Charity & Donation; Utility & Bill Payment; Health & Pharmacy; Family & Friend Emergency; Retail & Shopping; Loan & Debt Relief; Buying Property & Real Estate; Context-Free Links & Phone Numbers; and Other.

That breadth matters. The more scams resemble the normal messages people receive every day, the more ordinary life requires verification.

One category nevertheless dominated. Investment and cryptocurrency scams were the largest text-scam category by volume in 47 of 50 states. Only Maine, North Dakota and Michigan broke the pattern, with toll and traffic violation scams as well as loan and investments ranking first.

The prevalence of investment scams is important because many are not trying to steal money with a single text. They are trying to start a relationship.

The most common action requested in the scam texts analyzed by McAfee was clicking or joining a WhatsApp group, driven heavily by investment and cryptocurrency schemes. A message might promote an investing community or offer access to financial advice.

Example of a scam text attempting to move users to WhatsApp Example of a scam text attempting to move users to WhatsApp

Moving the recipient into a group or private conversation gives the scammer more time to establish credibility before money enters the picture. Plus, for many of us, social apps feel more personal and we more easily let our guard down when we move a conversation to these messaging platforms.

That helps explain why an unsolicited text that looks relatively harmless can still be the beginning of a much longer scam.

Other prominent scams rely on a different tactic: urgency. Fake account alerts can suggest that something needs immediate attention. Toll and traffic scams warn of an unpaid charge or violation. McAfee Labs also saw scammers impersonating T-Mobile with fake reward offers among the largest individual scam topics.

Example of a scam text attempting to move users to WhatsApp Example of scammers exploiting trusted brands like T-Mobile to dupe customers

The stories change, but the underlying objective is often the same. Scammers want people to act before they have time to question what they are seeing. And there is a lot to question.

Across the United States

McAfee’s analysis found meaningful differences in the amount of scam traffic reaching consumers around the country during the three month analysis period. Alabama recorded an average of 5.14 scam texts per device, the highest in the analysis. Georgia followed at 4.67, with Mississippi close behind at 4.64.

North Dakota stood out in a different way. There, scams represented 2.8% of all text traffic McAfee analyzed, the highest concentration in the country. Hawaii showed another pattern: among devices that received at least one scam text, the average was 8.45 scam messages during the three-month period. That was about 15% higher than Alabama, which ranked second at 7.35 scam texts per exposed device.

Rank  State  Scams per device  State  Scams per device scammed 
1  Alabama  5.14  Hawaii  8.45 
2  Georgia  4.67  Alabama  7.35 
3  Mississippi  4.64  Ohio  7.29 
4  Nevada  4.54  Florida  7.29 
5  Tennessee  4.50  North Dakota  7.28 

A third measure shows how concentrated scam traffic was within people’s overall text messages. North Dakota had the highest concentration in the country, with scams accounting for 2.8% of all text traffic McAfee analyzed.

These measures capture different dimensions of the same problem. The all-device average shows how many scam texts reached devices across a state overall. The exposed-device average shows how persistent scam activity was for devices that received at least one scam. And the share of total text traffic shows how prominent scam messages were within the broader messaging environment.

This shows each states top scam category by volume if Investments & Cryptocurrency scams are ignored. Notice these colors don’t necessarily match the colors from the previous graph.

This shows each states top scam category by volume if Investments & Cryptocurrency scams are ignored. Notice these colors don’t necessarily match the colors from the previous graph.

For consumers, those distinctions may be invisible. What they experience is repetition: another message asking for attention and another decision about whether it deserves it.

AI raises the stakes further. It can make convincing scam content cheaper and faster to produce, while people are simultaneously encountering more AI-generated material in everyday online life. The result is an environment where the old advice to simply “look for something suspicious” becomes harder to apply reliably. Sometimes the suspicious thing looks perfectly ordinary.

That is why the next phase of consumer protection cannot depend on people becoming infinitely better at scrutinizing everything themselves.

America’s Scam Reality

McAfee’s consumer research shows what happens when that scam environment meets everyday life.

Most Americans are encountering scams regularly. Eighty-eight percent say they experienced at least one type of scam in the past year, and one in five say they typically encounter four or more scam attempts in a single day.

Yet frequency tells only part of the story. The more consequential finding may be what people are doing in response.

Eighty-two percent say scam concerns have changed their online behavior. Forty-four percent have avoided an unfamiliar retailer. Thirty-seven percent have ignored a legitimate call, text or email because they suspected a scam. Thirty-three percent have avoided clicking a legitimate message or link.

These are not examples of people falling for scams. They are examples of people trying not to.

Job scams make that tradeoff particularly tangible. Twenty-seven percent of Americans say they encountered a fake recruiter or job opportunity in the past year. Eighteen percent say concerns about scams have caused them to avoid responding to a job opportunity.

The financial consequences remain substantial when a scam does succeed. Nearly one-third of Americans (31%) report losing money to a scam in the past year. Among those victims, 53% recovered none of what they lost.

From our McAfee Labs Research: This shows approximate location of all the scams received

From our McAfee Labs Research: This shows approximate location of all the scams received

But a national average can obscure how differently people experience the problem.

Our full 50-state scam breakdown examines the data state by state, combining McAfee’s consumer survey with Labs telemetry to show where scam exposure is highest, where financial recovery is hardest, how concerns affect behavior, and which types of text scams McAfee is seeing across the country.

Across those differences, one finding remains remarkably consistent: Americans are adapting. They are checking more carefully and approaching unfamiliar interactions with greater caution, or even avoiding them altogether.

Those behaviors can help keep people safe. But that puts the mental load on back onto the everyday user. There is a limit to how much vigilance we should expect people to supply on their own.

The better question is how technology can take on more of that work for them. And that is the thinking behind McAfee’s new brand and product experience, beginning its rollout in the U.S. today.

How McAfee is Changing to Meet the Moment

McAfee’s new consumer experience is designed to make protection simpler to understand and easier to act on, while helping people navigate the moments where scams and other threats increasingly create uncertainty.

We’ll let you know if something seems suspicious and could put you at risk.

The experience is built to spot risks earlier, guide people clearly, and act when protection can be handled automatically. That means flagging suspicious messages, links, sites, exposed data, or unsafe connections; explaining what matters in plain language; and helping people take the right next step without requiring them to become security experts.

McAfee can alert you when your information appears in a data breach, help identify suspicious messages and links, protect your connection on risky Wi-Fi, monitor for exposed personal information, and help keep your devices and accounts safer.

Just as importantly, we’ve worked to make those protections understandable.

Instead of expecting people to know cybersecurity terminology or hunt through settings, the experience is designed to surface what matters and help people understand what to do next.

Because good protection shouldn’t create another job for you.

The refreshed McAfee experience makes it easier to see what needs your attention and how you’re protected.

The refreshed McAfee experience makes it easier to see what needs your attention and how you’re protected.

What We’re Unveiling

That idea, making protection do more of the work, is built into the new McAfee experience we’re unveiling today.

