The “Passkey Migration” Call: How Attackers Turned Microsoft’s MFA Change Into a Pretext
Microsoft really is moving Entra ID users off SMS and voice MFA, and callers posing as IT are using that as cover, sending staff to lookalike enrollment pages that relay the sign-in live. Six signs the call isn’t real, and how to run your own migration so staff never learn to obey a caller. Sources: Canadian Centre for Cyber Security, Microsoft, Google, 2026.
Scam Trends, November 2026: Fake FTC Calls, COLA Cons, and the Package You’re Expecting
Callers posing as the FTC threaten to shut off your phone number, Social Security’s 3.6% raise brings fake “activation” fees, Marketplace enrollment opens behind misleading ads, and package texts peak by Cyber Monday. Sources: FTC, SSA OIG, FBI IC3, USPIS, 2025–2026.
Microsoft 365 Account Takeover: Why a Password Reset Isn’t Enough
Huntress tracked a Microsoft 365 campaign across 79 organizations that needed no password and walked past MFA, then left rogue devices, attacker-owned authenticators and inbox rules hiding payroll mail. Six things that survive a reset, and the order that actually evicts them. Sources: Huntress, Microsoft, 2026.
Legitimate-Service Phishing: When the DocuSign Email Is Real
The DocuSign, Dropbox or Frame.io notification can be genuine, pass every sender check, and still be phishing: the trap is a link inside the file or a phone number in the message. Seven signs, the Phantom Preview case, why filters miss it, and the one habit that beats it. Sources: Ocean Security, KnowBe4, DocuSign, Abnormal, 2025–2026.
Midterm Election Scams 2026: The Four the FBI Flagged
The FBI flagged four scams riding the 2026 midterms: a “campaign investment pool,” PACs that keep the money, merch that never ships, and “you’re not registered” texts. Seven red flags, what the robocall rules allow, and where to check instead. Sources: FBI IC3, FCC, FTC, 2024–2026.
RFQ Phishing: The Fake Buyer Aimed at Your Sales Team
Quote-request phishing rose 12-fold in a year. The first email has no link; it just asks if you can quote, and the “project portal” that wants your work login arrives after you reply. Seven tells, the forwarded booking-link variant, a five-step buyer check, and what IT should change. Sources: Fortra, FBI IC3, Coalition, 2025–2026.
Holiday Scams 2026: Watch How They Want to Be Paid
Fake stores, “missed delivery” texts, fake charities, gift cards drained on the rack and the boss who needs gift cards for clients. Most of them give themselves away at the payment step. Seven red flags, how card draining works, and what to do if you already paid. Sources: FBI IC3, BBB, FTC, Texas FCIC, 2025–2026.
RMM Phishing: When the Malware Is a Real Remote-Access Tool
Two campaigns published this fortnight ended with staff installing a real, signed remote-access tool that reported to the attacker, so antivirus stayed quiet. Seven signs a “document” is really an install, the yours-or-rogue question, five controls in order, and the cleanup. Sources: Microsoft, Huntress, CISA, Proofpoint, FBI, 2025–2026.
Deepfake Nudes and the Take It Down Act: A Parent’s 48-Hour Playbook
Since May 2026, apps must remove an intimate image of your child, AI fakes included, within 48 hours of a valid request. What to do in the first hour, what a valid request needs, who does what (platform, NCMEC, FTC, police, school) and what the law won’t do. Sources: FTC, FBI, NCMEC, Thorn, 2026.
Scam Trends, October 2026: Fake Officials, Fake Recalls, and the Enrollment Window
Callers posing as police and officials took more than $1.6 billion in 19 months, Medicare enrollment opens behind look-alike search ads, fake recall texts ride the Prime sale, and an app-consent trick walks past MFA. Sources: FBI IC3, FTC, AARP, SSA OIG, Amazon, 2025–2026.
Applicant Data Is the Softest Target You Own
Hiring systems face the open internet, hold Social Security numbers and home addresses for people you never hired, and usually run on a vendor nobody inside the company owns. What the FBI jobs-portal breach claim and the one-letter PeopleSoft firewall bypass mean for small employers, and what to check, delete and get in writing. Sources: FBI, Mandiant, Verizon DBIR, FTC, EEOC, 2026.
