In 2025 the FBI logged 191,561 phishing and spoofing complaints. Direct losses jumped 208% to about $216 million, even though the complaint count barely moved. Each hit is doing more damage. 1

AI wiped out the old tells. Spelling is clean. Logos are right. Celebrity deepfake ads and QR-code lures are now ordinary. What still works is context: you were not expecting this, and the message wants you to act before you think.

Legitimate companies almost never demand a password, a payment, or a gift card by surprise email. Close the message. Type the real address yourself.

Business email compromise cost $3.05 billion in 2025 from only about 25,000 complaints — roughly $123,000 per report. The attack is simple: a message that looks like a vendor, a boss, or payroll, asking for a wire change. 1

Filters catch a lot. They do not catch a well-aimed note written by a model that already knows your name and a recent invoice.

Most websites already use HTTPS, which encrypts the page between your browser and the site. On café or airport Wi-Fi, that already stops a stranger on the same network from reading a password as it travels. A virtual private network adds a tunnel from your device to a company’s server. It can hide which sites you visit from the café. It cannot tell a real bank page from a fake one, and it cannot stop you from typing a recovery phrase.

You do not need one for ordinary email, banking, or shopping, especially on your phone’s own cellular connection. If you still want one on a public network, pay a known provider and install it from that provider’s site or the official store. Free virtual private networks, and applications that only pretend to be one, often sell data or are malware themselves.

A password manager generates a long unique secret for every site and is the only realistic way to stop reuse. Bitwarden is the strong free and open option. 1Password is the smoothest daily driver. Proton Pass fits if you already live in that ecosystem.

The order of protection is passkeys, then a hardware key, then an authenticator app, then SMS. SMS codes can be stolen with a SIM swap. Hardware keys refuse to answer a fake domain.

Check old passwords at haveibeenpwned.com. If one is in a breach, change it everywhere it was reused — then stop reusing it.

The person may arrive on a dating site, in a social-media message, or as a wrong number that keeps talking. They are warm, they have a reason they cannot meet, and the conversation turns to money. Sometimes it is a medical bill or a travel emergency. Often it becomes a private investment. They may never ask for a date in person.

Do not send money, gift cards, or cryptocurrency to someone you have not met. A video call does not prove the relationship is real, because video can be staged or generated. If the talk turns to an investment, stop. That pattern is also covered in the cryptocurrency kit under the long investment scam.

Quishing is phishing that uses a QR code. The code may arrive in an email about a document, on a parking meter sticker, on a restaurant menu, or in a letter that looks like a bill. You scan it and land on a sign-in page or a payment page that is not the company it imitates.

Do not scan a code that was pasted over another code. Type the company’s address yourself, or use the application you already installed. If you must scan a code from a business you are standing inside, check the address that opens before you enter a password or a card number.

On a marketplace, a buyer sends a screenshot of a payment that is not in your account and asks you to ship, or to pay a courier with gift cards. A seller of tickets, a car, a puppy, or a vacation rental asks you to pay by wire, gift card, or cryptocurrency before you have seen the thing. The price is unusually good, and they want the deal closed today.

A screenshot is not a payment. Check the payment application yourself. For a rental, be wary of a host who will not meet, will not do a video walk-through, or pushes you off the listing site to pay. For tickets, buy from the venue or a seller you can reverse a card charge with. If the payment method cannot be reversed, treat that as the warning.