Fraud Intel · Threat brief · Phishing, smishing and impersonation scams
It starts with a message. An unpaid toll. A parcel that couldn't be delivered. A call from your bank's "fraud team". A friendly stranger with an investment tip. Phishing and scams have become the front door to most financial crime, and the numbers for 2025 broke every record. Americans reported losing $20.9 billion to internet crime, phishing losses more than tripled, and phishing attacks kept climbing into 2026.
Internet crime losses reported to the FBI in 2025, up 26% on 2024, from more than 1 million complaints.
Losses from phishing and spoofing rose from $70 million to $215.8 million in a single year (FBI).
Lost to imposter scams in 2025, the most reported fraud type for the fifth year running (FTC).
Unique phishing attacks in Q1 2026, up 13.8%, and up another 10.1% in Q2 (APWG).
The scam economy in numbers
The FBI's Internet Crime Complaint Center (IC3) collects reports of online fraud from victims across the United States. Its annual totals show a business that keeps growing:
| Year | Reported losses | Trend |
|---|---|---|
| 2022 | $10.3 billion | |
| 2023 | $12.5 billion | |
| 2024 | $16.6 billion | |
| 2025 | $20.9 billion1,008,597 COMPLAINTS |
Losses have doubled in three years. In 2025 the IC3 received more than a million complaints for the first time, about 3,000 every day. And phishing sits at the heart of it:
| FBI IC3 category (2025) | Losses | Note |
|---|---|---|
| Investment fraud | $8.6 billion | The costliest category. Schemes often begin with an online or social-media contact. |
| Business email compromise | $3.04 billion | Fake invoices and payment instructions sent from hijacked or spoofed email accounts. |
| AI-related crime | ~$900 million | Tracked for the first time: 22,000+ complaints involving AI, including deepfakes and cloned voices. |
| Account takeover | $359.7 million | Criminals use stolen logins and codes to take over real accounts. |
| Phishing and spoofing | $215.8 million | The most reported crime, with 191,561 complaints, and losses up from $70 million. |
Phishing at industrial scale
The Anti-Phishing Working Group (APWG), an industry and law enforcement coalition, counts unique phishing attacks worldwide. After a dip in late 2025, volumes surged again:
- 971,181 phishing attacks in the first quarter of 2026, up 13.8% from 853,244 in the last quarter of 2025.
- A further 10.1% rise in the second quarter, with 425,808 attacks in June 2026 alone, the highest monthly total since April 2023.
- Phone-based phishing, by text message and voice call, rose 15% between late 2025 and early 2026.
- Telecom brands jumped to the top of the most-targeted list, rising from 5.9% to 33% of attacks in six months.
The impersonation playbook
The most effective scams don't look like scams. They look like your bank, your toll agency, your delivery company or the government. The Federal Trade Commission's 2025 figures show how well that works:
| FTC measure (2025) | Figure |
|---|---|
| Imposter scam losses | $3.5 billionNEARLY 3× THE 2020 LEVEL |
| Imposter scam reports | More than 1 millionNEARLY 1 IN 3 FRAUD REPORTS |
| Business impersonators (including banks) | About $1 billion |
| Government impersonators | About $920 millionREPORTS UP 40% |
| Losses from scams that started on social media | $2.1 billionCOSTLIEST CONTACT METHOD |
The 40% jump in government impersonation reports was driven largely by fake unpaid-toll texts: messages claiming you owe a few dollars in road tolls and threatening penalties if you don't pay through a link. The link leads to a convincing payment page built to capture your card details. The FTC also found that the costliest imposter scams typically began with a fake bank security alert, and that nearly one in three people who lost money were first contacted on social media.
Total fraud losses reported to the FTC reached $15.9 billion in 2025, from 3 million reports.
The same story in the UK
In the UK, scams where victims are tricked into sending money themselves are called authorized push payment (APP) fraud. UK Finance's 2025 figures show them rising sharply:
| UK APP scams (2025) | Losses | Change |
|---|---|---|
| All APP scams248,070 CASES | £576.4 million | +19% |
| Investment scams | £221.5 million | +40% |
| Purchase scams71% OF ALL CASES | £118.1 million | +20% |
| Romance scams | £39.2 million | +23% |
Two-thirds of UK scam cases began online, and 17% by phone or text. Phone-based scams were fewer, but they accounted for 28% of losses. UK banks reimbursed £354.3 million, about 61% of losses, but that still left victims hundreds of millions of pounds out of pocket.
