McAfee’s Mobile Research Team identified more than 1,900 unique applications associated with the campaign across over 500,000 devices in more than 190 countries. Based on publication patterns, we estimate that the operators were releasing approximately 20 to 25 new applications per day, each leveraging different themes, brands, and impersonation targets. The highest concentrations of affected devices were observed in India, Russia, and the United States.
Most of these apps were published on the official android platform impersonating well-known products such as CapCut, Roblox, Zelle, PayPal, Netflix, Xbox Game Pass, Siri, iMessage, etc. under different developer accounts, they shared a common codebase, repeated the same deceptive behaviors, and contacted the same remote server, which told each app where to send its users. That destination was an advertising funnel and in our testing the ads it served led to third-party subscription-fraud pages billing as much as $49.99 per month
McAfee identified the malicious apps, conducted technical analysis, and reported its findings to Google through responsible disclosure channels. Following McAfee’s report, Google removed all of the identified apps from Google Play. McAfee is a member of the App Defense Alliance, which supports collaboration across the mobile ecosystem to improve user protection. McAfee Mobile Security detects these apps as a Medium-Risk Threat. For more information, and to get fully protected, visit McAfee Mobile Security.
The Global Impact
This fake app campaign reached consumers around the world, with McAfee researchers identifying more than 1,900 unique apps across over 500,000 devices in more than 190 countries.
McAfee’s detection data shows how the campaign appeared across key markets. In the United Kingdom, McAfee recorded 11,862 detections, in Germany (5,016 detections), France (4,288), Australia (1,434), and Japan (944).
Market
Devices protected
Global rank
Share of global
Fake apps seen
Top 3 lures
United Kingdom
10,582
#8 of 207
1.98%
970
Streaming/TV/sports (17%), video editors (13%), games (11%)
Germany
4,465
#16
0.84%
444
Health apps (22%), games (16%), AI tools (13%)
France
3,882
#19
0.72%
450
Streaming/TV/sports (20%), AI tools (17%), adult content (10%)
Australia
1,293
#42
0.24%
306
Video editors (16%), AI tools (16%), adult content (15%)
Japan
843
#55
0.16%
229
Health apps (29%), streaming/TV (18%), AI tools (11%)
These figures represent fake app encounters identified by McAfee, not total infections. It reflects where McAfee detected these apps rather than the overall infection rate in each country.
Different Regions, Different Fake App Lures
While the campaign used the same underlying tactics worldwide, the types of apps detected varied by region. Globally, fake video and photo editors accounted for 19% of detections, followed by streaming, TV, and sports apps (13%).
A closer look at individual markets reveals some notable differences:
United Kingdom: Streaming, TV, and sports apps led at 17% of detections, followed by video and photo editors at 13%.
Germany: Fake health apps accounted for 22% of detections, followed by games and game modifications at 16%.
France: Streaming, TV, and sports apps were the most common at 20%, followed by AI tool clones at 17%.
Australia: Video and photo editors and AI tool clones were nearly tied, each accounting for approximately 16% of detections.
Japan: Fake health apps stood out at 29% of detections, followed by streaming, TV, and sports apps at 18%.
These findings highlight how the same fake app campaign can appear in very different forms depending on what consumers are looking for. Whether it’s a health app, an AI assistant, a streaming service, or a popular game, familiar names and recognizable branding can make a fraudulent app appear trustworthy.
The risk isn’t limited to one country or one type of app. It’s the same underlying deception: an app that promises a familiar service but delivers something entirely different.
The Financial Impersonators
We identified fake apps impersonating Zelle, PayPal, Apple Pay, Mir Pay, Binance and several banks. One fake PayPal app had been downloaded 10,000+ times.
Zelle has no standalone consumer app: it lives inside your bank’s app so anyone searching Google Play for “Zelle” is already confused. And Apple Pay has no Android app at all, so users searching for it cannot find a legitimate result. Both are searches with no correct answer, which makes them ideal traffic to intercept.
Figure 1: Firsts result on Google Play of ‘Zelle’ search are Fake Applications
Combine that with an in-app browser whose address bar is hidden and whose destination the operator controls remotely, and the risk profile of a fake banking app is simply not the same as a fake video editor even when both currently do nothing worse than show ads.
From the user’s perspective the current risk is straightforward: they search Google Play for “Zelle”, the first results include fake apps, and installing it delivers not a banking guide but a stream of full-screen ads. Tapping one leads to a page requesting their credit card details for a “free” trial that then bills them monthly.
What Users Actually Got: Gambling Inventory, on an “Everyone” Rating
In multiple cases we observed a gambling-style quiz funnel: “Win Mega Jackpot,” “50,000 COINS DAILY,” “PLAY FOOTBALL QUIZ,” “Play Now.”
Now consider who was looking at those store pages: Among the apps still available for measurement at the time of our analysis, the ones impersonating children’s and teenagers’ brands had been downloaded more than 86,000 times:
Downloads
App title
Package Name
50,000+
Roblox
com.sitaram.robloxgame1
10,000+
Roblox
com.sitaram.robloxgame3
10,000+
Netflix Game Controller
netflixgamecontroller.uzair1
10,000+
Netflix Game Controller: Play
netflixgamecontroller.uzair2
5,000+
Xbox Game Pass: Play Games
xboxgame.abdul2
1,000+
Fall Guys for Mobile
com.react.fallguysgame1
Across the full campaign we identified 37 apps impersonating games and services aimed at young players: Roblox, Minecraft, Fall Guys, Brawl Stars, Clash of Clans, Deltarune, Xbox Game Pass even GTA VI.
Figure 2: Fake Xbox App with over 5,000 installations
Every one of these listings carried an “Everyone” content rating.
So, the chain runs: a child searches Google Play for Roblox, installs an app called Roblox with the Roblox logo, rated suitable for everyone — and is funneled into gambling-style prize inventory that the operator can redirect at will. No exploit, no permission prompt, no warning.
The Searches With No Correct Answer
One application captured this strategy particularly well: Published as “AppStore: App Downloader,” the application used a legacy Appstore icon and presented itself as an Android version of Apple’s official software marketplace.
Figure 3: Fake AppStore on Google Play with over 1K Downloads
A legitimate Apple App Store cannot exist on Android because Apple operates the App Store exclusively for its own platforms, and the iOS applications it distributes are not compatible with Android’s operating system or application format. Any Android app claiming to be Apple’s App Store is therefore impersonating the service rather than providing the official marketplace.
“AppStore: App Downloader” was not an alternative marketplace but an advertising funnel disguised with Apple’s branding, rated for all users, and distributed through Google Play.
There is no App Store, Siri, iMessage, FaceTime nor Apple Pay app for Android. Zelle has no standalone consumer app, it lives inside your bank app. Every one of those is a search people perform on Google Play every day, and every one of them is a search with no legitimate result.
Figure 4: Multiple fake apps that does not officially exist on Android
The user’s own intent is the vulnerability: they want the thing, they cannot have the thing, and something appears that looks exactly like the thing. No security control mediates that moment. It is not a technical failure at all: it is a person trusting a logo, which is precisely what logos are for.
How Are the Ads Displayed?
Each app is a shell. It wears the branding of something people search for — CapCut, Roblox, Zelle, PayPal, Netflix, Huawei Health, Xbox Game Pass, Siri, iMessage — and behind that branding it contains no real product. What it contains is a redirector.
On launch, the app contacts a server controlled by the operator:
`hxxps://rewadevelopments[.]online/data/.json`
The server replies with a small configuration block. One field in that block, `qureka_url`, holds a web address. The app takes that address and opens it in an in-app browser window, a Chrome Custom Tab, configured with the URL bar hidden.
In every case we observed, the address served was a gambling-style quiz site promising daily coin rewards. Users did not get a CapCut tutorial or a Zelle guide. They got an endless funnel of ad and quiz pages, monetized by the operator.
The mechanism matters more than today’s payload. Because the destination is fetched from the server at every launch, the operator can change where these apps send users at any moment, for any single app, without shipping an update and without passing store review again. An app wearing a bank’s logo, opening a browser window with the address bar hidden, pointed wherever the operator chooses, is a capability that can be used for phishing and credential exfiltration.