We’ve brought protection for personal information, connections, and devices into one connected experience across PC, Mac, mobile, and tablet. Instead of asking people to piece together what’s protected or search for what needs attention, McAfee makes it easier to see both in one place.

The experience is also more personal. McAfee can alert you when your information or devices may be at risk and provide guided actions, that explain what needs your attention in plain language. The goal is not to give people more security information. It’s to help them understand what matters to them and what they can do about it.

And over time, the experience is designed to become more personal and relevant to each person, proactively identifying risks, alerting in the moment, and guiding when action is needed for the protections that matter most based on their digital life.

We’ve also made improvements to privacy tools like Online Account Cleanup, which now helps people prioritize higher-risk accounts, and Personal Data Cleanup, which makes it easier to see the personal information being found and removed on their behalf.

Taken together, these changes reflect where we believe consumer safety needs to go: less hunting through settings, less deciphering security alerts, and less relying on people to spot every threat themselves.

More protection that understands what matters, explains what needs attention, and works proactively in the background.

Here to give you peace of mind and lighten the mental load of life online.

Here to give you peace of mind and lighten the mental load of life online.

Conclusion

The findings in this report suggest that the impact of scams extends beyond exposure and financial loss.

Every scam adds another small decision to an already crowded digital day: Is this message real? Is this link safe? Is this person who they say they are? As those decisions multiply, staying safe online becomes not just a security challenge, but a growing mental burden.

As people encounter more attempts to imitate legitimate messages, businesses and opportunities, the effort required to establish trust becomes a consequence in its own right.

That makes reducing the burden of verification an increasingly important part of consumer protection. People should not have to devote more of their limited attention to staying safe simply because scams are becoming harder to distinguish from everyday life online. That’s where McAfee comes in.

The post Your State’s Scam Reality: What New Research Reveals Across All 50 States appeared first on McAfee Blog.

8 Steps to Protect Your Child From Identity Theft

By: McAfee
18 September 2026 at 14:00

The best ways to protect your child from identity theft include freezing their credit, limiting exposure of personal information, monitoring for suspicious activity, securing family devices, and teaching safe online habits. Because children often don’t discover identity theft for years, taking preventive action early can help protect their credit, finances, and future opportunities.

Child identity theft is one of the fastest-growing forms of fraud, and many families don’t discover it until years after the damage is done. But child identity theft has surged in recent years, with 38% of U.S. survey participants reporting that a child or family member’s child had been victimized in 2025, jumping from 23% the year prior.

This guide explains how child identity theft happens, what warning signs to watch for, and the eight most effective ways to protect your child’s future.

Key Takeaways

  • Children are prime targets because their Social Security numbers or national ID equivalents are a blank slate, allowing fraud to go undetected for years.
  • Data breaches, phishing scams, social media oversharing, and AI-powered fraud are making child identity theft more common and harder to detect.
  • In 2025, the FTC received 22,782 identity theft reports involving people 19 and under in the United States.
  • AI-driven scams are making it faster and cheaper to target families and steal children’s data at scale.
  • Freezing your child’s credit, monitoring for suspicious activity, and teaching safe online habits are among the most effective protective measures parents can take.

What is Child Identity Theft?

Child identity theft is a crime in which someone steals a minor’s personal information, most commonly the minor’s name, date of birth, and Social Security number (SSN) or equivalent national identifier, to commit fraud. The thief might open credit card accounts, take out loans, rent housing, file fraudulent tax returns, or claim government benefits, all in the child’s name. A 2021 Javelin Strategy study found that this crime affects one in every 50 children and costs U.S. families nearly $1 billion annually.

Why Child Identity Theft Is So Dangerous

The crime is made uniquely dangerous by the silence. Because children typically do not start applying for credit until they are 16 to 18, a thief can have more than a decade of undetected activity. As a result, by the time the victim becomes an adult, they may face:

  • Damaged credit scores
  • Debt collection notices
  • Loan denials
  • Difficulties renting housing

The crime is not confined to the United States, either. One documentary tells the story of Renata Furst Galvão, a native of Brazil, whose identity was stolen at age six and used to amass more than $400,000 in debt.

How Criminals Get Access to Children’s Information

To protect your child effectively, it helps to understand exactly who is targeting them, how they are getting in, and why the threat is accelerating. Even the most security-conscious household can be exposed through no fault of its own. In reality, information is often exposed through organizations that collect and store children’s data.

Common sources include:

  1. Data breaches at retailers, healthcare providers, schools, and financial institutions could expose children’s information alongside adults’.
  2. Social-engineering scams and phishing attacks may target parents directly to extract children’s details.
  3. Social media profiles are prime targets for identity thieves to monitor, which is why a child posting their birthday, school name, and city in separate posts creates genuine risks. Minimize the personal details shared online and in photos.
  4. Online games and apps that over-collect data, including a child’s full name, birthdate, and town, create additional opportunities for personal data exposure.

New Risks: AI Scams and Synthetic Identities

A December 2025 survey found that reports of ID theft rose from 43% in 2024 to 78% in 2025, a single-year spike that reflects how AI-powered tools have made it faster and cheaper for criminals to generate convincing phishing messages and fake identities at scale.

Synthetic identity fraud is particularly dangerous for children. It pairs a real Social Security number belonging to a minor unlikely to use it anytime soon with a fictitious name and address. The resulting fake identity can then build a credit history, take out loans, and disappear before anyone connects the dots.

Warning Signs Your Child’s Identity May Be Stolen

Catching this crime early makes the recovery process far less painful. Knowing what to look for means you will not dismiss the very clues that trigger a fast response.

Unexpected Mail, Bills and Collection Calls

The most common early indicators arrive in your mailbox or by phone, including:

  • Pre-approved credit card offers in your child’s name
  • Collection agencies calling to speak with your child
  • Court notices or bills for accounts your child never opened

Any business mail addressed to a young child should trigger an immediate investigation.

Rejected Applications, Benefit Denials, Suspicious Debt

Many families first discover the theft during pivotal life moments. Examples include:

  • A teen may be denied a learner’s permit due to fraudulent driving violations.
  • A young adult may be denied an apartment because of unpaid debt on their credit report.
  • Stolen Social Security numbers can interfere with access to government benefits.

Unexplained Credit Activity

Children typically should not have a credit history, so potential warning signs of identity theft include:

  • A credit report exists under your child’s name
  • Credit accounts appear that your family never opened
  • Loan applications are associated with your child’s Social Security number
  • Debt appears on your child’s credit file

If your child has a credit record before they are old enough to use credit, it may indicate identity theft.

The 8-Step Protection Plan for Parents

You can follow these steps while seeking guidance from financial educators, credit authorities, and consumer protection experts. Start small by choosing two or three today, then build from there.

Step 1: Check and Freeze Your Child’s Credit

A credit freeze is one of the most effective ways to protect your child from identity theft. If your child is under 16, request a free credit freeze from Equifax, Experian, and TransUnion. This prevents anyone from opening new financial accounts in your child’s name without your authorization. Once in place, the freeze remains active until you ask the credit bureau to temporarily lift or remove it.

