Scam trends in 2026: what has actually changed

Analysis — patterns and trends, not a report of any single incident.

The three shifts that matter

Cyber fraud does not change as quickly as headlines suggest. The underlying goals have been the same for twenty years: get a password, get a payment, or get a person to act against their own interest. What changes is cost and scale, and over the past two years three shifts have altered both.

Writing became free. Generative tools produce fluent, personalised, idiomatic text in dozens of languages at effectively no cost. The practical consequence is that the standard advice — look for bad spelling and awkward grammar — has stopped working. A fraudulent message can now read better than a genuine one from your bank.

Voice became cheap to copy. Cloning a recognisable voice needs a short sample of ordinary speech, easily taken from a social media video or a voicemail greeting. The assumption underneath decades of everyday trust, that recognising a voice confirms identity, no longer holds.

Fraud became industrial. Much of what reaches you is produced by organised operations with scripts, shift patterns, training material and quality control. Some are run from compounds where the operators are themselves trafficked. This matters for how we talk about victims: being deceived by a professional operation working from a tested script is not a failure of intelligence.

Where the money is actually going

Losses cluster in a small number of categories, and they are not the ones people expect.

Payment redirection remains the largest single cause of business loss. Someone reads a real email thread — often from a supplier's compromised mailbox rather than yours — and sends a message changing the bank details on a genuine invoice. There is no malware, no suspicious link and no spelling error, because nothing about it is fake except the account number.

Investment fraud, usually introduced through a relationship built over weeks, produces the largest individual losses. The platform displays convincing growing returns. Withdrawals are blocked by fees and taxes that never end.

Impersonation of banks and authorities continues to work because caller ID is trivial to falsify and because the scripts are refined constantly. The request is always one of a small set: move money to a "safe account", read out a code, or install software.

Marketplace and delivery scams are individually small and enormous in aggregate, and they are the category most likely to be someone's first experience of fraud.

Techniques worth understanding this year

Attacks that use your own computer's tools

The approach commonly called ClickFix shows a fake error or verification failure, then walks the visitor through pasting a command into a system tool. Because the victim runs it themselves using software already on the machine, there is no suspicious download for a filter to inspect. Our explainer covers the detail; the one-line defence is that no legitimate website ever asks you to paste a command into a terminal or Run box.

QR codes as a delivery method

A QR code is a link you cannot read, which removes the single most useful defence people have. Stickers placed over genuine codes on parking meters and payment machines have become common enough that councils in several countries have issued warnings.

Session theft rather than password theft

Information-stealing malware increasingly targets session cookies rather than passwords, because a stolen session token can bypass both the password and the two-factor prompt. This is why signing out of all sessions matters after any compromise, and why passkeys — which are bound to the real site's address — are the strongest defence available.

Recovery fraud

Victim lists are traded, and a second approach offering to recover lost funds for an upfront fee is now routine. It is frequently the same network returning for whatever is left.

What has not changed

Every one of these still requires the target to do something: send money, hand over a code, install something, or approve a prompt. The polish sits on the surface. The structure underneath is unchanged, and so are the defences that address structure rather than appearance.

• Verify through a channel you chose, not the one that contacted you.
• Nobody legitimate will ever ask you for a one-time code.
• There is no such thing as a safe account.
• Urgency and secrecy are the mechanism, not incidental details.
• A unique password everywhere turns one breach into one problem.

What to do about it

The practical response to all of the above is unglamorous and short. Turn on two-factor authentication for your email first, because it resets everything else. Use a password manager so a breach at one site stays at one site. Agree a family check word so an urgent call can be verified without relying on recognising a voice. Let your devices update automatically.

None of that responds to a specific trend, which is precisely the point. Defences tied to a technique expire when the technique does. Defences tied to structure keep working.