Figure 5: Ads severed from the website loaded in full screen that funnel to subscription fraud.
The full-screen ads users encounter are not served by the app. Its own ad slots are configured with Google’s public test IDs, which generate no revenue — so the app earns nothing from advertising itself. The ads come from the website the app opens: the destination supplied in the remote JSON configuration. That page’s ad inventory is filled with deceptive offers which, when tapped, lead to credit-card forms tied to subscription-fraud billing.
What Makes These Apps Interesting Is What They Do Not Do
There is no exploit, privilege escalation, rooting attempt, dynamic code loading, obfuscation, encrypted payload, or dropper chain. The applications request no dangerous Android permissions. From the perspective of conventional static analysis, their code presents few of the indicators typically associated with Android malware.
This campaign avoids many of those controls because its primary deception occurs outside the application code. Rather than exploiting a software vulnerability, the operators exploit the user’s trust in an official app store and in recognizable brands.
The post-installation behavior can remain technically simple, as it does here with advertising redirection, because persuading the user to install the application is the most critical stage of the operation.
The affected users did not need to follow a malicious link or sideload an APK from an unofficial forum. They searched an official application store for a product they recognized, and the search results presented an application with the expected name, logo, and visual identity.
How to protect yourself
Install financial apps only from your bank’s own website or a verified link. If you are searching for an app store for a payment brand, you are in the exact position this campaign targets.
Be suspicious of “guide,” “tutorial,” “helper” and “tips” apps for products you already use.
Legitimate services do not need a third party to explain them.
Check the developer’s name, not just the app name and icon. A real brand’s app is published by that brand.
If a product doesn’t exist on your platform, no app can provide it. There is no Apple Pay, Siri, or iMessage for Android.
Ignore install counts as a trust signal. Several of these apps had tens of thousands of downloads.
Run mobile security software. McAfee Mobile Security detects this family.
Conclusion
Mobile security has genuinely improved. Permissions are narrower, sandboxing is stronger, exploit mitigations are routine, store review catches more than it used to, and AI now finds obfuscated payloads at a scale no human team could match. Every one of those defenses works but none of them was tested here.
Attackers move to one part of the system that cannot be patched: the judgment of the person holding the phone. And they apply pressure exactly where that judgment is weakest — a familiar logo, an official store, a name that matches what you searched for.
These apps are adware or a medium risk threat rather than malware because the fraudulent content is not theirs. The app opens a web page chosen by its operator; that page’s advertising slots are filled by open programmatic ad exchanges, which sell to whichever advertiser bids. The subscription-fraud pages belong to those advertisers.
As threat actors continue to exploit trust rather than software vulnerabilities, McAfee remains committed to protecting users, raising awareness, and collaborating across the industry to ensure that seemingly harmless applications do not evolve into large-scale fraud operations.
Every time a big Amazon sales event takes place, shoppers flock to the deals. And scammers know it.
This year, Amazon has added a new Prime Day event Oct 6-7 called Amazon’s Prime Big Deal Days event. And in preparation, we’re breaking down the ways scammers use AI-driven manipulation to create fake Amazon websites, send delivery scam texts, impersonate customer support agents, and make scams look more convincing than ever.
Recent McAfee research suggests shoppers may be especially vulnerable in 2026. Forty percent of consumers say they would trust a lower-priced deal without verifying it first, while 29% admit they would skip researching a seller if the price looked good enough.
That combination of urgency, discounts, and increasingly sophisticated scams creates the perfect environment for fraud.
“Anyone who has ever fallen for a scam thought they would recognize one first,” McAfee’s Head of Threat Research Abhishek Karnik reminds shoppers.
“That confidence is part of what scammers count on,” he says. “Tools like McAfee exist precisely for those moments, flagging suspicious links, messages, and offers in real time, before a split-second decision becomes a costly one.”
Here are the most common Amazon Prime Day scams to watch for in 2026 and the warning signs that can help you avoid them.
Scam Type
How It Works
Red Flags
Fake shopping websites
Fraudulent websites mimic real retailers and disappear after collecting payments
Prices far below competitors, little company information, newly created websites
Fake social media ads
Ads promote products that never arrive or are counterfeit
Codes placed on flyers, posters, packages, or public locations
Brushing scams
Unsolicited packages arrive at your home
Items you never ordered, requests to scan codes or leave reviews
Fake recall scams
Messages claim a recent purchase has been recalled
Requests for payment, account credentials, or personal information
Here are examples of Amazon-related scam texts our team came across near Prime day last year, McAfee’s Scam Detector helped detect and stop these messages:
Figure 1. Examples of Amazon tariff and job scams
Figure 2. An example of a fake Amazon sign-in page.
Figure 3. Examples of Amazon phishing scams
Why Prime Day Scams Work
Major shopping events create the exact conditions scammers rely on: urgency, distraction, and the promise of savings.
82% of consumers prioritize finding the cheapest deal when shopping online
55% spend more time hunting for discounts
40% would trust a lower-priced deal without verifying it
29% would skip researching a seller if the deal looked especially good
23% feel pressure to act quickly before a deal disappears
“What the data reflects is that economic pressure has effectively done some of the scammer’s work for them,” says Abhishek Karnik, Head of Threat Research at McAfee. “When consumers are already primed to move quickly and prioritize price over authenticity, it takes far less effort to push them toward a bad click or a fraudulent purchase.”
How to Protect Yourself This Prime Day
The good news? These scams are preventable if you know what to watch for and take the right precautions. Here’s your defense playbook:
Verify Before You Trust
Amazon will never call you about suspicious account activity or unauthorized purchases
Always log into your Amazon account directly through amazon.com to check for real issues
Use Amazon’s Message Center – all legitimate communications from Amazon appear there
Never give personal information, passwords, or payment details over the phone
Watch for Red Flags
Urgent language demanding immediate action (“Your account will be closed in 24 hours!”)
Requests for payment via gift cards, wire transfers, or cash
Claims that you need to “verify” or “legalize” your money
Transfers to “government agencies” during the same call
Pressure to keep the call secret or not hang up
How to Protect Your Shopping Experience
Enable two-factor authentication on your Amazon account
Only shop on secure websites (look for “https://” and the padlock icon)
Monitor your bank and credit card statements regularly
Never click links in suspicious emails – go directly to the retailer’s website instead.
Use reputable online protection like McAfee to keep you safer from online shopping scams
Trust your gut – if it feels too urgent or too good to be true, it probably is
Together, these protections are designed to address the broader range of online risks people face every day.
No matter where you live in the U.S., AI-driven scams and deceptive content are increasingly filling our feeds, alerts, and inboxes with moments that make us stop and ask: “Is this real?”
But the scams and threats Americans encounter aren’t the same everywhere. Where you live can shape the types of scams reaching your devices, how often you encounter them, and even how those experiences affect the way you behave online.
This 50-state breakdown combines McAfee consumer research with McAfee Labs data to show how Americans are experiencing scams, how those experiences are affecting trust and behavior online, and which text-based scams are reaching devices across the country.
The consumer findings come from a nationally representative survey of 5,000 U.S. adults, with 100 respondents in each state. The survey explores people’s exposure to scams, financial losses, changing online behaviors, concerns about AI and the mental effort involved in deciding what to trust online.
Alongside those findings, McAfee Labs analyzed text-based scam activity across the U.S. from May through July 2026. That data provides a view into the volume, concentration and types of scam texts McAfee observed in each state during the three-month analysis period.
Together, the two datasets offer different views of the same problem: what people say they are experiencing and how it affects them, alongside the scam activity McAfee is seeing in the wild.
Alabama
Key takeaway: Alabama had the highest scam-text rate per device in McAfee’s analysis, while scam concerns are also changing how residents behave online.
66% say figuring out what’s real online takes more mental energy than it did a year ago.
60% check whether something online is legitimate at least weekly.
19% say they do that checking several times a day.
45% have encountered an AI-generated image presented as real.
83% are concerned AI is making scams harder to recognize.
64% have avoided an unfamiliar retailer because of scam concerns.
42% have ignored a legitimate call, text or email because they feared a scam.
41% have avoided trying a new app, website or service.
39% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams were the leading text-scam category detected in Alabama.
McAfee detected 5.14 scam texts per device, the highest rate in the country.
Alaska
Key takeaway: Alaska has one of the widest gaps between rising trust fatigue and active checking: 54% report more mental effort, but only 44% verify online content at least weekly.
54% say figuring out what’s real online takes more mental energy than a year ago.
44% check online legitimacy at least weekly.
13% say they check several times a day.
44% have encountered an AI-generated image presented as real.
82% are concerned AI is making scams harder to recognize.
48% have avoided an unfamiliar retailer.
39% have ignored a legitimate call, text or email.
40% have avoided trying a new app, website or service.
34% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams were the leading text-scam category detected in Alaska.
Arizona
Key takeaway: Arizonans are feeling a pronounced trust burden, with 65% saying it now takes more mental energy to decide what’s real online.
65% report greater mental effort figuring out what’s real online.
60% check online legitimacy at least weekly.
17% check several times a day.
41% have encountered an AI-generated image presented as real.
81% are concerned AI is making scams harder to recognize.
43% have avoided unfamiliar retailers.
44% have ignored a legitimate call, text or email.
31% have avoided trying a new app, website or service.
39% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Arizona’s text-scam volume.
Arkansas
Key takeaway: Arkansas residents are relatively active verifiers: 64% check online legitimacy at least weekly even though only about half report greater mental strain.
51% say figuring out what’s real online takes more mental energy.
64% verify online content at least weekly.
22% check several times a day.
38% have encountered an AI-generated image presented as real.
77% are concerned AI is making scams harder to recognize.
46% have avoided unfamiliar retailers.
42% have ignored a legitimate call, text or email.
32% have avoided trying a new app, website or service.
32% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Arkansas text-scam volume.
California
Key takeaway: California has one of the heaviest trust burdens in the survey: 72% say figuring out what’s real online now takes more mental energy.
72% report greater mental effort deciding what’s real online.
58% verify online content at least weekly.
20% check several times a day.
41% have encountered an AI-generated image presented as real.
83% are concerned AI is making scams harder to recognize.
49% have avoided unfamiliar retailers.
43% have ignored a legitimate call, text or email.
32% have avoided trying a new app, website or service.
38% have avoided clicking a legitimate message or link.
Among Californians surveyed who lost money to scams, 72% recovered none of it.
Investment and cryptocurrency scams led California’s text-scam volume.
Colorado
Key takeaway: Colorado’s clearest signal is concern about AI-enabled scams, shared by 85% of residents surveyed.
59% report greater mental effort figuring out what’s real online.
56% verify online content at least weekly.
15% check several times a day.
38% have encountered an AI-generated image presented as real.
85% are concerned AI is making scams harder to recognize.
42% have avoided unfamiliar retailers.
45% have ignored a legitimate call, text or email.
35% have avoided trying a new app, website or service.
34% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Colorado’s text-scam volume.
Connecticut
Key takeaway: Connecticut residents report rising trust fatigue, yet fewer than half say they verify online content every week.
57% say figuring out what’s real takes more mental energy.
47% verify online content at least weekly.
18% check several times a day.
35% have encountered an AI-generated image presented as real.
79% are concerned AI is making scams harder to recognize.
33% have avoided unfamiliar retailers.
36% have ignored a legitimate call, text or email.
26% have avoided a new app, website or service.
24% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Connecticut’s text-scam volume.
Delaware
Key takeaway: Delaware stands out for exposure to synthetic imagery, with 46% encountering an AI-generated image presented as real.
53% report greater mental effort figuring out what’s real online.
53% verify online content at least weekly.
8% check several times a day.
46% have encountered an AI-generated image presented as real.
80% are concerned AI is making scams harder to recognize.
47% have avoided unfamiliar retailers.
34% have ignored a legitimate call, text or email.
30% have avoided a new app, website or service.
33% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Delaware’s text-scam volume.
Florida
Key takeaway: Floridians are active online reality-checkers, with 63% verifying messages, offers, websites or people at least weekly.
56% report greater mental effort figuring out what’s real online.
63% verify online content at least weekly.
18% check several times a day.
43% have encountered an AI-generated image presented as real.
85% are concerned AI is making scams harder to recognize.
43% have avoided unfamiliar retailers.
37% have ignored a legitimate call, text or email.
42% have avoided a new app, website or service.
27% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Florida text-scam volume.
From our McAfee Labs Research: This shows approximate location of all the scams received
Georgia
Key takeaway: Georgia had the second-highest scam-text-per-device rate highlighted by McAfee, at 4.67.
59% report greater mental effort figuring out what’s real online.
60% verify online content at least weekly.
25% check several times a day.
33% have encountered an AI-generated image presented as real.
80% are concerned AI is making scams harder to recognize.
40% have avoided unfamiliar retailers.
37% have ignored a legitimate call, text or email.
27% have avoided a new app, website or service.
35% have avoided clicking a legitimate message or link.
McAfee detected an average of 4.67 scam texts per device.
Investment and cryptocurrency scams led Georgia’s text-scam volume.
Hawaii
Key takeaway: Hawaii had the country’s highest scam intensity among affected devices: those receiving at least one scam text averaged 8.45 over three months.
56% report greater mental effort figuring out what’s real online.
54% verify online content at least weekly.
13% check several times a day.
38% have encountered an AI-generated image presented as real.
81% are concerned AI is making scams harder to recognize.
47% have avoided unfamiliar retailers.
38% have ignored a legitimate call, text or email.
37% have avoided a new app, website or service.
37% have avoided clicking a legitimate message or link.
Affected devices averaged 8.45 scam texts, the highest figure nationally.
Investment and cryptocurrency scams led Hawaii’s text-scam volume.
62% report more mental effort figuring out what’s real online.
49% verify online content at least weekly.
13% check several times a day.
43% have encountered an AI-generated image presented as real.
82% are concerned AI is making scams harder to recognize.
48% have avoided unfamiliar retailers.
35% have ignored a legitimate call, text or email.
40% have avoided a new app, website or service.
38% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Idaho’s text-scam volume.
Illinois
Key takeaway: Two-thirds of Illinois residents say deciding what’s real online is taking more mental energy than a year ago.
66% report more mental effort figuring out what’s real online.
59% verify online content at least weekly.
18% check several times a day.
39% have encountered an AI-generated image presented as real.
75% are concerned AI is making scams harder to recognize.
40% have avoided unfamiliar retailers.
26% have ignored a legitimate call, text or email.
32% have avoided a new app, website or service.
24% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Illinois text-scam volume.
Indiana
Key takeaway: Indiana’s scam anxiety is translating into caution: 81% are concerned about AI making scams harder to recognize and 60% verify online content weekly.
62% report more mental effort figuring out what’s real online.
60% verify online content at least weekly.
18% check several times a day.
46% have encountered an AI-generated image presented as real.
81% are concerned AI is making scams harder to recognize.
38% have avoided unfamiliar retailers.
41% have ignored a legitimate call, text or email.
35% have avoided a new app, website or service.
35% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Indiana text-scam volume.
55% report more mental effort figuring out what’s real online.
47% verify online content at least weekly.
17% check several times a day.
33% have encountered an AI-generated image presented as real.
81% are concerned AI is making scams harder to recognize.
43% have avoided unfamiliar retailers.
32% have ignored a legitimate call, text or email.
33% have avoided a new app, website or service.
34% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Iowa text-scam volume.
Kansas
Key takeaway: Kansas has one of the bleakest recovery pictures in the survey: 75% of scam victims who lost money recovered none of it.
61% report more mental effort figuring out what’s real online.
51% verify online content at least weekly.
10% check several times a day.
40% have encountered an AI-generated image presented as real.
80% are concerned AI is making scams harder to recognize.
42% have avoided unfamiliar retailers.
39% have ignored a legitimate call, text or email.
40% have avoided a new app, website or service.
32% have avoided clicking a legitimate message or link.
75% of victims who lost money said they recovered none of it.
Investment and cryptocurrency scams led Kansas text-scam volume.
Kentucky
Key takeaway: Kentucky is the standout verification state: 76% say they check whether online content is legitimate at least weekly.