Because minors typically don’t have established credit files, the process for placing a freeze differs from that for adults. Each of the three major credit bureaus provides specific instructions for parents and guardians. Follow the guidance from Experian, Equifax, and TransUnion to place a freeze on your child’s credit file.

Step 2: Enable Fraud Alerts and Social Security Reports

In addition to a credit freeze, it’s smart to watch for signs that someone is using your child’s identity. Ensure that you:

  • File a fraud alert with each credit bureau to prompt verification checks if someone attempts to open an account in your child’s name.
  • Request an earnings report from the Social Security Administration to confirm whether wages are being reported under your child’s SSN.
  • Once your child is old enough to have a legitimate credit file, teach them to stagger their use of free credit reports from the AnnualCreditReport website, checking one bureau every four months.

Step 3: Educate Your Kids about Identity Theft & Private Information

In an honest, age-appropriate conversation, explain to them that personal information is the master key to their financial future and should not be shared with online strangers. Role-playing helps: ask your child what they would do if someone they met in a game asked for their full name and home address. Empowered kids are less likely to overshare and more likely to alert you when something feels off.

Step 4: Get Fierce about Protecting Your Child’s Data

Draw a very thick line around your child’s details. Reiterate that sharing them should be limited only when truly necessary, such as school enrollment or medical forms, and only with verified institutions. Ask why it is needed, how it will be stored, and if an alternative identifier is acceptable. Keep important documents in a locked safe and shred papers with your child’s information before disposal.

Step 5: Lock Down Devices, Accounts, and Online Habits

Talk with your kids about safe internet habits. Instruct them to stay skeptical of quizzes, free offers or apps, and unbelievable promos that request personal details. Set their social media accounts to private and limit follower or friend lists to people they know in real life. Use strong, unique passwords for family accounts and enable multifactor authentication on email, school portals, and social media apps used by older children.

Step 6: Monitor for Early Warning Signs

Regularly check your household mail for notices addressed to your child. If you spot anything suspicious, contact the company directly using the contact details on its official website. Do not call the number printed on the suspicious document, as it could redirect you to the thief who sent it. Consider using an identity monitoring service that scans for your child’s data in data breaches or on the dark web and alerts you when their information surfaces.

Step 7: Get Full-Device and Network Security

Many identity theft incidents start with a compromised family device. To reduce this risk, keep operating systems, browsers, and apps fully updated. Secure your home Wi-Fi with a strong password and WPA3 encryption to prevent data interception. Comprehensive security software, such as McAfee+ Family Plans, can help you block malware, keyloggers, and phishing sites that harvest personal data from every device in your home, including the tablets and phones your children use most.

Step 8: Act Quickly If Theft Happens

If you discover or suspect your child’s identity has been stolen, immediately contact the company where the fraudulent account was opened, close the account, and request written confirmation that your child bears no liability. Report the theft to IdentityTheft.gov, follow the personalized recovery plan, and file a police report to create an official record that will help resolve disputes with creditors.

Next, contact each credit bureau to cancel fraudulent accounts, inquiries, and collection notices linked to your child’s SSN. Keep detailed records of every call, letter, and case number throughout the process. Reporting the incident to the authorities helps your family recover and supports broader enforcement efforts that protect other families.

Final Thoughts

Child identity theft is a fast-growing, serious threat worldwide, but it is also one of the more preventable forms of fraud when families take proactive steps early. Start this week by spending 10 minutes to safely lock away your child’s physical documents, then call the major credit bureaus to request a freeze on your child’s credit. Build toward the full eight-step plan over the next month to close every door that leads to potential harm.

Beyond the 8-step sprint, add a recurring data safety day to your family calendar each year to recheck credit freezes and fraud alerts, review your children’s online accounts and platform settings, update devices and passwords, and discuss emerging threats. A family that combines strong protective habits with smart security tools is a much harder target for any kind of cybercrime.

The post 8 Steps to Protect Your Child From Identity Theft appeared first on McAfee Blog.

ConnectWise turns off its SaaS-y backup, security, and management services to probe security SNAFU

19 October 2026 at 04:31
SaaS-for-managed services providers ConnectWise has initiated a “service interruption” for its some of its offerings after detecting unauthorized access. ConnectWise offers ERP tailored to the needs of managed services providers (MSPs), plus tools they can use to manage their customers’ environments. Cloud Backup is one of those tools and does what it says on the tin for data stored on-prem, in the cloud, or in SaaS services like M365 and Google Workspace. On October 16, the company published an advisory revealing that on the 15th it “identified unauthorized access to application identities within the ConnectWise Cloud Backup environment.” “The service interruption affects partners and customers using Cloud Backup, formerly known as SkyKick. Because SaaS Security and Cloud Management are integrated with Cloud Backup, those services have also been suspended out of an abundance of caution while our investigation and remediation continue,” the company advised. The suspension does not mean MSPs, or their customers, should assume that their environments were compromised, just that ConnectWise isn’t confident it can operate its services safely at this time. As of 16:00 UTC on October 18, the services remain unavailable, which means end-users can’t back up data, access their archives, or restore data. “Existing archives remain encrypted, isolated, and preserved, with no evidence of unauthorized access. Our teams continue monitoring affected environments, conducting forensic analysis and threat hunting, and carrying out remediation activities,” the company’s veep of security operations, Jason Ferguson, wrote on Reddit. ConnectWise has not offered much detail on the incident, other than to publish some indicators of compromise it thinks are tied to a handful of IP addresses and integrations with third-party apps. It has also disabled some integrations between Cloud Backup and Exchange, Teams, SharePoint Online, and its own products. Security outfit Huntress offered a starker view and wrote “A Microsoft 365 credential (API secret) belonging to ConnectWise Cloud Backup has been compromised, and Huntress has confirmed it is being used to gain unauthorized access to customers' M365 environments.” “In one Huntress partner tenant, a second ConnectWise application, ConnectWise Cloud Management - MS Teams (Application ID 24205314-2b89-4e07-a2a4-579e898a5640), gave itself Global Administrator and then added new credentials to two other applications in that tenant, one of them being a single-tenant Huntress application unique to this partner.” “Disabling M365 apps, including the abused ConnectWise apps will not remove credentials that were already added,” the firm warns. “You must review the credentials on all of your M365 applications.” ConnectWise says it “cannot discuss threat actor attribution at this time” because it is focused on “investigation, remediation, and supporting affected partners and their customers.” It has, however, called on its customers to probe any M365 environments they manage for signs of compromise. This is where things get tricky, because ConnectWise has no knowledge of those setups – as is proper because it is a platform provider and its MSP clients manage end-user relationships. It’s therefore relying on MSPs to do the right thing. MSPs are under no obligation to disclose the platforms they use to deliver their services. Indeed, for some organizations the allure of working with an MSP is to access packaged services they never need to learn or worry about. End-user organizations that may be happily oblivious about ConnectWise’s contribution to their business are therefore in an awkward position. Businesses that serve MSPs are a frequent target for attackers, who see the chance to compromise the likes of ConnectWise as a possible route to crack all of their partners and those service providers' end-users. The 2021 attack on Kaseya is the most notorious example of such an incident. ConnectWise will be hoping it doesn't take the crown. ®

