AI Scams in 2026: 7 Findings from NordVPN’s Report

NordVPN combined third-party threat intelligence with aggregated detections from its own security products. That is valuable operational evidence: it can show what enabled tools encountered and blocked. It cannot tell us the percentage of all internet users attacked, how many detections became losses or how people without those tools behaved.

The denominators also differ. URL classifications, malware blocks, breach notifications and phishing-brand observations measure separate things. Adding them together would create a dramatic number with no coherent meaning. This guide keeps each metric attached to its original unit and treats future holiday risk as a reason to prepare, not as a confirmed result.

The FTC reported nearly $16 billion in consumer fraud losses for 2025 across roughly 3 million reports. More than 1 million reports involved impersonation, with $3.5 billion in reported losses. These are self-reported cases rather than a measure of every scam, but they independently support the report’s central point: pretending to be a trusted person, company or agency causes material harm.

The contact channel is broader than email. The FTC says nearly 30% of people who reported losing money to a scam in 2025 said it began on social media, totaling $2.1 billion in reported losses. A realistic defense therefore covers texts, calls, direct messages, ads, search results and QR codes—not only the inbox.

FBI IC3 data adds a different lens: complaints received by law enforcement. FTC and IC3 totals should not be merged because reporting paths and categories overlap. Together they show why a polished message, HTTPS lock or `.com` address cannot substitute for verifying who is asking and why.

Generative tools can quickly rewrite messages, imitate tone, translate text and personalize a story with leaked or public information. That reduces obvious spelling and grammar clues. Voice cloning and synthetic images can also make an urgent family, executive or support request feel familiar.

The underlying pressure remains recognizable: act immediately, keep the request secret, move money to “protect” it, reveal a code or sign in through a supplied link. Good defenses target that workflow. Slow the interaction down, leave the channel the attacker controls and verify the request through a contact method you obtained independently.

• Urgency is a signal. A deadline designed to prevent verification deserves more verification.
• Personal detail is not proof. Names, addresses, employers and recent purchases may come from leaks or public profiles.
• Familiar design is cheap to copy. Logos, sender names and login screens can be reproduced accurately.
• A real voice can be simulated. Confirm sensitive requests with a known number or pre-agreed family phrase.

A scam does not need a complete identity file. A full name, old password, physical address, employer or social profile can be enough to make a message appear informed. Separate breaches can expose different fragments, and data brokers or public posts can fill the gaps. AI tools make it cheaper to turn those fragments into natural language at scale.

Treat a message’s knowledge as a reason to investigate, not as authentication. A genuine bank can still be impersonated by someone who knows the last four digits of an account. A fake delivery text can arrive while a real parcel is in transit. A caller can know a relative’s name without being that relative.

Account recovery deserves special attention. Review recovery email addresses, phone numbers and active sessions on your primary email and financial accounts. Remove methods you no longer control. Where a service offers a recovery code, store it offline rather than in the same inbox it can unlock.

Sale periods combine advertising volume, expiring offers, delivery messages and unfamiliar checkout pages. That makes urgency feel normal. Before paying, open the retailer through a saved bookmark, official app or independently typed address. Compare the landing-page domain with the checkout domain and read the full total, renewal term and cancellation language.

• Do not trust an ad badge alone. Sponsored placement, a verified-looking profile or a familiar logo does not prove the seller controls the linked site.
• Check the payment request. A demand for gift cards, cryptocurrency, wire transfer or remote-device access is incompatible with an ordinary retail checkout.
• Keep evidence. Save the offer, checkout total, merchant name and confirmation before the page changes.
• Use account alerts. Turn on transaction notifications and review the statement after the promotion, not only on purchase day.

A discount can be genuine and still unsuitable. Security checks should confirm the seller; buying checks should confirm the product, final price, renewal and refund terms.

NordVPN’s report contains telemetry from security features that extend beyond a basic VPN tunnel. Keep those layers distinct. A VPN connection alone is not evidence that phishing, malware scanning, dark-web monitoring or call protection is active. Read the QuickVPNs NordVPN review for current product evidence and limitations.

Check current NordVPN plans →

1. Protect your primary email first. Give it a unique password and a passkey or phishing-resistant MFA when available. Email often controls password resets for other accounts.
2. Use a password manager. Unique credentials limit the damage when one site leaks. A manager also resists filling credentials on a lookalike domain that does not match the saved site.
3. Turn on MFA. Prefer passkeys or security keys; app-based codes are still better than a password alone. Never send an authentication code to someone who contacted you.
4. Update automatically. Enable operating-system, browser and app updates so known flaws do not remain easy entry points.
5. Verify outside the message. Open the official app, type a saved address or call a number from a statement. Do not use the link, number or “support agent” supplied in the suspicious contact.
6. Reduce public clues. Limit public birthdays, family names, travel plans, employer details and voice/video samples that make impersonation easier.
7. Report and warn. Report fraud to the FTC and cybercrime to IC3. Report the account, ad or message on the platform, then warn affected contacts through another channel.

CISA’s Secure Our World guidance centers on phishing recognition, strong passwords, MFA and updates. NIST’s consumer guidance recommends password managers and explains why passkeys resist phishing better than reusable passwords.

1. Stop the interaction. Do not send another code, payment or explanation.
2. Contact the bank or payment provider immediately. Use the official number and ask about freezing, recalling or disputing the transaction.
3. Change exposed credentials from a clean device. Start with email, banking and any account where the password was reused.
4. End active sessions. Review logged-in devices, recovery methods, forwarding rules and newly added MFA methods.
5. Scan and update the device. If you installed software or opened an attachment, disconnect it from sensitive accounts until checked.
6. Preserve evidence. Save messages, addresses, transaction IDs and timestamps before blocking the sender.
7. Report the event. Use ReportFraud.ftc.gov and IC3.gov in the US; contact local authorities when identity documents, threats or major losses are involved.