Your Employer’s HR System Was Breached. Here’s What Happens Next.
An HR or hiring system holds what you can’t reset: your Social Security number, birth date, home address, and the people on your benefits — even if you only ever applied. What the FBI jobs-portal breach claim shows, what tends to follow a breach like it, and the free locks that beat each move. Sources: FBI, FTC, IRS, E-Verify, DOL, 2026.
Fake Equipment Dealers: The Wire Transfer That Buys Nothing
A cloned dealer site keeps the real dealership’s photos, inventory and reviews and changes two fields: the phone number and the bank details. The purchase agreement looks right, the invoice looks right, and the only irreversible step is the buyer’s wire. Six tells, four checks worth twelve minutes, and what the first hour looks like. Sources: FTC, BBB, FBI IC3, 2026.
Microsoft Teams Help Desk Impersonation: When IT Support Messages You First
Teams allows chat from any external domain by default, so a tenant registered an hour ago can message your staff as “IT Service Desk.” One lab replication went from first message to full control of a laptop in 21 minutes. The chain, the four admin settings, and the one sentence to give your team. Sources: Expel, Blumira, Microsoft, CSO Online, FBI IC3, 2026.
MyChart Medicare Health Kit Scam: How to Check the Message
An email wearing the MyChart name offers a free 2026 Medicare Health Kit. There is no kit — there is a countdown clock, a $149 value marked to $0, a $13.77 “shipping fee,” and a form that takes your address before you ever pay. Sources: Epic/MyChart, Becker’s, AHA, Healthcare Dive, FTC, 2026.
Business Funding Phishing: The Form That Wants Your Revenue, Not Your Password
A year-long campaign impersonating SBA lending sends you to a page with one working element: a form asking your revenue, credit score, role and tenure. You can rotate a password. You cannot rotate that. Sources: Microsoft Security Research, Fortra, SBA OIG, FTC, 2025–2026.
Fake Car Dealership Websites: Two Free Checks a Clone Can’t Pass
Scammers copy a real dealer’s site — logos, listings, photos, even the reviews — then take payment for a car that was never there. Why reading the reviews cannot help you, and the two government registers that can. Sources: FTC, FBI IC3, BBB, US DOJ, 2026.
Fake QR Code Sticker Scam: How to Spot It, How to Stop It
A sticker over the real code sends people to a look-alike payment page. A 15-second check before you pay, and a weekly signage sweep for the businesses that own the meter.
Scam Trends, September 2026: The Second Scam and the Medicare Countdown
Refund and recovery crews work lists of people who already paid, Medicare impersonation calls land before enrollment even opens, and AI-cloned storefronts take payment for goods that never ship. Sources: FTC, FBI IC3, CMS, NOAA, 2025–2026.
MyChart Phishing: When the Attack Targets Your Patients, Not Your Network
Two campaigns are wearing a patient portal’s logo, and 41 health systems have warned patients. Nothing touches your network, so nothing in your stack fires. The first 72 hours, five moves you control, and a front-desk script. Sources: Epic, AHA, Becker’s, ASTP/ONC, 2026.
What the ScamDrill App Does — and What It Deliberately Doesn’t
It checks a text, email, link or screenshot and tells you what looks wrong. It does not read your inbox, does not keep what you check, and will never call a message safe. The reasoning behind each thing we left out.
The “Veterans Savings Program” Postcard Scam: What the Call Wants
A postcard says you or your spouse qualify for extra VA money — call within five days. No such program exists. The nine-month timeline, six tells on the card, and the three rules that settle any offer of paid help with a VA claim. Sources: FTC, VA, MOAA, 2025–2026.
Payroll Diversion: The Scam That Steals a Paycheck Before It Lands
Payroll runs on time, the amount is right, and the account belongs to someone else. The three ways in, the inbox rule that hides the warning, and the four controls that break the chain. Sources: Microsoft Threat Intelligence, Okta, FBI IC3, 2025–2026.