Cybercrims go beyond stealing data to attack physical building systems

17 October 2026 at 11:30
Late Sunday night, a still-unknown cybercriminal or group hacked thousands of remote-controlled refrigeration systems across hundreds of French grocery stores, spiking temperatures, spoiling food, and sparking fires. This is part of an ongoing trend of attacking physical systems that can do damage in the real world. In August, a ransomware attack disrupted building-management systems at a Canadian hospital, affecting door access controls, central HVAC monitoring, and the issuing of staff access cards. And three years ago, cyberattacks hit Las Vegas casinos, causing slot machines to go dark, preventing payment kiosks and ATMs from spitting out cash, and locking guests out of their rooms when the electronic keys stopped working. Not all digital intrusions remain in cyberspace, and attackers don’t need to encrypt files and steal data to cause chaos. Hitting physical systems often produces more severe consequences - and turns up the heat on executives to pay an extortion demand. “There was one gig where the customer was refusing to pay, and so the threat actor was like, ‘Hold my beer, have fun getting into your offices,’ and locked everybody out,” Tim Beasley, a senior incident response consultant at Semperis, told The Register. Beasley won’t name the customer, or provide any incriminating information, but said the incident response involved police smashing glass in addition to his team recovering compromised data. “The cops had to break in, and literally get into the building, breaking some windows, so the customer was able to finally get back in,” he said. We asked if the customer paid the ransom demand, and Beasley yelled: “Oh, hell, no!” A report published earlier this month by ServiceNow’s Armis Labs found increasing evidence of ransomware attackers using physical consequences as leverage in their intrusions. “Today’s BAS operate at the intersection of IT and OT worlds, creating unprecedented exposure,” the report said. Ransomware with physical consequences Building automation systems - BAS - are the critical systems that control and monitor facilities’ HVAC, lighting, energy usage, and water consumption. They also oversee badge readers, door locks, surveillance cameras, fire alarm control panels, and other physical safety equipment. As such, BAS make very attractive targets for ransomware operators looking for high-pressure ways to extort organizations into paying multi-million ransom demands. These systems also appeal to government-backed goons and hacktivists looking to ensure maximum psychological and physical impact during destructive cyberattacks. Armis Labs found 73 percent of organizations own BAS that have been used in ransomware attacks, and this same percentage have known exploited vulnerabilities in at least one of their building automation systems. Additionally, 91 percent of BAS communicate over insecure protocols - opening up an even bigger attack surface for cyber-miscreants wanting to cause physical harm. “The primary thing that we see with any attack on building management systems or physical systems: It’s a great place for the threat actor to hide,” Michael Freeman, ServiceNow’s senior director of threat research, told The Register. “It's easier for them to compromise, and it's easier for them to hide in.” BAS and operational technology (OT) in general have fewer security controls than IT systems. Most require continual uptime, which makes them harder to patch or even scan for vulnerabilities and misconfigurations as this may lead to outages. “One case in particular, against a very large financial institution, the threat actors were staying low and quiet by attacking their BMS systems, and then pivoting into the IT environment,” Freeman said. The intruders were routinely caught - and booted from - the financial institution’s IT systems, so they built backdoors into the BMS to ensure persistent access to both OT and IT networks. “We're also seeing threat actors using AI to understand more building automation systems, especially ones that are using obscure OSs like VxWorks, older Unix-type systems,” Freeman said. AI has entered the chat As multiple security experts have told us in previous interviews, security through obscurity is dead. Not only does AI make it easier for attackers to find bugs – some very obscure and decades old - but it also means criminals no longer need to be OT experts to carry out destructive cyberattacks on critical networks and facilities. Instead, they can use AI to learn all about the obscure protocols and proprietary hardware and software that historically made industrial control systems black boxes. “It’s easier to understand what the controls are,” Freeman said, using the example of an attacker trying to take down a plane, or some similar catastrophic cyberattack. Historically, even advanced, government-backed hacking squads would “be quiet, because you don't know what changing certain settings is going to do,” Freeman explained. “Now you can use AI to say, ‘If I compromise a weight and balance system for airlines, all I need to do now is move this number here to this number, and I just told the system to load heavy stuff on the right side of the plane instead of equal distribution.'” Freeman told us he has seen attackers break into airlines’ OT gear in the past. “But they didn’t know what they were getting into, and so they left them alone,” he said. “Those do cause me concern because in the past I've helped to kick people out of those types of systems.” Industrial orgs increasingly under attack OT security provider Dragos tracks ransomware groups’ claims against industrial organizations on the criminals’ leak sites, along with publicly disclosed intrusions affecting manufacturing and other critical sectors. To be clear: claims on leak sites aren’t always accurate or even true, and the claim itself doesn’t mean operations or control systems were hit. Since 2022, however, “the numbers have been consistently increasing,” Lexie Mooney, senior threat analyst at Dragos, told The Register. The cybersecurity firm tracked 995 ransomware attacks against industrial orgs in 2023, a 49.5 percent increase from 2022. That number jumped more than 87 percent in 2024. Active ransomware groups targeting industrial orgs also grew in 2024 to 80 groups, up from 50 the year before. Dragos tracked 119 ransomware groups impacting more than 3,300 industrial organizations in 2025, and the incidents have steadily increased every quarter this year: 1,020 incidents in the first quarter of 2026 and 1,140 incidents in Q2. “The vast majority of cases are opportunistic,” Abdul Alamri, a senior threat analyst at Dragos, told us. “In some of the cases that we have seen an operational impact, either physical systems or an OT operation, it’s just the nature of the opportunism on the part of those ransomware groups.” This is partially due to the complexity of OT systems, he added. “Ransomware groups want to disrupt operations, and put pressure on the victims to pay the ransom,” Alamri said. “They don’t want to invest that time and effort to target complex systems." It’s usually quicker and easier for financially motivated crims to affect operations via IT systems - as the extortionists did in the August 2025 Jaguar Land Rover (JLR) breach, which halted manufacturing and crippled business operations for months. Internet-connected OT: the next 'low-hanging fruit' The other side of this complexity, however, is that many organizations themselves still lack visibility into their OT environments. Dragos estimates that fewer than 10 percent of OT networks worldwide currently have sufficient network monitoring in place. Plus, in 30 percent of incidents the security firm responded to in 2025, the investigations did not begin with a detection alert, but with someone noticing that “something seemed wrong” in operations. This lack of visibility, combined with threats from AI, worries Alamri. “If you compare the risk that we have seen from humans, to what we are about to face in the near future with AI agents who might continuously try to break into those systems - it’s a pretty dark future if we don't take the right measures to protect ourselves against it.” As organizations get better at patching and securing IT systems, attackers will likely look to internet-connected OT systems where digital compromises have real-world consequences, according to Matt Hayden, VP of cyber and emerging threats at General Dynamics Information Technology. “We all anticipate that as we get better at reducing the IT low-hanging fruit, OT will become a vector of much more scrutiny and much more attention,” Hayden told The Register. Before joining GDIT, Hayden served as the assistant secretary for cyber, infrastructure, risk and resilience policy at the US Department of Homeland Security. Compliance vs. security “There is a big focus on the hardware being connected for the purpose of compliance - and to make sure that, in the name of compliance, we aren't opening back doors, to devices that traditionally wouldn't have to be connected to facilitate their service,” he said, using refrigeration units as an example of one such system that is now internet-connected for compliance purposes. This was prior to the French supermarket hacks. Refrigeration units’ monitoring systems connect to the internet so their owners and operators can prove to regulators that the units maintain their uptime and temperature in accordance with regulations. “So if the health department comes by, they say, ‘Look, my refrigerator was at 27 degrees for the last 72 days,' and they have a check mark, and they get their A plus. But that simple connectivity is also a vector in which that particular refrigerant unit could be targeted for disruption,” Hayden said. About a week after our interview, criminals did exactly that. “The recently reported exploitations of commercial refrigeration units represent a significant example of devices without digital value, no sensitive data or extended enterprise access, being exploited by being connected to the internet with unpatched firmware,” Hayden told us in a subsequent email. He said he expects the attribution to be “less nation-state, and more likely those looking for targets of opportunity to identify what could be done with the unpatched systems.” “The consequences are food supply degradation at a small scale, but it is an important example of what could happen at scale very quickly with more consequential operating equipment,” Hayden said.®