62% report more mental effort figuring out what’s real online.
76% verify online content at least weekly.
19% check several times a day.
41% have encountered an AI-generated image presented as real.
83% are concerned AI is making scams harder to recognize.
46% have avoided unfamiliar retailers.
30% have ignored a legitimate call, text or email.
39% have avoided a new app, website or service.
25% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Kentucky text-scam volume.
Louisiana
Key takeaway: Louisiana combines comparatively low trust fatigue with severe financial consequences: 73% of victims who lost money recovered none of it.
45% report more mental effort figuring out what’s real online.
54% verify online content at least weekly.
13% check several times a day.
35% have encountered an AI-generated image presented as real.
75% are concerned AI is making scams harder to recognize.
43% have avoided unfamiliar retailers.
37% have ignored a legitimate call, text or email.
32% have avoided a new app, website or service.
30% have avoided clicking a legitimate message or link.
73% of victims who lost money said they recovered none of it.
Investment and cryptocurrency scams led Louisiana text-scam volume.
Maine
Key takeaway: Maine is one of only two states where toll and traffic scams, rather than investment and crypto scams, ranked first in McAfee’s text telemetry.
64% report more mental effort figuring out what’s real online.
59% verify online content at least weekly.
13% check several times a day.
39% have encountered an AI-generated image presented as real.
81% are concerned AI is making scams harder to recognize.
46% have avoided unfamiliar retailers.
34% have ignored a legitimate call, text or email.
34% have avoided a new app, website or service.
30% have avoided clicking a legitimate message or link.
Toll and traffic violation scams were Maine’s leading text-scam category.
Maryland
Key takeaway: Marylanders show particularly high concern about AI-enabled fraud, with 86% saying AI is making scams harder to recognize.
65% report more mental effort figuring out what’s real online.
60% verify online content at least weekly.
25% check several times a day.
45% have encountered an AI-generated image presented as real.
86% are concerned AI is making scams harder to recognize.
46% have avoided unfamiliar retailers.
45% have ignored a legitimate call, text or email.
37% have avoided a new app, website or service.
44% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Maryland text-scam volume.
Massachusetts
Key takeaway: Massachusetts has a striking trust gap: 65% report more mental effort deciding what’s real, but only 48% verify online content at least weekly.
65% report more mental effort figuring out what’s real online.
48% verify online content at least weekly.
15% check several times a day.
46% have encountered an AI-generated image presented as real.
86% are concerned AI is making scams harder to recognize.
47% have avoided unfamiliar retailers.
35% have ignored a legitimate call, text or email.
37% have avoided a new app, website or service.
38% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Massachusetts text-scam volume.
Michigan
Key takeaway: Michigan joins Maine as the only state where toll and traffic scams outranked investment and cryptocurrency scams.
71% report more mental effort figuring out what’s real online.
52% verify online content at least weekly.
21% check several times a day.
43% have encountered an AI-generated image presented as real.
71% are concerned AI is making scams harder to recognize.
40% have avoided unfamiliar retailers.
35% have ignored a legitimate call, text or email.
34% have avoided a new app, website or service.
32% have avoided clicking a legitimate message or link.
Toll and traffic violation scams were Michigan’s leading text-scam category.
Minnesota
Key takeaway: Minnesota records the highest AI-scam concern in the state crosstabs, at 91%.
60% report more mental effort figuring out what’s real online.
59% verify online content at least weekly.
10% check several times a day.
47% have encountered an AI-generated image presented as real.
91% are concerned AI is making scams harder to recognize.
44% have avoided unfamiliar retailers.
44% have ignored a legitimate call, text or email.
38% have avoided a new app, website or service.
34% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Minnesota text-scam volume.
Mississippi
Key takeaway: Mississippi had one of the heaviest scam-text loads in McAfee’s analysis, averaging roughly 4.64 scam texts per device.
55% report more mental effort figuring out what’s real online.
54% verify online content at least weekly.
17% check several times a day.
32% have encountered an AI-generated image presented as real.
82% are concerned AI is making scams harder to recognize.
43% have avoided unfamiliar retailers.
34% have ignored a legitimate call, text or email.
34% have avoided a new app, website or service.
35% have avoided clicking a legitimate message or link.
McAfee detected roughly 4.64 scam texts per device.
Investment and cryptocurrency scams led Mississippi text-scam volume.
Missouri
Key takeaway: Missouri residents show a confidence problem around AI scams: 13% said they were not at all confident spotting AI-created or AI-enhanced fraud.
63% report more mental effort figuring out what’s real online.
60% verify online content at least weekly.
16% check several times a day.
41% have encountered an AI-generated image presented as real.
85% are concerned AI is making scams harder to recognize.
43% have avoided unfamiliar retailers.
40% have ignored a legitimate call, text or email.
39% have avoided a new app, website or service.
35% have avoided clicking a legitimate message or link.
13% said they’re not at all confident they could spot a scam enhanced by AI
Investment and cryptocurrency scams led Missouri text-scam volume.
Montana
Key takeaway: Montana has the highest reported exposure to AI-generated images presented as real, at 51%.
63% report more mental effort figuring out what’s real online.
49% verify online content at least weekly.
11% check several times a day.
51% have encountered an AI-generated image presented as real.
84% are concerned AI is making scams harder to recognize.
47% have avoided unfamiliar retailers.
44% have ignored a legitimate call, text or email.
43% have avoided a new app, website or service.
37% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Montana text-scam volume.
Nebraska
Key takeaway: Nebraska’s strongest signal is AI concern: 87% say AI is making online scams harder to recognize.
56% report more mental effort figuring out what’s real online.
50% verify online content at least weekly.
8% check several times a day.
43% have encountered an AI-generated image presented as real.
87% are concerned AI is making scams harder to recognize.
41% have avoided unfamiliar retailers.
35% have ignored a legitimate call, text or email.
40% have avoided a new app, website or service.
29% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Nebraska text-scam volume.
Nevada
Key takeaway: Nevada has the broadest reported scam exposure in the survey, with 95% encountering at least one type of scam in the past year.
60% report more mental effort figuring out what’s real online.
66% verify online content at least weekly.
18% check several times a day.
43% have encountered an AI-generated image presented as real.
82% are concerned AI is making scams harder to recognize.
45% have avoided unfamiliar retailers.
33% have ignored a legitimate call, text or email.
32% have avoided a new app, website or service.
33% have avoided clicking a legitimate message or link.
95% encountered at least one type of scam in the past year.
Investment and cryptocurrency scams led Nevada text-scam volume.
New Hampshire
Key takeaway: New Hampshire shows another trust gap: 59% report more mental effort figuring out what’s real, while 46% verify online content weekly.
59% report more mental effort figuring out what’s real online.
46% verify online content at least weekly.
10% check several times a day.
48% have encountered an AI-generated image presented as real.
85% are concerned AI is making scams harder to recognize.
50% have avoided unfamiliar retailers.
34% have ignored a legitimate call, text or email.
37% have avoided a new app, website or service.
33% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led New Hampshire text-scam volume.
New Jersey
Key takeaway: New Jersey residents report unusually frequent scam exposure, with 30% saying they encounter four or more scam attempts on a typical day.
61% report more mental effort figuring out what’s real online.
61% verify online content at least weekly.
18% check several times a day.
43% have encountered an AI-generated image presented as real.
82% are concerned AI is making scams harder to recognize.
49% have avoided unfamiliar retailers.
34% have ignored a legitimate call, text or email.
37% have avoided a new app, website or service.
36% have avoided clicking a legitimate message or link.
30% report encountering at least four scam attempts on a typical day.
Investment and cryptocurrency scams led New Jersey text-scam volume.
New Mexico
Key takeaway: New Mexico has one of the toughest scam-recovery pictures: 72% of victims who lost money recovered none of it.
65% report more mental effort figuring out what’s real online.
59% verify online content at least weekly.
16% check several times a day.
39% have encountered an AI-generated image presented as real.
79% are concerned AI is making scams harder to recognize.
42% have avoided unfamiliar retailers.
48% have ignored a legitimate call, text or email.
38% have avoided a new app, website or service.
44% have avoided clicking a legitimate message or link.