The Package You Didn’t Order: Brushing Scams and the QR Card Inside
A cheap item nobody ordered, sometimes with a card that says “scan to see who sent your gift.” Why it arrived, why the QR code is the part that can cost you, and the seven steps to take today. Sources: FTC, FBI IC3, USPIS, 2025–2026.
When the Help Desk Calls You: The 2026 Vishing Playbook for Small Businesses
A caller with your real support number on the screen sells an urgent “security migration” — and the page at the end of the call relays your password and MFA code in real time. Seven tells, and the callback rule that ends it. Sources: CrowdStrike, Google Threat Intelligence, FBI & CISA, 2023–2026.
Was Your Cologuard Data Leaked? What the Exact Sciences Breach Means for You
Data stolen from the maker of the Cologuard screening test was published online — 10.9 million email addresses, with names, birth dates, addresses and personal health data. How to check whether you’re in it, and the six things to do this week. Sources: Have I Been Pwned, Abbott, FTC, 2026.
The 2026 Medtech Breach Wave: A Supplier and Small-Practice Playbook
Eight medtech companies were breached in 2026 — and in every confirmed case the way in was a person on a phone or an email, not a hacked device. What suppliers, billers, and small practices should actually do. Sources: SEC filings, Have I Been Pwned, Oregon AG, 2026.
Family Safe Word: Ideas and How to Use It Against AI Scams
AI can clone a voice, not a secret. How to pick a safe word nobody can guess, what to do if a caller says they forgot it, and a pickup plan for kids.
The Deepfake Job Candidate: When Your Next Remote Hire Is a Fraud
Some remote applicants aren’t real people — they use AI video, voice changers, and stolen identities to pass live interviews and get hired. The seven red flags, the on-camera move that trips a deepfake, and what to do if you already hired one. Sources: U.S. State Dept, Unit 42, DOJ, 2026.
Scam Trends, August 2026: Back-to-School Cons and Storm-Season Impostors
Fake school fees, phantom student-loan forgiveness, task-job traps aimed at students, and the FEMA impostors that follow every storm. What to watch this month, at home and at work. Sources: FTC, IRS-CI, U.S. Census Bureau, 2025–2026.
AiTM Phishing: The Stolen Session Cookie That Walks Past Your MFA
A proxy sits between your team and the real Microsoft login, relays the password and MFA, and copies the session cookie that already cleared your second factor. The six tells, why ordinary MFA misses it, and the phishing-resistant fix. Sources: Microsoft, CISA, Lexfo/Rescana, 2026.
Fake Interpol Emails: The “Investigation” That’s Actually Ransomware
An email claims Interpol’s cybercrime unit is investigating your company and tells you to open the “evidence” — but the file is ransomware. The red flags, why the crude malware still works, and what to do if someone clicked. Sources: Bitdefender, FBI IC3, CrowdStrike, 2026.
The Fake FBI Agent in Your DMs: The IC3 Impersonation Scam
Criminals posing as the FBI and its IC3 now use AI deepfake videos and spoofed IC3 sites to re-target people who already lost money. The red flags, the “no DMs, no fees” rule, and how to report for free. Sources: FBI IC3, FTC, 2025–2026.
Unpaid Toll Text Scam: How to Check If You Really Owe
That ‘unpaid toll’ text is built to steal your card, not collect $7: the official toll sites to type in instead, what changed in 2026, and what to do if you already paid.
Vendor Email Compromise: Stop Bank Account Change Fraud
A supplier emails new bank details inside a real invoice thread. Why you never act on it by email, and how to change vendor bank and contact details safely in your AP system.
Utility Shutoff Scam: Is That Call or Text Real?
A call or text says your power, gas or water goes off today unless you pay now. It’s a scam: the tells, the winter and refund versions, and the two-step exit.
The First 60 Minutes After a Scam — Your Emergency Action Plan
The first hour decides how much comes back. A minute-by-minute plan: stop the money, lock your accounts, report it, freeze your credit — plus what’s recoverable by payment type.