Networking problems after the October 2026 Windows update? NTLM might be to blame

16 October 2026 at 15:30
The October 2026 Windows security update may break networking for some customers who are still clinging to long-deprecated NTLMv1 security. A seemingly minor change in the update could have major implications for administrators and enterprises that haven't fully moved away from the legacy technology. Before the October 2026 update, Windows permitted NTLMv1-derived credentials for Single Sign-On and generated warning events. After the update, requests to use NTLMv1-derived credentials are blocked. It comes down to the BlockNtlmSSO registry value. If it hasn't been set, Windows will now use Enforce mode (1) instead of Audit mode (0), thus blocking requests and potentially impacting Wi-Fi, Ethernet, and VPN authentication, and therefore connections. The update does not set the value of BlockNtlmSSO, and administrators can set it to 0 to temporarily allow NTLMv1-derived Single Sign-On credentials. However, Microsoft noted, "Using Audit mode reduces the protection provided by Enforce mode and should only be considered as a scoped, temporary security exception." To be clear, this is not a bug and is by design. The addition of NTLM to the deprecation list occurred in 2024, and Microsoft added audit logs for NTLMv1 usage in late August 2025. The Windows giant has made no secret of its desire to ditch the legacy technology, stating in 2023, "Our end goal is eliminating the need to use NTLM at all." The problem is NTLM's longevity. It appeared in 1993 with Windows NT 3.1, and removing it from enterprise environments has proven tricky, even though it is somewhat insecure by modern standards. Microsoft removed it from Windows 11 24H2 and Windows Server 2025, but some remnants can still be found, notably when using MS-CHAPv2-based connections, including PEAP-MSCHAPv2, and EAP-MSCHAPv2, in a domain-joined environment. Hence the introduction of the audit mode in 2025, to help administrators spot where the technology was still being used. It is now 2026, and Microsoft has taken the next step. If Credential Guard is not enabled and BlockNtlmSSO is not set to Audit mode (0), the use of NTLMv1-derived credentials will be blocked as Microsoft works "to finalize the disablement of NTLMv1." There is no indication of how long the BlockNtlmSSO workaround (setting the value to Audit mode) will work - most likely until the next major Windows release. In September, Microsoft said, "In-market versions of Windows client and Windows Server will continue to support NTLM." However, it also stated, "Our long-term objective is a Windows platform that doesn't need NTLM at all." As such, if the message wasn't already clear, the move to enforce it by default makes it impossible to miss. The technology still exists in the operating system, but it is on its way out and will be removed in a future Windows release. Problems with networking after the October 2026 Windows security update could therefore signal that migration plans are not as far along, or as complete, as administrators might have thought. ®

Attack on BAE-managed system disrupts US bankruptcy courts

16 October 2026 at 13:29
The US' bankruptcy courts are currently down owing to what officials are calling a “cybersecurity incident.” The Administrative Office of the US Courts said the websites and systems that support the Bankruptcy Noticing Center (BNC), which manages electronic comms related to bankruptcy cases, were pulled offline while the vendor investigates. BAE Systems runs the affected systems and websites on behalf of the Federal Judiciary, and is “working to restore operations,” according to an announcement by the US Courts on Thursday. “As a result of the incident, all access to the BNC systems and websites that BAE operates on behalf of the judiciary and the related bankruptcy noticing process are unavailable at this time, including bnc.uscourts.gov, bankruptcynotices.uscourts.gov, notices.uscourts.gov, and the National Creditor Registration Service," it said. “The incident has also halted the BNC’s production and distribution of bankruptcy notices for bankruptcy courts.” While the public notice was published on Thursday, the issues affecting the BNC systems began a few days earlier, on October 9, according to the Bankruptcy Court of the Eastern District of Texas. Alongside its own announcement, the same court published a general order indicating that for any case filed on or after September 14 with an active motion to stay, that delay would be extended by an additional 30 days. The court said it will continue to accept filings, open cases, and process documents, but said there may be a delay in the entry and service of notices and orders until the issues are resolved. The courts' ability to process electronic and paper bankruptcy notices is affected, and it applies to federal bankruptcy courts across the country. A spokesperson at BAE told The Register: "BAE Systems, Inc. operates the Bankruptcy Noticing Center (BNC) on behalf of the Administrative Office of the U.S. Courts (AOUSC). We are aware of a security incident that is isolated to the BNC system and have taken immediate steps to address it. We are coordinating closely with AOUSC on the response." The disruption comes at a difficult time for the US public sector, which has struggled with multiple recent cyberattacks. ShinyHunters' attack on the FBI in September is doubtless the most high-profile of these, although the Arizona Judicial Branch confirmed an attack on the state’s court systems at around the same time. Officials said the “criminal hackers or their bots” were responsible for stealing personal data and backup court files. The US Courts also said in August 2025 that it was stepping up its cybersecurity measures in response to increased targeting of its case management system. ®