72% of victims who lost money said they recovered none of it.
Investment and cryptocurrency scams led New Mexico text-scam volume.
New York
Key takeaway: New York’s most striking behavioral signal is comparatively low retailer avoidance: 33% have stayed away from unfamiliar sellers because of scam concerns.
59% report more mental effort figuring out what’s real online.
58% verify online content at least weekly.
19% check several times a day.
41% have encountered an AI-generated image presented as real.
78% are concerned AI is making scams harder to recognize.
33% have avoided unfamiliar retailers.
37% have ignored a legitimate call, text or email.
27% have avoided a new app, website or service.
27% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led New York text-scam volume.
Displays the number of scams seen per unique device
North Carolina
Key takeaway: North Carolina stands out on recovery: 42% of scam victims who lost money said they recovered all of it.
53% report more mental effort figuring out what’s real online.
65% verify online content at least weekly.
17% check several times a day.
33% have encountered an AI-generated image presented as real.
69% are concerned AI is making scams harder to recognize.
38% have avoided unfamiliar retailers.
38% have ignored a legitimate call, text or email.
29% have avoided a new app, website or service.
29% have avoided clicking a legitimate message or link.
42% of victims who lost money reported recovering all of it.
Investment and cryptocurrency scams led North Carolina text-scam volume.
North Dakota
Key takeaway: North Dakota had the country’s highest concentration of scams in analyzed text traffic, at 2.8%.
61% report more mental effort figuring out what’s real online.
55% verify online content at least weekly.
13% check several times a day.
46% have encountered an AI-generated image presented as real.
83% are concerned AI is making scams harder to recognize.
48% have avoided unfamiliar retailers.
40% have ignored a legitimate call, text or email.
40% have avoided a new app, website or service.
37% have avoided clicking a legitimate message or link.
2.8% of analyzed text traffic was classified as scams, the highest share nationally.
Investment and cryptocurrency scams led North Dakota text-scam volume.
Ohio
Key takeaway: Ohio stands out for financial harm: 41% of respondents say they lost money to an online scam in the past year.
59% report more mental effort figuring out what’s real online.
63% verify online content at least weekly.
20% check several times a day.
46% have encountered an AI-generated image presented as real.
73% are concerned AI is making scams harder to recognize.
44% have avoided unfamiliar retailers.
33% have ignored a legitimate call, text or email.
33% have avoided a new app, website or service.
30% have avoided clicking a legitimate message or link.
41% report losing money to an online scam in the past year.
Investment and cryptocurrency scams led Ohio text-scam volume.
Oklahoma
Key takeaway: Oklahoma consumers are feeling the mental load of navigating AI-powered scams: 85% are concerned AI is making scams harder to recognize, while half say figuring out what’s real online requires more mental effort.
56% verify online content at least weekly.
19% check several times a day.
47% have encountered an AI-generated image presented as real.
85% are concerned AI is making scams harder to recognize.
50% have avoided unfamiliar retailers.
46% have ignored a legitimate call, text or email.
39% have avoided a new app, website or service.
43% have avoided clicking a legitimate message or link.
10% say they never spend time checking whether online content is legitimate.
Investment and cryptocurrency scams led Oklahoma text-scam volume.
Oregon
Key takeaway: Oregon scam concerns are spilling into ordinary digital life, with 45% avoiding new apps, websites or services.
57% report more mental effort figuring out what’s real online.
49% verify online content at least weekly.
17% check several times a day.
41% have encountered an AI-generated image presented as real.
85% are concerned AI is making scams harder to recognize.
52% have avoided unfamiliar retailers.
45% have ignored a legitimate call, text or email.
45% have avoided a new app, website or service.
39% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Oregon text-scam volume.
Pennsylvania
Key takeaway: Pennsylvania has one of the heavier trust burdens in the survey, with 67% saying figuring out what’s real takes more mental energy.
67% report more mental effort figuring out what’s real online.
54% verify online content at least weekly.
14% check several times a day.
39% have encountered an AI-generated image presented as real.
85% are concerned AI is making scams harder to recognize.
48% have avoided unfamiliar retailers.
38% have ignored a legitimate call, text or email.
37% have avoided a new app, website or service.
31% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Pennsylvania text-scam volume.
Rhode Island
Key takeaway: Rhode Island scam concerns are affecting legitimate online behavior: 42% have avoided clicking a real message or link.
58% report more mental effort figuring out what’s real online.
57% verify online content at least weekly.
11% check several times a day.
45% have encountered an AI-generated image presented as real.
84% are concerned AI is making scams harder to recognize.
40% have avoided unfamiliar retailers.
37% have ignored a legitimate call, text or email.
36% have avoided a new app, website or service.
42% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Rhode Island text-scam volume.
South Carolina
Key takeaway: South Carolina has a confidence problem around AI scams: 13% say they are not at all confident identifying AI-created or AI-enhanced fraud.
57% report more mental effort figuring out what’s real online.
47% verify online content at least weekly.
12% check several times a day.
44% have encountered an AI-generated image presented as real.
79% are concerned AI is making scams harder to recognize.
43% have avoided unfamiliar retailers.
42% have ignored a legitimate call, text or email.
38% have avoided a new app, website or service.
39% have avoided clicking a legitimate message or link.
13% say they are not at all confident identifying AI-created or AI-enhanced fraud.
Investment and cryptocurrency scams led South Carolina text-scam volume.
South Dakota
Key takeaway: South Dakota’s scam response is relatively restrained compared with many states, with 35% avoiding unfamiliar retailers and 29% avoiding legitimate links.
55% report more mental effort figuring out what’s real online.
52% verify online content at least weekly.
11% check several times a day.
41% have encountered an AI-generated image presented as real.
78% are concerned AI is making scams harder to recognize.
35% have avoided unfamiliar retailers.
37% have ignored a legitimate call, text or email.
38% have avoided a new app, website or service.
29% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led South Dakota text-scam volume.
Tennessee
Key takeaway: Tennessee residents report rising trust fatigue without matching verification habits: 59% feel more mental strain, but 48% verify weekly.
59% report more mental effort figuring out what’s real online.
48% verify online content at least weekly.
15% check several times a day.
40% have encountered an AI-generated image presented as real.
80% are concerned AI is making scams harder to recognize.
48% have avoided unfamiliar retailers.
33% have ignored a legitimate call, text or email.
35% have avoided a new app, website or service.
37% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Tennessee text-scam volume.
Texas
Key takeaway: Texas is one of the more active verification states, with 62% checking online legitimacy at least weekly.
61% report more mental effort figuring out what’s real online.
62% verify online content at least weekly.
22% check several times a day.
46% have encountered an AI-generated image presented as real.
81% are concerned AI is making scams harder to recognize.
41% have avoided unfamiliar retailers.
30% have ignored a legitimate call, text or email.
32% have avoided a new app, website or service.
30% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Texas text-scam volume.
Utah
Key takeaway: Utah has one of the highest levels of exposure to AI-generated imagery, with 49% seeing an AI image presented as real.
58% report more mental effort figuring out what’s real online.
50% verify online content at least weekly.
8% check several times a day.
49% have encountered an AI-generated image presented as real.
85% are concerned AI is making scams harder to recognize.
43% have avoided unfamiliar retailers.
40% have ignored a legitimate call, text or email.
43% have avoided a new app, website or service.
32% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Utah text-scam volume.
Vermont
Key takeaway: Vermont has a sizeable trust-versus-action gap: 58% report more mental effort online while 47% verify content weekly.
58% report more mental effort figuring out what’s real online.
47% verify online content at least weekly.
12% check several times a day.
45% have encountered an AI-generated image presented as real.
79% are concerned AI is making scams harder to recognize.
47% have avoided unfamiliar retailers.
28% have ignored a legitimate call, text or email.
32% have avoided a new app, website or service.
30% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Vermont text-scam volume.
Virginia
Key takeaway: Virginia reports comparatively low exposure to AI-generated images presented as real, at 34%, even as concern about AI scams remains high.
58% report more mental effort figuring out what’s real online.
54% verify online content at least weekly.
15% check several times a day.
34% have encountered an AI-generated image presented as real.
83% are concerned AI is making scams harder to recognize.