I Gave My SSN to a Scammer — What to Do Now
You can’t cancel a Social Security number, so you lock what it unlocks. A calm, free, step-by-step plan: freeze your credit, get an IRS IP PIN, report it, and dodge the follow-up recovery scam.
Back-to-School Scams 2026: The Four Cons Waiting for Students This Fall
Fake scholarships, upfront loan-forgiveness fees, phantom campus rentals, and phony schools — the four cons waiting for students this fall, and the one tell they share. How each works and how to shut it down fast. Sources: FTC, U.S. Dept. of Education, 2025–2026.
The “Pay Yourself” Scam: When Your Bank’s Fraud Department Isn’t Your Bank
A fake fraud alert, a spoofed callback, and one “security code” — how the pay yourself scam reroutes Zelle transfers to a scammer, and the ten-second exit that beats it. Sources: Zelle, FTC, FBI, 2023–2026.
The VA Overpayment Scam: Fake ‘You Owe the VA Money’ Messages Hitting Veterans
Fake “you owe the VA money” texts, calls, and letters are hitting veterans. How the scam works, the two-minute VA.gov check that beats it, and where to report. Sources: VA, FTC, 2024–2026.
Crypto Courier Scams: When Fraud Sends Someone to Your Door for Cash
Once your bank blocks the wire, the scammer sends a courier to your door for the cash. How the FBI-flagged crypto “courier” loop works, why the password handoff is fake, and what to do. Sources: FBI IC3, FTC, 2024–2026.
Scam Trends, July 2026: World Cup Cons and Prime Day Fallout
Imposter losses hit a record $3.5B, World Cup ticket cons peak through the July 19 final, and post–Prime Day phishing rides your real deliveries. What to watch this month, at home and at work. Sources: FTC, FBI IC3, Check Point, 2025–2026.
Device Code Phishing in Microsoft 365: How to Block It
Attackers send a code for Microsoft’s real devicelogin page and walk straight past MFA. How to spot it, and how to block device code flow in Microsoft Entra, step by step.
Jury Duty Scams: Why the Arrest-Warrant Call Is Always Fake
A caller says you missed jury duty and a warrant is out for your arrest unless you pay now. Courts mail you, they never call to collect. The spoofed-ID and fake-warrant tells, the script, and what to do. Sources: FTC, FBI IC3, U.S. Courts, 2026.
World Cup 2026 Ticket Scams: Fake FIFA Sites and the Safe Way to Buy
The FBI flagged dozens of fake FIFA sites selling bogus tickets and harvesting card and ID details. The real-vs-fake address tells, the payment that protects you, and the one official place to buy. Sources: FBI IC3, FTC, AARP, 2026.
Is This Remote Job Real or a Scam? 7 Red Flags
Is that remote job real? Check the company’s own careers site, never pay to start, spot the seven red flags, and know what to do if you already handed over your SSN or bank details.
Snapchat Sextortion: What to Do in the First 60 Minutes
A calm parent’s playbook for financial sextortion: don’t pay, don’t delete, screenshot, and report to NCMEC and the FBI. Why teen boys are the target, and the one line that protects your child. Sources: FBI, NCMEC, Thorn, 2023–2026.
Mortgage “Relief” Scams: When the Rescue Is the Robbery
Fake foreclosure-relief firms, bogus government letters, and upfront-fee traps are surging, up 407% since 2022. The one rule that exposes every version, and where to get real help for free. Sources: FTC, CFPB, FBI IC3, 2024–2026.
Ghost Students: How Strangers Take Out College Aid in Your Name
Synthetic-identity rings enroll in community colleges as you, file a FAFSA, and pocket the Pell refund. How the scam works, what the April 2026 FAFSA crackdown changed, and how to lock down your name and transcript.
Scam Trends, June 2026: The New Federal Numbers
The 2025 reports are in: $15.9B (FTC) and $20.9B (FBI), up 26%. The scams moving fastest this month for families and businesses, the first official AI-fraud tally, and how to stop each one. Sources: FTC, FBI IC3, 2025–2026.