Thief snatches school snapper's SD cards in smash & grab

16 October 2026 at 09:15
An old-fashioned smash-and-grab job on a photographer’s vehicle threatens the security of pupils’ data as a UK secondary school says it faces a potential data protection pickle. Jon Curtis-Brignell, headteacher at Priory School in Lewes, said in an email this week that a company the school hired to take pupils’ annual school photos has alerted it to a data theft case after a vehicle was broken into. “Pret-a-Portrait has informed us that, overnight between 6 and 7 October, one of its vehicles was broken into and a camera bag containing SD memory cards was stolen,” Curtis-Brignell wrote. “Some of these cards may have contained photographs taken at Priory School, together with images of the QR code cards used for school photographs, which show pupils’ names and class names.” The headteacher said that the same equipment used to take the photos at Priory School was also used for three additional photography jobs after Pret-a-Portrait visited the school on October 1. Pret-a-Portrait, which has offices in the UK, Qatar, and the UAE, told the school that it believes “most, if not all” of the files containing pupils’ data will have been overwritten as a result, but it cannot be certain. Curtis-Brignell said that the potentially affected information included photographs, pupils’ names, and their “class information associated with the photography process.” Other types of data, such as addresses, contact details, financial information, medical information, and safeguarding records stored in the school’s own systems remain untouched. Nick Kerr, owner of Pret-a-Portrait, told The Register that no physical, printed photos were stored in the vehicle at the time of the break-in, and that it was not possible to determine the potential scope of the data protection violation. “As the email from Priory School explains, it is likely to be somewhere between a small subset of their pictures and none of them,” said Kerr. On a positive note, he said that there is nothing to suggest the files have been improperly accessed. “Our analysis reveals that no improper access to pictures from this job occurred in between the time of the theft and the pictures being taken offline.” Per the headteacher’s email, Pret-a-Portrait confirmed that it took a number of steps to mitigate the potential damage, including taking all school photos offline, changing the IDs used to access them, and changing its procedures so that all SD cards are wiped at the end of each commission. The company also “reviewed and strengthened its procedures following the incident,” and reported the matter to both the police and the ICO. “I appreciate that receiving an email of this nature may understandably cause concern,” Curtis-Brignell added. “We have worked closely with our Data Protection Officer and Pret-a-Portrait to understand what happened, establish the potential risk and ensure that appropriate action has been taken. “We wanted to be open with families about what has happened, while also reassuring you that there is currently no evidence that the information has been accessed or misused and that a number of steps have now been taken to prevent access to the affected photographs and reduce the risk of a similar incident occurring again.” ®

User refused to change her password because everyone already knew it

16 October 2026 at 07:28
Change is constant, but The Register likes to keep some things the same – such as using Friday mornings to bring you a new installment of On Call, the reader-contributed column that shares your tech support stories. This week, meet a reader we'll Regomize as "Daniel" who told us that in 2020 he was hired to replace a two-person IT department at a UK school. "The IT manager had left amid some 'accounting irregularities,' mainly involving high-end gaming PCs being purchased using school funds but never making it onto the school site," Daniel told On Call. "His deputy stepped up just in time to have to deal with a ransomware attack that took the school's entire network offline for three months." The school eventually hired external contractors to rebuild the network and restore from the only available backup, which was months old. The deputy IT manager then quit without serving their notice period. Daniel took the vacant job and in his first week the school principal asked him to audit the network and deliver a report explaining how to get things up to scratch. "I found a few quick wins, including the password policy which at the time was set to six letters. Just that, no complexity, no expiry," Daniel told On Call. "And users hadn't been forced to change them since before the ransomware attack. Or, indeed, ever." The principal approved Daniel's proposed password policy and a requirement for everyone to change their password immediately. "I was not prepared for the backlash this would create," Daniel wrote. The school's data manager proudly said she had used the same password since 1998 and justified keeping it on the grounds that everyone on staff knew it. "She said, 'If I'm not in, they can log in as me and run the reports.'" It gets worse: the password was "letmein" and the data manager had written it on a piece of paper and taped it to her desk. As Daniel rolled out the new password policy, more complaints rolled in. The school principal eventually told Daniel to direct all enquiries regarding the password changes to him. "Within two days, he came into my office, sighed, put his head in his hands, and ordered me to revert the change and to remove the requirement for everyone to change their password," Daniel wrote. "I resisted, I really did," he wrote. "But it was his school. I got him to put the request in writing." The principal left three months later, and a nonprofit took over the school. Daniel's new bosses agreed with his stance and reinstated his password policy. The data manager again fought the change. "After a meeting with me and the nonprofit's IT director, she decided to take early retirement, so she wouldn't have to learn the new systems – or change her beloved password." Have management or users rejected your advice? Click here to tell us what happened, and your story could appear in a future edition of On Call. ®

Researchers warned attackers could 'defrost the food' months before French supermarkets got hit

15 October 2026 at 19:23
Security researchers warned about exploitable vulnerabilities in refrigeration controllers months - and in one case, more than a year - before cyberattacks disrupted hundreds of French supermarkets. Late Sunday night, unknown criminals hacked thousands of controllers, cranking the heat as high as 122°F (50°C), spoiling food and sparking fires across nearly 700 of the country’s supermarkets. France's national cybersecurity agency ANSSI on Monday warned of widespread compromises involving Danfoss refrigeration controllers, and a day later added affected systems from Copeland and its Dixell brand. The compromised devices were accessible over the internet, with many reportedly no longer receiving software or security updates and others running outdated firmware. Danfoss did not immediately respond to The Register’s request for comment. Copeland emailed us the following statement: “We acknowledge the vulnerability identified in a discontinued, end-of-life generation of controllers. Protecting our customers’ operations has always been a top priority. We are currently working with impacted customers to mitigate the risk. We will continue to support customers in strengthening cybersecurity through supported products, current software and industry-recommended practices.” Operational technology (OT) security firm Claroty’s Team82 sounded the alarm on these buggy devices in August, warning that hackers could “freeze the controller” and “defrost the food.” At the time, the researchers published details of dozens of vulnerabilities, including authentication bypass and operating-system command execution flaws, affecting Danfoss AK-SM 800A and Copeland XWEB controllers. Even earlier, the US Cybersecurity and Infrastructure Security Agency (CISA) published advisories about security flaws in both brands’ controllers. In February, CISA said nearly two dozen CVEs in Copeland XWEB and XWEB Pro could be exploited to “allow an attacker to bypass authentication, cause a denial-of-service condition, cause memory corruption, and execute arbitrary code.” In a May 2025 advisory, updated in August 2025, CISA published a similar warning about buggy Danfoss AK-SM 8xxA series devices. “What makes this incident particularly striking is the timeline,” Tiago Henriques, chief underwriting officer at cyber insurance provider Coalition, told The Register. He noted that the French supermarket hacks happened two months after Team82 published its research, and Danfoss released a firmware update (R4.3.1) to mitigate the flaws. 'Critical exposure' continues “Yet, despite the availability of these patches, Coalition’s scanning identified critical exposure to these threats continuing well into the fall,” Henriques said. Between September 7 and October 6, Coalition’s sensors identified 1,506 unique IP addresses still publicly exposing a Danfoss StoreView web-accessible admin panel, and 820 of these - 54 percent - were associated with French networks. “Our scans counted at least 2,624 refrigeration controllers from the named brands with a login page open to the internet: 1,506 Danfoss StoreView and 1,119 XWEB,” he added, noting that one IP runs both types of controllers. To be clear: this doesn’t mean all of these controllers were vulnerable, but rather they were exposed to the open internet. Even after the cyberattacks - as of Thursday - 618 Danfoss devices remain connected to the internet, according to the insurance provider’s count. Of these, 206 are connected to French networks, while 50 are in the US, and two in the UK. “An unpatched device featuring a web-accessible admin panel can act as a major entry point” for digital attackers, Henriques said. “The takeaway is clear: digital risk extends far beyond workstations and email servers.” Criminals are targeting OT and other industrial devices that are connected to the internet, too. “Identifying these exposed access points before they are targeted can directly contribute to preserving business continuity,” Henriques said. OT cyber leaders call for CISA directive In America, a group of OT cybersecurity and technology providers doubled down on their call for stronger food and agriculture protections in the US. The French cyberattacks “are another stark reminder of the importance of implementing baseline cybersecurity measures to enhance operational technology cybersecurity,” the Operational Technology Cybersecurity Coalition (OTCC) said in a Wednesday statement. Earlier this month, the group, whose members include Claroty, Forescout, Honeywell, and Schneider Electric, called on CISA to issue a Binding Operational Directive to improve OT cybersecurity within the federal government. The OTCC repeated this demand on Wednesday and suggested that the US Department of Agriculture could encourage organizations in the food and agriculture sector to implement cybersecurity best practices. “While no incidents have been reported in the United States, malicious actors are undoubtedly viewing this incident as a potential attack vector to perform here,” the statement said. “We cannot wait for that to happen.”®