40% have avoided unfamiliar retailers.
33% have ignored a legitimate call, text or email.
39% have avoided a new app, website or service.
30% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Virginia text-scam volume.
Washington
Key takeaway: Washington has one of the highest levels of AI-scam concern in the survey, at 86%.
62% report more mental effort figuring out what’s real online.
55% verify online content at least weekly.
15% check several times a day.
40% have encountered an AI-generated image presented as real.
86% are concerned AI is making scams harder to recognize.
50% have avoided unfamiliar retailers.
36% have ignored a legitimate call, text or email.
34% have avoided a new app, website or service.
36% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Washington text-scam volume.
West Virginia
Key takeaway: West Virginia has one of the lower weekly verification rates in the survey, at 45%, despite a majority reporting greater trust fatigue.
55% report more mental effort figuring out what’s real online.
45% verify online content at least weekly.
12% check several times a day.
43% have encountered an AI-generated image presented as real.
81% are concerned AI is making scams harder to recognize.
41% have avoided unfamiliar retailers.
25% have ignored a legitimate call, text or email.
29% have avoided a new app, website or service.
31% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led West Virginia text-scam volume.
Wisconsin
Key takeaway: Wisconsin shows relatively high exposure to synthetic imagery: 46% have encountered an AI-generated image presented as real.
56% report more mental effort figuring out what’s real online.
49% verify online content at least weekly.
15% check several times a day.
46% have encountered an AI-generated image presented as real.
85% are concerned AI is making scams harder to recognize.
39% have avoided unfamiliar retailers.
35% have ignored a legitimate call, text or email.
26% have avoided a new app, website or service.
26% have avoided clicking a legitimate message or link.
Investment and cryptocurrency scams led Wisconsin text-scam volume.
Wyoming
Key takeaway: Wyoming has the most distressing scam-loss recovery story in the survey: 76% of victims who lost money recovered none of it.
64% report more mental effort figuring out what’s real online.
52% verify online content at least weekly.
11% check several times a day.
49% have encountered an AI-generated image presented as real.
78% are concerned AI is making scams harder to recognize.
44% have avoided unfamiliar retailers.
41% have ignored a legitimate call, text or email.
43% have avoided a new app, website or service.
31% have avoided clicking a legitimate message or link.
76% of victims who lost money said they recovered none of it.
Investment and cryptocurrency scams led Wyoming text-scam volume.
The best ways to protect your child from identity theft include freezing their credit, limiting exposure of personal information, monitoring for suspicious activity, securing family devices, and teaching safe online habits. Because children often don’t discover identity theft for years, taking preventive action early can help protect their credit, finances, and future opportunities.
Child identity theft is one of the fastest-growing forms of fraud, and many families don’t discover it until years after the damage is done. But child identity theft has surged in recent years, with 38% of U.S. survey participants reporting that a child or family member’s child had been victimized in 2025, jumping from 23% the year prior.
This guide explains how child identity theft happens, what warning signs to watch for, and the eight most effective ways to protect your child’s future.
Key Takeaways
Children are prime targets because their Social Security numbers or national ID equivalents are a blank slate, allowing fraud to go undetected for years.
Data breaches, phishing scams, social media oversharing, and AI-powered fraud are making child identity theft more common and harder to detect.
AI-driven scams are making it faster and cheaper to target families and steal children’s data at scale.
Freezing your child’s credit, monitoring for suspicious activity, and teaching safe online habits are among the most effective protective measures parents can take.
What is Child Identity Theft?
Child identity theft is a crime in which someone steals a minor’s personal information, most commonly the minor’s name, date of birth, and Social Security number (SSN) or equivalent national identifier, to commit fraud. The thief might open credit card accounts, take out loans, rent housing, file fraudulent tax returns, or claim government benefits, all in the child’s name. A 2021 Javelin Strategy study found that this crime affects one in every 50 children and costs U.S. families nearly $1 billion annually.
Why Child Identity Theft Is So Dangerous
The crime is made uniquely dangerous by the silence. Because children typically do not start applying for credit until they are 16 to 18, a thief can have more than a decade of undetected activity. As a result, by the time the victim becomes an adult, they may face:
Damaged credit scores
Debt collection notices
Loan denials
Difficulties renting housing
The crime is not confined to the United States, either. One documentary tells the story of Renata Furst Galvão, a native of Brazil, whose identity was stolen at age six and used to amass more than $400,000 in debt.
How Criminals Get Access to Children’s Information
To protect your child effectively, it helps to understand exactly who is targeting them, how they are getting in, and why the threat is accelerating. Even the most security-conscious household can be exposed through no fault of its own. In reality, information is often exposed through organizations that collect and store children’s data.
Common sources include:
Data breaches at retailers, healthcare providers, schools, and financial institutions could expose children’s information alongside adults’.
Social-engineering scams and phishing attacks may target parents directly to extract children’s details.
Social media profiles are prime targets for identity thieves to monitor, which is why a child posting their birthday, school name, and city in separate posts creates genuine risks. Minimize the personal details shared online and in photos.
Online games and apps that over-collect data, including a child’s full name, birthdate, and town, create additional opportunities for personal data exposure.
New Risks: AI Scams and Synthetic Identities
A December 2025 survey found that reports of ID theft rose from 43% in 2024 to 78% in 2025, a single-year spike that reflects how AI-powered tools have made it faster and cheaper for criminals to generate convincing phishing messages and fake identities at scale.
Synthetic identity fraud is particularly dangerous for children. It pairs a real Social Security number belonging to a minor unlikely to use it anytime soon with a fictitious name and address. The resulting fake identity can then build a credit history, take out loans, and disappear before anyone connects the dots.
Warning Signs Your Child’s Identity May Be Stolen
Catching this crime early makes the recovery process far less painful. Knowing what to look for means you will not dismiss the very clues that trigger a fast response.
Unexpected Mail, Bills and Collection Calls
The most common early indicators arrive in your mailbox or by phone, including:
Pre-approved credit card offers in your child’s name
Collection agencies calling to speak with your child
Court notices or bills for accounts your child never opened
Any business mail addressed to a young child should trigger an immediate investigation.
Many families first discover the theft during pivotal life moments. Examples include:
A teen may be denied a learner’s permit due to fraudulent driving violations.
A young adult may be denied an apartment because of unpaid debt on their credit report.
Stolen Social Security numbers can interfere with access to government benefits.
Unexplained Credit Activity
Children typically should not have a credit history, so potential warning signs of identity theft include:
A credit report exists under your child’s name
Credit accounts appear that your family never opened
Loan applications are associated with your child’s Social Security number
Debt appears on your child’s credit file
If your child has a credit record before they are old enough to use credit, it may indicate identity theft.
The 8-Step Protection Plan for Parents
You can follow these steps while seeking guidance from financial educators, credit authorities, and consumer protection experts. Start small by choosing two or three today, then build from there.
Step 1: Check and Freeze Your Child’s Credit
A credit freeze is one of the most effective ways to protect your child from identity theft. If your child is under 16, request a free credit freeze from Equifax, Experian, and TransUnion. This prevents anyone from opening new financial accounts in your child’s name without your authorization. Once in place, the freeze remains active until you ask the credit bureau to temporarily lift or remove it.
Because minors typically don’t have established credit files, the process for placing a freeze differs from that for adults. Each of the three major credit bureaus provides specific instructions for parents and guardians. Follow the guidance from Experian, Equifax, and TransUnion to place a freeze on your child’s credit file.
Step 2: Enable Fraud Alerts and Social Security Reports
In addition to a credit freeze, it’s smart to watch for signs that someone is using your child’s identity. Ensure that you:
File a fraud alert with each credit bureau to prompt verification checks if someone attempts to open an account in your child’s name.
Request an earnings report from the Social Security Administration to confirm whether wages are being reported under your child’s SSN.
Once your child is old enough to have a legitimate credit file, teach them to stagger their use of free credit reports from the AnnualCreditReport website, checking one bureau every four months.
Step 3: Educate Your Kids about Identity Theft & Private Information
In an honest, age-appropriate conversation, explain to them that personal information is the master key to their financial future and should not be shared with online strangers. Role-playing helps: ask your child what they would do if someone they met in a game asked for their full name and home address. Empowered kids are less likely to overshare and more likely to alert you when something feels off.