The Second Scam: When a Stranger Offers to Get Your Money Back
Recovery scams hunt people who already lost money once. How the “sucker list” works, who scammers impersonate, and the one rule that ends the con: no real agency charges a fee. Sources: FTC, FBI IC3, 2024–2026.
Schools on Their Own: K-12 Ransomware After the Federal Cuts
Free federal cyber defense for schools ended in late 2025. What districts lost, why gangs now steal student data instead of encrypting it, and a playbook that runs on local money.
Authorized, and Still Fraud: NACHA’s June 22 Rule
A new ACH rule lands June 22, 2026 for every business that sends payments. What “risk-based” monitoring for BEC, vendor, and payroll scams actually requires.
When Ransomware Comes for Your Practice
Ransomware was in 88% of small-business breaches in 2025. Why dental and medical offices are the soft target, how the attack works, and the HIPAA fallout.
Business Video Compromise, Explained
BEC’s video sibling: deepfake executives, fake hires, and live face-swaps on your work calls, and how to stop them.
PCS Rental Scams: Why Moving Season Is Open Season on Military Families
Military-connected consumers lost $584M to fraud in 2024. PCS season is the strongest seasonal lock in rental fraud — the three plays hitting servicemembers May–September, and the 10-minute drill that stops them.
The “Easy Online Job” Scam Aimed at Your Teen: How Task Scams Work
Task scams went from near-zero in 2020 to ~40% of all job-scam reports by 2024 — and young people report losing money more often than seniors. How the “get paid to like videos” trap works, the human cost behind it, and the one line that ends it. Sources: FTC, FBI IC3, UNODC, 2024–2026.
The Influence Stack: How Scammers Use Persuasion Psychology Against You
Scammers don’t fire one trick at a time — they stack authority, urgency, liking, and social proof in a single message. Why the traits that make you a good colleague are the exact ones being exploited. Sources: FTC, Harvard Kennedy School, Journal of Cybersecurity, 2023–2026.
The QR Code Scam Coming for Your Teen: How “Quishing” Works
QR-code phishing climbed roughly fivefold in 2025, and teens scan codes on reflex. How quishing works at concert rideshare lines, parking lots, giveaways, and on doorsteps — plus the one habit that stops it. Sources: FTC, FBI IC3, 2025–2026 reporting.
The Anatomy of a Modern Scam: Six Stages, $40B in Profits, One Playbook
Scams aren’t random crimes — they’re an industry. The six-stage assembly line behind pig butchering, BEC, deepfake calls, and smishing, with the 2025-2026 numbers most coverage doesn’t show you. Sources: FBI IC3, FTC, UNODC, Chainalysis, Verizon DBIR, TRM Labs.
Scammed? Here’s Exactly What to Do — A 2026 Family Recovery Guide
$20.9B lost to cybercrime in 2025. 4 in 10 Americans hit. The first 60 minutes, first 24 hours, and first week after a scam — plus what NOT to do. Built on the latest FTC, FBI IC3, and AARP guidance.
Your Business Just Got Scammed: What to Do in the First Hour
Wire sent to a fraudster or business email hacked? Who to call in what order, how to lock down Microsoft 365 or Google Workspace, and copy-ready messages for your bank, vendor and staff.
Summer Travel Scams 2026: The Five Patterns Hitting Travelers This Summer
5.2M Americans lost money to rental scams in 2025. McAfee found 1 in 5 booked into a fake. Fake rentals, AI-generated travel sites, toll-text smishing, fake passport pages, and recovery scams — with a five-minute pre-trip drill.
The ShinyHunters Canvas Hack: What Every Business Should Take From the Largest Education Breach on Record
3.65 TB, 275 million records, 8,809 institutions — one phone call at a time. How a teen-run extortion crew keeps walking through the front door, and what small, mid-size, and enterprise businesses should change this week.
Internet Safety for Tweens and Teens: A 2026 Parent’s Guide
What reaches kids at each age, how sextortion unfolds, a four-question scam check, the app settings worth turning on, and a household agreement to print — with five printable figures.