Spyware vendors found a way to make targeted ads even worse

15 October 2026 at 14:31
The online advertising industry has found a new way to make itself even more unpopular, with one adtech outfit accused of helping spyware vendors infect people's phones without them even clicking an ad. Researchers at Citizen Lab say they've uncovered the first publicly confirmed case of a zero-click mercenary spyware attack being delivered through targeted online ads, with devices at Al Jazeera among those infected. The technique, dubbed "AdFection," turns advertising networks into a spyware delivery system. Simply opening a website or app can be enough to trigger the attack, with no suspicious links or downloads involved. Israeli adtech firm Discover-Tech is allegedly behind the operation, according to researchers at Citizen Lab, which says the company acts as a middleman between the online advertising industry and multiple spyware and hacking vendors. "We present technical evidence that the Israel-based company Discover-Tech, while purporting to be a legitimate advertising company, appears to be a front for large-scale ad espionage abuse," the researchers wrote. “In fact, it appears that serving as this bridge is Discover-Tech’s primary purpose." Discover-Tech’s Controlium platform exploits the real-time bidding system that decides which ads appear on websites and apps. Every time someone loads a page, advertisers compete for available ad space and, in the process, receive information about the user's device and location. Discover-Tech allegedly used that data to identify specific targets and serve them malicious ads. One spyware vendor linked to the operation is Candiru, the Israeli developer now known as Integrity Labs. Citizen Lab traced attacks against at least 45 devices at Al Jazeera in 2024 and 2025 to Candiru spyware delivered through ads from Discover-Tech. Discover-Tech didn't have to sneak into the advertising system, as Google and IAB Europe had listed the company as an approved vendor since 2020, apparently unaware of what it was Citizen Lab claims it was doing with that access. Citizen Lab sifted through nearly four billion ad-bidding records and found Discover-Tech ads on more than 70,000 mobile apps and 120,000 websites between March and June 2026. Some reached networks belonging to government agencies, defense organizations, and NATO. Researchers found no evidence that those organizations were infected, but they say the ads could have been used to profile devices on those networks. The researchers said the operation also covertly directed millions of devices toward servers associated with Candiru, although those connections don't necessarily indicate spyware infections. Google has since terminated Discover-Tech's access to its advertising exchanges and removed it from its approved vendor lists. IAB Europe followed suit, while Beeswax, Vungle and Eskimi also took action. Discover-Tech and Candiru did not respond to Citizen Lab's requests for comment, nor ours. The researchers argue that the findings expose serious failings in an advertising industry that allowed a company with links to commercial surveillance operators to operate inside its supposedly vetted ecosystem for years. “Discover-Tech’s mass abuse, privacy invasion, and facilitation for mercenary spyware attacks illustrates structural flaws with the online advertising system, which failed to detect or prevent the abuse documented in this report,” Citizen Lab said. For years, the worst thing about targeted advertising was that it knew far too much about you. Turns out some advertisers were interested in much more than your shopping habits. ®

Bank of America had to bring in 1,000 contractors to patch all the bugs Mythos identified

15 October 2026 at 13:45
Bank of America recruited an additional 1,000 contractors to help patch all the vulnerabilities discovered by Anthropic’s Mythos model, the CEO said on Wednesday. Brian Moynihan, chairman and CEO at BoA, said during the company’s Q3 earnings call that it spent “a couple of hundred million plus” in remediation costs related to Mythos, and the anti-money laundering (AML) orders issued this week. These costs are expected to decline over time, though, with the contractors in place to help ease the initial burden of patching a large number of flaws, an issue that shouldn’t be so pronounced in the longer term. He went on to tell CNBC that the bank brought in outside help after concerns grew over how it would quickly tackle all the work associated with Mythos’ discoveries. The same concerns were shared globally, in part due to how Anthropic marketed Mythos as an all-powerful model that threatened the status quo of cybersecurity. While it ultimately turned out to be highly effective and capable of identifying complex vulnerabilities quicker than humans, leading to the massive influx of patches, some early adopters say it was no smarter than elite researchers. Mozilla CTO Bobby Holley said in April: "So far we've found no category or complexity of vulnerability that humans can find that this model can't," after Mythos found 271 flaws in Firefox 150. "We also haven't seen any bugs that couldn't have been found by an elite human researcher." The 1,000 contractors brought in by the bank in its Q2 added to its existing 3,000 technical staff. The contractors remain at the bank for now, although their assistance won’t be needed in the longer term. Moynihan told financial analysts on the bank’s earnings call that BoA has made its tech engineering workforce around 10 percent more efficient, and that each of the circa 130 AI-related projects it has running is expected to achieve a 2x or 3x return on investment over time. In 2026 alone, the CEO expects AI projects to deliver between $250 million and $300 million in benefits – a sum he expects to shoot up to $700 million by the end of 2027. He didn't detail how. The bank has also reduced around 3,000 roles, including a 5 percent decrease in the number of managers on the payroll, although it didn't specify how much of a role AI played. Moynihan didn’t break down how much of the “couple of hundred million plus” in remediation costs were devoted to AI or Mythos, compared to costs associated with cleaning up its AML issues, both of which the CEO lumped together. BoA’s share price slid more than 8 percent on Wednesday morning after it reported a 17 percent drop in profits owing to the $1.21 billion settlement it agreed to with the Treasury’s Financial Crimes Enforcement Network (FinCEN). The FinCEN order relates to BoA’s failure to police national security risks, including Chinese money laundering, and a failure to report over $5 billion in suspicious activity. FinCEN’s order was issued concurrently with a $750 million penalty from the Office of the Comptroller of the Currency, related to Bank Secrecy Act and AML compliance deficiencies. BoA also agreed an $11.6 million settlement with the Office of Foreign Assets Control for sanctions violations, including those related to Iran, Russia, narcotics, and global terrorism. ®