Step 4: Get Fierce about Protecting Your Child’s Data
Draw a very thick line around your child’s details. Reiterate that sharing them should be limited only when truly necessary, such as school enrollment or medical forms, and only with verified institutions. Ask why it is needed, how it will be stored, and if an alternative identifier is acceptable. Keep important documents in a locked safe and shred papers with your child’s information before disposal.
Step 5: Lock Down Devices, Accounts, and Online Habits
Talk with your kids about safe internet habits. Instruct them to stay skeptical of quizzes, free offers or apps, and unbelievable promos that request personal details. Set their social media accounts to private and limit follower or friend lists to people they know in real life. Use strong, unique passwords for family accounts and enable multifactor authentication on email, school portals, and social media apps used by older children.
Step 6: Monitor for Early Warning Signs
Regularly check your household mail for notices addressed to your child. If you spot anything suspicious, contact the company directly using the contact details on its official website. Do not call the number printed on the suspicious document, as it could redirect you to the thief who sent it. Consider using an identity monitoring service that scans for your child’s data in data breaches or on the dark web and alerts you when their information surfaces.
Step 7: Get Full-Device and Network Security
Many identity theft incidents start with a compromised family device. To reduce this risk, keep operating systems, browsers, and apps fully updated. Secure your home Wi-Fi with a strong password and WPA3 encryption to prevent data interception. Comprehensive security software, such as McAfee+ Family Plans, can help you block malware, keyloggers, and phishing sites that harvest personal data from every device in your home, including the tablets and phones your children use most.
Step 8: Act Quickly If Theft Happens
If you discover or suspect your child’s identity has been stolen, immediately contact the company where the fraudulent account was opened, close the account, and request written confirmation that your child bears no liability. Report the theft to IdentityTheft.gov, follow the personalized recovery plan, and file a police report to create an official record that will help resolve disputes with creditors.
Next, contact each credit bureau to cancel fraudulent accounts, inquiries, and collection notices linked to your child’s SSN. Keep detailed records of every call, letter, and case number throughout the process. Reporting the incident to the authorities helps your family recover and supports broader enforcement efforts that protect other families.
Final Thoughts
Child identity theft is a fast-growing, serious threat worldwide, but it is also one of the more preventable forms of fraud when families take proactive steps early. Start this week by spending 10 minutes to safely lock away your child’s physical documents, then call the major credit bureaus to request a freeze on your child’s credit. Build toward the full eight-step plan over the next month to close every door that leads to potential harm.
Beyond the 8-step sprint, add a recurring data safety day to your family calendar each year to recheck credit freezes and fraud alerts, review your children’s online accounts and platform settings, update devices and passwords, and discuss emerging threats. A family that combines strong protective habits with smart security tools is a much harder target for any kind of cybercrime.
It’s 10 p.m. on a school night, but your child is still watching YouTube Shorts, one after another, and the feed never ends. YouTube is one of the most widely used video platforms among children. A 2025 Pew Research Center study found that about 85% of parents allow their children to watch videos on YouTube, including 51% who permit daily use.
If your children are among the millions using YouTube, this article will help you balance your child’s screen time on the platform, filter out inappropriate content, and keep their data safe.
Key Takeaways
Even kid-friendly content on YouTube can include inappropriate themes, aggressive marketing, or low-quality videos designed solely for engagement, not learning.
Choosing the right YouTube experience for your child’s age is essential. Select from YouTube Kids, supervised accounts on the main YouTube, or regular YouTube.
In January 2026, YouTube introduced new parental controls for Shorts, allowing parents to set time limits or block short-form videos entirely for supervised accounts.
The most effective approach combines smart tool settings, including content filters, time limits, and Restricted mode, with co-viewing and open conversations within families.
Is YouTube Safe for Kids?
YouTube can be safe for kids, but it isn’t automatically safe. While the platform offers educational videos, creative content, and entertainment for children of all ages, kids can still encounter inappropriate videos, cyberbullying, misleading content, and excessive screen time if parental controls aren’t enabled. For most families, YouTube Kids, supervised accounts, parental filters for YouTube, and regular monitoring provide the safest experience.
What Parents Need to Know about YouTube
YouTube has become a primary platform where children spend hours each week being entertained, getting help with their homework, and following social trends such as challenges and Shorts. They shift seamlessly between devices: first watching on the TV in the living room, then switching to a tablet in their bedroom, and then pulling it up on a phone in the car.
Unfortunately, some parents underestimate how quickly YouTube’s recommendation algorithm can steer kids from age-appropriate content to more intense, commercial, or borderline inappropriate videos. Recommendation algorithms are primarily designed to maximize engagement and viewing time, which may not always align with age-appropriate content. One minute, your child is watching an educational science video. Three autoplay cycles later, they’re watching an unboxing channel where an adult screams at toys for 20 minutes straight.
What Are the Biggest YouTube Safety Risks for Kids?
While YouTube offers everything from educational content to entertaining videos for kids, no video-sharing platform is completely risk-free. YouTube carries risks that many parents don’t fully understand until problems arise at home. Understanding these challenges is the first step toward helping children build more balanced digital habits.
Inappropriate and Low-Quality Content
Automated filters aren’t perfect. Despite explicit policies banning deceptive, sensational, and clickbait content on YouTube Kids, inappropriate content can slip through. You might find cartoon violence, endless unboxing videos dressed up with science or learning keywords, or content that promotes unrealistic body images. In addition, many videos aimed at children encourage risky physical challenges, harmful pranking, and consumerism.
If your child is gravitating toward such content, use it as a teaching moment. Watch a few videos together and ask your child what they like about them. Then gently guide them toward higher-quality alternatives.
Child development experts warn that this type of content, when consumed in large doses, can crowd out creative play, may contribute to a lack of focus, and reduce time spent on activities that foster creativity and critical thinking.
YouTube Shorts and Excessive Screen Time
Short-form vertical video like YouTube Shorts has become a particular source of concern for parents, educators, and mental health professionals. The format’s infinite scroll and rapid-fire delivery make it engaging for young viewers, but researchers and child safety advocates have raised concerns that endless-scroll feeds may cause sleep disruption and compulsive viewing habits.
In addition, pediatric health organizations, including the American Academy of Pediatrics, are concerned that excessive screen time can mean fewer hours spent reading, playing outdoors, having face-to-face conversations, or engaging in imaginative play.
Cyberbullying and Unsafe Interactions
Children using standard YouTube accounts may encounter toxic comments, harassment, or cyberbullying. While younger children are less likely to engage with comments, older kids and teens often participate in online discussions that can expose them to negative interactions.
If your child experiences online harassment:
Encourage them not to respond to aggressive comments
Teach them how to report online bullying
Use YouTube’s reporting tools to block abusive users
Save evidence of serious threats or harassment
Learning how to stop a cyberbully starts with open communication and making sure children know they can come to a trusted adult when something online feels wrong.
Data, Privacy, and Advertising
YouTube Kids collects data about your child’s viewing habits and device, including IP addresses, to power recommendations and serve ads. Although regulations such as the Children’s Online Privacy Protection Act (COPPA) in the U.S. limit personalized advertising for children, many parents remain uneasy about the amount of data collected.
Recommendation algorithms can also narrow what kids see, showing them endless variations of the same content type. A child who watches one slime video might end up in a loop of nothing but slime videos. This creates a repetitive, passive viewing experience that doesn’t expose children to diverse ideas or interests.
Red Flags or Warning Signs Parents Should Watch For
A child doesn’t need to view harmful content to develop unhealthy YouTube habits. Consider reviewing your family’s YouTube settings if you notice:
Behavioral Changes
Consider reviewing your family’s YouTube settings, screen time limits, and online safety practices if you notice any of the following:
Meltdowns, arguments, or persistent bargaining for “just one more video” when it’s time to stop watching
Sleep disruption, including difficulty falling asleep, waking up tired, or sneaking devices at night to watch videos
Declining interest in offline activities, such as sports, reading, hobbies, or time with friends and family
Secretive behavior, such as hiding screens, clearing watch history, or becoming defensive when asked what they’re watching
Slipping grades or incomplete homework due to excessive time spent watching videos or YouTube Shorts
Appearing unusually anxious, upset, or withdrawn after spending time on YouTube
Receiving mean comments, harassment, or unwanted attention on their uploaded videos
Becoming overly attached to content creators and speaking about them as if they are personal friends
Reluctance to discuss online interactions, comments, or messages from other users
These behaviors don’t necessarily mean your child is watching harmful content. However, they may indicate that YouTube is displacing other important activities, that screen time has become excessive, or that your child is experiencing uncomfortable online interactions.