Neo-Phishing (a.k.a. “Phishmaxxing”): The AI-Powered Scams Now Targeting Households and Businesses
AI-written email, three-second voice clones, deepfake video calls — what Gen Z has started calling “phishmaxxing.” The new wave of scams that drove US fraud losses to a record $20.9B in 2025, and exactly what to do if one lands.
Two Museum Heists, One Cybersecurity Playbook: Lessons from the Louvre and Magnani-Rocca
The Louvre lost €88M in seven minutes. A villa near Parma lost a Renoir, a Cezanne, and a Matisse in three. Strip away the gold leaf and what’s left is a cyber-breach playbook — recon, weak passwords, insider risk, and the alarm nobody was watching.
The Fake CAPTCHA “ClickFix” Scam: Why It’s Everywhere Right Now
Fake CAPTCHA pages that tell you to press Windows + R and paste a “verification code” surged 517% in 2025 — and now run on Windows, Mac, and Linux. Here’s how the scam works and the one rule that stops it cold.
How AI Is Reshaping Cybersecurity for Businesses of Every Size
Anthropic’s Mythos Preview, Palo Alto’s April 2026 Defender’s Guide, and Fortinet’s industrialized-cybercrime forecast — what an AI that finds zero-days for sport actually means for businesses from 12 to 12,000 employees.
Social Engineering Targeting SMBs: Tactics, Trends and Simple Defenses
~68% of breaches involve a person being deceived, not a system being hacked. The pretexting, vendor email compromise and deepfake-voice tactics now hitting small businesses — and the simple defenses that work.
5 Scam Trends Spiking in 2026: What you should know
Americans lost a record $20.9B to cybercrime in 2025. Task scams, toll smishing, AI voice clones, government impersonation, and recovery fraud — the five trends driving the surge, and what to tell your family this week.
Why Scammers Target Military and Veterans — and the Tactics to Watch For
Military families lost $584 million to fraud in 2024, a 25% jump in a single year. The seven scam tactics — from VA imposters to pension poaching — that hit servicemembers and veterans hardest.
The 20 Minutes That Saved My Father $2,400 a Year
A personal story of auditing an 80-year-old parent’s bank statements — and finding $200 a month in scam tech-support subscriptions and quietly-unused services.
How to Protect Elderly Parents from Scams: 2026 Checklist
People 60+ reported $7.7 billion in scam losses in 2025. The eight settings and habits that protect a parent without taking over, plus what to do in the first hour if it’s already happened.
Phishing Simulation for Families: Why It Works and How to Start This Weekend
What workplace security teams have known for years, finally adapted for the kitchen table. The research — and the exact steps.
How to Teach Kids About Online Scams Without Scaring Them
NCMEC logged 546,000+ sextortion-related reports from Snapchat alone in 2025. What to say, at what age, and what to avoid.
The AI Voice Cloning Scam: What to Do When the Voice Sounds Exactly Like Your Daughter
One Florida grandmother lost $15,000 in a single afternoon in July 2025. Here’s how the scam works and the 10-second rule that stops it.
USPS Text Scams: How to Check a Delivery Message
Americans lost $470 million to package-delivery smishing texts in 2024. The fake texts are now indistinguishable from real ones.
Pig Butchering: The $7.2B “Friendly” Crypto Scam You Need to Warn Your Parents About
It starts with a wrong-number text or a dating match. Updated for the 2026 version, where one tap on a wallet “spending cap” lets scammers take the balance.
Romance Scam Red Flags: How to Help a Family Member Who Thinks They’re in Love
$1.16 billion lost to romance scams in just the first nine months of 2025. What to say when you think it’s happening to someone you love.
Small Business Phishing Training: Why 56% of SMB Employees Still Click (and What to Do About It)
88% of 2025 ransomware breaches hit small and mid-sized businesses. A practical training program for teams without a CISO.
Phishing Simulation for Small Business: A 30-Day Rollout Plan (Template Included)
Exactly what to send, when, and how to handle the inevitable “why did you trick me?” conversations. From baseline to 40% risk reduction.