Anatomy of a phishing lure
| Lure | How it hooks you | Red flag |
|---|---|---|
| Unpaid toll or parcelSMISHING | A text says you owe a small fee and links to a fake payment page that steals your card details. | Toll agencies and couriers don't demand payment through random text links. |
| "Your bank's fraud team"VISHING | A caller warns your account is under attack and asks for a one-time code, or tells you to move money to a "safe account". | Your bank will never ask for a code or ask you to move money. |
| Account alert emailPHISHING | An email asks you to "verify" your account on a look-alike login page. | Check the real web address. Never sign in from a link. |
| Investment tipSOCIAL MEDIA | A new online contact or fake celebrity ad promises fast, guaranteed returns. | Guaranteed high returns and pressure to act fast. |
| Familiar voice in troubleAI VOICE CLONE | A cloned voice of a relative or boss urgently asks for money. | Urgency plus secrecy. Hang up and call back on a number you know. |
Why it works
Phishing doesn't hack your computer. It hacks your instincts: urgency, fear, authority and trust.XINTCARD FRAUD INTEL
Every lure uses the same levers. It creates urgency ("pay today or face a penalty"), borrows authority (your bank, the government, a delivery company), and triggers fear or reward. The goal is to make you act before you think.
Generative AI has removed the old warning signs. Scam messages no longer arrive full of spelling mistakes. They can be written in perfect, personalized language at massive scale, and a few seconds of audio from social media is enough to clone a voice. The FBI's first count of AI-related complaints, more than 22,000 with nearly $900 million in losses, is likely only the beginning.
Where your card fits in
Many phishing attacks have one goal: your card details. A fake toll page or delivery fee collects your card number, expiry date and security code. Those details keep working for the criminal long after you close the page. UK Finance reports that criminals also trick people into handing over one-time passcodes, which they use to add stolen cards to their own phone wallets.
XintCard is designed so that phishing has nothing reusable to catch:
- No permanent card number. Online payments use one-time tokens, so details typed into a fake page don't work again.
- A dynamic security code instead of a fixed three digits printed on the back.
- Real-time verification of every payment, designed to flag and stop payments to suspicious new payees or devices before money moves.
- Instant owner control, so you can see every attempt and freeze your card in one tap.
Try the phishing scam in our attack simulator to see how a regular card and XintCard respond.
Field guide: don't take the bait
- Stop and verify. Contact the company yourself, using its official app, website or the number on your card, never the link or number in the message.
- Never share a one-time code. No real bank, toll agency or delivery company will ask you to read one out.
- Nobody legitimate asks you to move money to a "safe account", buy gift cards, or pay with cryptocurrency.
- Ignore toll and parcel texts with links. Check any bill directly with the toll agency or courier.
- Treat investment offers on social media as scams until proven otherwise, especially guaranteed returns.
- Agree a family code word to confirm emergencies, in case a cloned voice calls.
- Turn on passkeys or two-step sign-in for email, banking and shopping accounts, and use a password manager so look-alike sites can't fool it.
- Report scam texts. In the U.S., forward them to 7726 (SPAM) to alert your mobile carrier.
If you've been hooked
- Contact your bank or card issuer immediately to block payments and cards. In the UK, call 159 to reach your bank's fraud team securely. Speed matters for recovering money.
- Change your passwords, starting with your email account, and sign out of all sessions.
- Report it to the FTC at reportfraud.ftc.gov and to the FBI at ic3.gov.
- Watch for follow-up scams. Fake "recovery" services often target people who have just been scammed.
The bottom line
Phishing works because it targets people, and people can be rushed, frightened and fooled, especially by AI-polished messages that look perfect. Awareness helps, but no one is alert every second of every day. That is why the strongest defense removes the prize: a card with no reusable details to steal, and payments checked in real time before money moves. That is what we are building. Join the XintCard early-access list.
Sources
- FBI Internet Crime Complaint Center, 2025 Internet Crime Report, April 2026, with figures as summarized by SpyCloud. 2022 and 2023 totals from the FBI's annual Internet Crime Reports.
- Anti-Phishing Working Group, Q1 2026 Phishing Activity Trends Report (May 2026) and Q2 2026 report.
- Federal Trade Commission 2025 imposter scam data, as reported by BleepingComputer and Bitdefender, June 2026.
- Federal Trade Commission, 2025 fraud totals, as reported in "FTC reveals a record $15.9 billion in consumer fraud losses in 2025", March 2026.
- UK Finance, Annual Fraud Report 2026, June 2026.
