Cyberfraud refers to illegal activities carried out using digital technologies—particularly the internet—to deceive, manipulate, and steal from individuals and organizations. Cybercriminals can perpetrate scams via email (phishing), text messages (smishing), telephone (vishing), and social media platforms. Under the guise of legitimate communications from trusted sources, they aim to trick targets into revealing sensitive information so that they can ultimately gain unauthorized access to data or funds. When it comes to protecting yourself, knowledge is the key to prevention.

A growing but avoidable threat

The threat of cyberfraud has become increasingly difficult to ignore in today’s interconnected world. Complaints to the FBI’s Internet Crime Complaint Center (IC3) nearly doubled between January 2019 and December 2023. Perhaps even more concerning, the reported financial losses resulting from suspected scams over this five-year period grew by over 350% from USD 3.5 billion to USD 12.5 billion (See Fig 1). Experts believe these numbers to be underestimated since many scams go unreported.

Start with the basics: Secure your accounts

While cybercrimes have grown in number and sophistication, there are steps you can take to reduce your risk of becoming a victim. Here are several basic but powerful security measures for protecting yourself and your financial accounts.

• Develop and maintain strong passwords. Unique, complex usernames and passwords (which include a mix of letters, numbers, and special characters) are crucial to maintaining account security. Having unique usernames and passwords for all of your online account providers can help to ensure that a breach in one account does not compromise others.
• Sign up for Multi-Factor Authentication. Multi-Factor Authentication adds an extra layer of security by requiring two forms of verification before granting access to an account. Once set up, in addition to your password, you will enter a one-time security code that is sent to your multi-factor method (via text, email, etc.). Consider using Multi-Factor Authentication every time you log in (versus only when logging in on a new device).
• Regularly monitor and review your account activity. Make sure you review your account activity on a regular basis and at least every 30 days for financial accounts. This will enable you to spot unusual transactions and report them in a timely manner. Consolidating your accounts can help make this easier. The fewer accounts you have (and the fewer notifications and statements you need to monitor), the likelier you’ll be to catch suspicious transactions.
• Set up alerts and notifications. Many companies enable you to customize alerts for specific actions, such as deposits, withdrawals, transfers, login attempts from new devices, or password changes. These alerts can inform you instantly about critical account activity. In the event that the action was not initiated by you, you can call the provider to inform them of the incident and work with them to correct it and secure your accounts.

Take reasonable measures to interact safely online and over the phone

In addition to securing your accounts, there are several actions you can take to further reduce your exposure.

Best practices for proactively engaging securely online

Often, engaging online is a choice. The following tactics can help to protect you.

• Exercise caution when using public Wi-Fi networks. Especially when checking financial accounts or executing transactions, stick to trusted private Wi‑Fi networks.
• Use secure websites starting with https://. This signifies that you are in a secure, encrypted online session.
• Log out of websites. Also, regularly clear cookies and browsing history from your internet browser.
• Keep all computer and device operating systems, antivirus software, and internet browsers up to date with the latest version. This can help to ensure that you have the most recent security patches in place.

Best practices for avoiding inadvertent exposure to social engineering

Social engineering is a technique utilized by cybercriminals to manipulate, influence, or deceive people into making security mistakes, performing an action, and disclosing sensitive information. The following steps can help to minimize your risk:

• Be cautious and take your time, especially when you receive unsolicited communications.
  • Review with a critical eye any unexpected email, text message, or other communication purporting to be from a legitimate source.
  • Look for red flags, such as poor grammar, requests for immediate action, or offers that seem too good to be true.
  • Always err on the side of caution, particularly when the requested action is unusual or bypasses normal business processes.
• Do not click on links or respond to emails or text messages from unknown senders.
  • Instead, if the sender purports to be representing a trusted company, type that company’s official URL directly into your browser.
  • Log in via their secure website or call the company using the phone number on your statement to further investigate the matter.
  • If the sender is completely unknown to you, disregard.
• Avoid providing personal or financial information requested via phone, email, text message, or social media.
  • Government agencies (such as the IRS or Social Security) and companies will not request personal information by email, text, or social media.
  • It is generally a best practice to disregard calls or texts from completely unknown numbers. If follow-up is needed, use a known phone number or alternate email address to verify any request before acting. Do not use the contact information provided by the potential scammer.
  • Typically, if the reason you are being contacted is legitimate, the company or individual will follow up using more formal communication channels, such as via first-class U.S. mail or express mail.

Develop awareness about common targets and scams

Unfortunately, adults over age 60 are the most common targets of cyberattacks, likely because they are viewed as having the largest savings balances. (See “Seniors and cyberfraud.”) Luckily, there are resources available to keep the public informed. The U.S. Department of Justice’s Transnational Elder Fraud Strike Force keeps an ongoing list of common elder fraud scams: https://www.justice.gov/elderjustice/senior-scam-alert. Following is a compiled list of these and other scams—and actions you should take if you suspect you’re being targeted.

Seniors and cyberfraud

Individuals over age 60 have reported over twice as much in financial losses as compared with any other age group (see Figure 2).

Seniors can reduce their vulnerability by following the technology use best practices outlined in this article and recognizing red flags that clearly indicate “this is a scam.”

According to the Federal Trade Commission:¹

• If the caller says you need to buy gift cards, go to a cryptocurrency ATM, or go to the bank in person while they stay on the phone with you, it’s a scam.
• If the caller tells you to lie to anyone who asks why you’re transferring or withdrawing so much money, it’s a scam.
• If the caller says you need to transfer or move your money to “protect it,” it’s a scam.
• If the caller tells you to cash out your savings to buy cryptocurrency or gold bars, it’s a scam.

A good rule of thumb: Ignore unexpected requests for money. Just hang up.

If you suspect that you’ve been victimized, let your loved ones and impacted account providers know. Many cybercrimes go unreported (and unresolved) because seniors are too ashamed to report the incident and explore a remedy.

Conclusion

While cybercrimes have grown in number and sophistication, the red flags and similarities across scams have largely remained the same. Cybercriminals often aim to create a sense of urgency through fear or the promise of something that sounds too good to be true. They often pressure their targets into acting fast and they almost always ask for money—but via odd methods such as through gift card or gold bar purchases, cryptocurrency transfers, or mobile payment apps. To protect yourself, take your time, ask questions, and trust that if something feels suspicious, it probably is. Take proactive measures to secure your accounts, and remember that if there is an urgent matter that must be resolved, trusted institutions will contact you through appropriate, formal business channels.

To become a more educated and aware online consumer, visit OnGuard Online, a service of the U.S. Federal Trade Commission and other federal agencies. OnGuard Online provides information about avoiding scams, understanding mobile apps and Wi-Fi networks, securing your home computer, and protecting family members. For additional information about actions you can take to protect yourself, speak with your trusted financial professional.

If you become a victim of cybercrime, do not feel ashamed. Let your loved ones and impacted financial institutions know, then report it to IC3 (a service of the U.S. Federal Bureau of Investigation). For additional guidance on steps to take if you suspect you’ve been scammed, visit the Federal Trade Commission’s website.