X purges 13,000 accounts linked to suspected meddling ahead of US midterms

15 October 2026 at 12:45
X says it has nuked more than 13,000 accounts involved in three suspected foreign influence operations targeting US political debate. In a post on Wednesday evening, the platform linked the operations to Iran, Russia, and China. It said the networks used inauthentic accounts to post and amplify political content targeting candidates and public figures across the political spectrum. The announcement comes ahead of the US midterm elections on November 3. "People come to X to talk about what's happening in the world, including the upcoming 2026 US midterms," the platform said. "Free speech is the bedrock of a functioning democracy, and we are proud that X is the global town square where these debates happen. Our job is to keep that conversation authentic, open, and safe." X did not publicly explain the evidence behind its attribution. Separately, it highlighted its Civic Integrity policy, which covers misleading information about how, when, and where to vote, as well as content intended to discourage participation. Reports submitted under "Civic Integrity" are routed into requests for Community Notes. X says it uses the crowdsourced feature alongside platform moderation and may label policy-breaking posts in critical cases. Community Notes has faced scrutiny. When the European Commission launched formal proceedings against X under the Digital Services Act in 2023, it raised questions about the feature's effectiveness for validating a post's accuracy. X's reliance on crowdsourced context follows layoffs and senior departures from its moderation teams after Musk acquired Twitter. Foreign influence campaigns aren't confined to US elections. MI5 chief Sir Ken McCallum said this week that Russia had attempted to interfere in the 2016 Brexit referendum, but cautioned against treating that as evidence it changed the result. ®

Legal Aid Agency hackers made off with records dating back to 1978

15 October 2026 at 11:23
Hackers who broke into the UK's Legal Aid Agency last year stole records dating back nearly five decades, the government has admitted, revealing the breach was far more extensive than previously thought. The Legal Aid Agency said on Wednesday that around 250,000 records stolen in the April 2025 attack date from before 2007, including one going back to 1978. That's much further back than the agency previously estimated ­­– it initially said the stolen data covered legal aid applications, claims, and payments from 2007. Most of the newly identified records date from the 1990s and 2000s, with only a “fractionally small number” originating before 1990. Still, the discovery raises an awkward question about just how much historical personal information was sitting in government systems when the attackers came knocking. That wasn't the only surprise in the stolen data, as the Ministry of Justice (MoJ) has also discovered that hackers accessed information from HM Prison and Probation Service (HMPPS), including names, dates of birth, nationalities, and case reference numbers for offenders supervised by probation services between 2010 and 2017. The government says the probation records concern a relatively small number of offenders, with more than 99 percent of the affected data relating to people under supervision in 2016 and 2017. It stressed that none of the stolen probation information relates to victims of crime. The latest revelations come almost 18 months after the Legal Aid Agency disclosed that criminals had accessed and downloaded a significant amount of sensitive personal information. The agency first detected the intrusion on April 23, 2025, but officials didn't establish the scale of the compromise until May 16. The government subsequently took the LAA's online services offline, leaving lawyers struggling to access the systems they needed to submit claims and manage cases. The disruption dragged on for months, with the agency's troubled return to service in December leaving legal aid providers battling delays and ongoing technical problems. Further forensic work has now revealed that the data theft goes back much further than officials originally believed. The compromised information varies by individual but could include names, addresses, dates of birth, National Insurance numbers, financial details, and information about legal proceedings. Some records also contain details of criminal charges, pleas, convictions, and sentences. Among the older material are records relating to legal aid benefit assessments dating from 1978 to 2012, and payments made under the Very High Cost Cases scheme between 1981 and 2004. The government cautioned that the presence of historical records doesn’t mean that everyone who applied for legal aid before 2007 had their information stolen, nor does the 250,000 figure represent a confirmed number of affected individuals. Explaining why it has taken so long to pin down the extent of the theft, the MoJ said the attackers stole information spread across several complex systems, much of it unstructured, fragmented, or incomplete. "Because of our increased capability to identify data, we have developed a more complete understanding of the information compromised," the agency said. The government says it has no indication that the stolen information has been published or shared, although that offers little certainty to anyone whose personal details may now be in criminal hands. Since the attack, the MoJ says it has tightened authentication and access controls, improved security monitoring, addressed vulnerabilities and begun retiring or isolating higher-risk technology. Work to modernize its legacy systems is also underway. The question of why records stretching back to the 1970s remained accessible in the first place is one the latest update does not answer. ®

US Air Force pilots used malware-laden USB drives to plan Afghanistan missions

15 October 2026 at 10:30
Welcome, once again, to PWNED, the weekly column where we gawk at organizations that have made serious security mistakes. Normally, we’re talking about businesses or maybe the odd school that messes up, but today we’re writing about a serious IT screwup in the world’s most powerful military. Have a story about someone leaving a gaping hole in their network? Share it with us at pwned@sitpub.com. Anonymity is available upon request. Today’s tale comes from Justin Henkel, the CISO of IT monitoring and service company SolarWinds. Henkel previously worked in IT security for the Air Force and one day in the early 2000s saw a practice that just wouldn’t fly today. Before USB drives became popular, burning CDs with mission data was the modus operandi, and those discs were put in both unclassified and classified systems. “They would write a CD, and then they would take that CD and then put it in a classified system and do the remainder of the mission planning,” Henkel told us. “Then they would take that disc and then put it in the airplane.” Inside the airplane, the data on the CD would help the pilot navigate and contain information about threats they might encounter. Later, when thumb drives became a thing, pilots used them instead of discs. “They didn't really think about the overall impact of classified versus unclassified systems,” Henkel said of the pilots. “Using the same device for both, they didn’t understand that you could read and write onto a USB drive with malware. [They were] not really understanding the overall threat picture.” According to Henkel, Air Force personnel would buy their flash drives from local vendors rather than sourcing them from official military contractors. If they were in Afghanistan, those drives could literally come from a store in Kabul. And it wasn’t exactly the equivalent of Best Buy. “It was more difficult to bring a US-based computer into the nation than it was just to buy local,” he said. “So they were just going out into the local market in Kabul or whatever city that they were out [in]. And I used to do this: go out, make relationships with the local vendors. ‘Hey I need 100 USB sticks.’” Unfortunately, enemies of the US noticed and soon started selling infected USB drives to local vendors in the Middle East. Henkel knew that using a sneakernet with classified systems was a recipe for disaster. It’s just that no one would listen to him. “It was just a shock,” he told us. “I was a young 22-year-old guy, very junior in the overall rank system, trying to tell colonels and majors that what they’re doing is a violation.” In 2008, the US Department of Defense was infected by malware after somebody attached an infected USB flash drive to a laptop with access to US Central Command. The worm, dubbed Agent.BTZ, could collect information from infected computers and communicate with remote servers. A 2016 report from the FBI and DHS attributed the malware to one or more Russian groups. It took the Pentagon 14 months to scrub it from its systems. It took this attack for the Pentagon to wise up in 2008 and ban the use of USB drives, instead forcing data transfers to go through more secure systems. Eventually, in 2010, the drives were allowed again under certain circumstances. ®

❌