For older children and teens, changes in mood, secrecy around devices, or sudden reluctance to use YouTube may also be signs of cyberbullying. Creating a judgment-free environment can make it easier for children to discuss negative online experiences and seek help when needed.
If you notice several of these warning signs at once, it may be time to reassess screen time limits, review the watch history together, and discuss how to interact safely with others online.
Choose the Right Experience for Your Children
YouTube offers three distinct experiences for families, and choosing the right one for each child matters more than any other setting you’ll configure:
YouTube Kids
YouTube Kids is a standalone app designed specifically for children. It offers three age-based profiles designed to pull up appropriate content for young viewers:
Preschool (4 and under): This is the most restrictive mode, featuring videos that promote creativity, playfulness, learning, and exploration.
Younger (5-8): This mode expands to include songs, cartoons, crafts, and content for early elementary-aged children.
Older (9-12): In this mode, the app features music videos, gaming content, science videos, and vlogs appropriate for tweens.
Within each profile, parents can choose between Curated mode and All of YouTube Kids mode. Curated mode includes only channels verified by YouTube’s human reviewers, making it the safest option for younger children. All of YouTube Kids mode includes more videos approved by automated filters, increasing the chance that inappropriate videos may slip through.
Disabling the search function in YouTube Kids limits your child to content on the home screen, which is an excellent option for very young children who don’t yet need the breadth of YouTube’s catalog. You can also block specific channels and review your child’s watch history to monitor what they’re watching. Overall, the app offers additional protections compared with the standard YouTube experience.
Supervised Accounts on Main YouTube
Supervised accounts on the main YouTube platform serve as a middle ground for kids who’ve outgrown YouTube Kids’ toddler aesthetic but aren’t ready for the unfiltered internet. These accounts, managed through Google Family Link, let parents:
Choose from three content settings: Explore for ages 9+, Explore More for ages 13+, and Most of YouTube for ages 18+
Enable or disable the search function
Manage which features the child can access, including comments, live streams, and community posts
Benefit from stricter community guidelines and protections for users under 18
After receiving feedback from parents and experts, the platform introduced controls to block Shorts or to set daily time limits for supervised accounts. The new controls also let parents:
Customize Bedtime reminders that prevent access during late hours when screens should be off
Enable Take a Break reminders, which prompt the child to pause after extended viewing sessions
These controls apply across all devices where the child is signed in and are designed to prevent children from disabling them without parental approval. In addition, the streamlined sign-up process makes it easier for parents to create a supervised account and switch between their own and their child’s account within the mobile app.
Regular YouTube
Regular YouTube is the full, unrestricted platform. If your child has an adult account, you’re relying entirely on their judgment and whatever settings they choose to enable. For younger teens, this can be risky without clear family agreements and monitoring.
Understanding YouTube Age Verification
YouTube uses account information and age-verification systems to determine whether a user should be treated as a child, teenager, or adult. Age verification determines what content users can access, what ads they see, and which safety features YouTube automatically applies.
How Does YouTube Age Verification Work?
When someone creates a Google account, they provide a birthdate that YouTube uses to determine age. In some regions, YouTube may also use account signals to estimate whether the user is under 18.
If YouTube determines that a user is under 18, the platform may:
Restrict age-restricted videos
Limit personalized advertising
Provide additional recommendation safeguards
Enable reminders to take breaks
Apply additional teen safety protections
What Happens If YouTube Thinks You’re Under 18?
If YouTube identifies a user as under 18, additional protections may automatically apply. These may include restrictions on mature content, changes to recommendations, reduced ad personalization, and digital well-being features designed for younger users.
How to Set Parental Controls on YouTube
YouTube offers several parental control options to help families manage content, screen time, privacy, and interactions. Most of these controls can be configured through Google Family Link, YouTube Kids, or YouTube’s built-in safety settings.
Parents who want to enable parental controls on YouTube, add a parental lock to the YouTube app, or create a more age-appropriate experience can explore the following options:
Parental Control
What It Does
Supervised Accounts
Allows parents to select age-appropriate content settings and manage certain YouTube features.
YouTube Kids
Provides a child-focused experience with age-based content settings and additional parental controls.
Search Controls
Lets parents limit or disable search to reduce exposure to unintended content.
Channel and Video Blocking
Allows families to block specific channels or videos they don’t want children to access.
Restricted Mode
Helps filter potentially mature content from search results and recommendations.
YouTube Shorts Controls
Lets parents manage access to Shorts and set viewing limits on supervised accounts.
Screen Time and Bedtime Controls
Allows families to set YouTube time limits, bedtime reminders, and viewing schedules.
Comment and Community Features
Gives parents greater control over interactions with other users.
For younger children, families may choose YouTube Kids with Search disabled to provide a more curated content experience. Older children and teens may benefit from supervised accounts that offer greater independence while still giving parents visibility and control.
Google regularly updates its parental control tools and settings. For the latest information on available options and setup guidance, visit Google’s Family Help Center.
Building a Safer YouTube Setup at Home
After choosing the right experience for your child, you can start configuring YouTube’s settings for added security.
For YouTube Kids
Choose the correct age profile and content mode during the app setup.
Disable search if you want to limit viewing to home screen recommendations only.
Block specific channels if you notice your child repeatedly watching low-quality or overly commercial content.
Turn off autoplay to prevent endless video chains.
Review your child’s watch history weekly to spot any concerning patterns.
For Supervised Accounts
Open Google Family Link and set up a supervised YouTube account for your child.
Choose the appropriate content level, starting conservatively. You can always grant more access later.
Set time limits for Shorts or block them if your child struggles with self-regulation.
Configure Bedtime reminders to enforce screen-free hours, especially before sleep.
Enable Take a Break reminders to interrupt binge-watching sessions.
Keep search disabled initially, and enable it only when your child demonstrates good judgment.
Review and adjust settings every few months as your child matures.
Any YouTube Account Your Child Might Access
Turn on Restricted Mode, which uses community feedback, metadata, and other signals to hide videos that may contain mature content. To lock this mode so that your child can’t disable it, go to the Google Family Link.
Disable autoplay and turn off notifications to reduce passive consumption.
Review the privacy settings to make sure that your child’s uploads, if allowed, aren’t publicly visible.
Co-Viewing and Conversations
Settings and filters are necessary, but they’re not sufficient. Research on children’s media use consistently shows that the best outcomes result from combining tools with active parental engagement. This means:
Co-viewing: Sit with your child regularly and watch their favorite channels together. Ask what they like about the content and use it as an entry point for conversations about advertising, authenticity, and what’s real versus staged.
Talking about what they see: If your child watches gaming videos, talk about the difference between games and reality. If they watch beauty influencers, discuss how lighting, makeup, and editing can create unrealistic expectations.
Modeling good habits: Children learn by watching you. If you’re constantly on your phone or scrolling through videos during family time, they’ll internalize that as normal. Set family screen-free zones and times that apply to everyone, including adults.
Creating a media plan: Sit down together and agree on daily or weekly screen time limits, acceptable content types, and what to do if they encounter something that makes them uncomfortable. Tools like the American Academy of Pediatrics media plan can help structure this conversation.
Final Thoughts
Recent years have brought improvements to YouTube as an engagement tool for children. Short-form video time limits, supervised accounts with meaningful controls, and growing awareness among parents and educators of the stakes mean we are better positioned to create safer, more balanced digital experiences.
Combine these efforts with another layer of comprehensive protection tools, such as McAfee+, to help reduce exposure to threats that may bypass platform-level filters. Together, these measures support a more thoughtful and safer online experience for children.
Login
