by Brian Thompson | Oct 7, 2026 | Mortgage, Real Estate, Scams, SMB
Mortgage wire fraud prevention usually gets treated as the title company’s job. The title company holds the escrow account, so the title company should worry about the wire. That logic breaks the moment a criminal gets into a loan officer’s mailbox. From there, they can see the closing date, the borrower’s name, the cash-to-close figure, and the tone your team uses with clients. Then they send the borrower “updated” wire instructions that look like they came from you.
Last Updated: October 2026
This guide is for owners, operations managers, and compliance leads at mortgage brokerages and independent lenders with roughly 10 to 150 employees. It covers what the numbers show, what the FTC Safeguards Rule may expect of your shop, and a mortgage wire fraud prevention plan your team can run without a full-time security hire.
Why mortgage wire fraud prevention starts with your shop
The FBI’s Internet Crime Complaint Center (IC3) logged 12,368 real estate fraud complaints in 2025, with $275.1 million in reported losses. That is up from $173.6 million in 2024, an increase of about 58% in one year. Source: the FBI IC3 2025 Internet Crime Report.
The broader category matters even more. Business email compromise (BEC), the scheme behind much of closing-day wire fraud, drew 24,768 complaints and more than $3 billion in reported losses in 2025. IC3 defines BEC as fraud against people who regularly make wire transfers, carried out by compromising email, phone numbers, or meeting apps. That describes a mortgage workflow almost exactly.
Real estate transactions give criminals three things they want:
- Large, predictable wires. Earnest money, cash to close, and payoffs all move on a known schedule.
- Many parties on one thread. Borrower, loan officer, processor, agent, title, and attorney all email each other. One weak mailbox exposes everyone.
- Time pressure. Nobody wants to delay a closing. Urgency makes people skip the callback.
AI is making the impersonation better. IC3 notes that chat tools can quickly produce official-sounding emails, and voice cloning can be used to request a wire. Businesses reported more than $30 million in 2025 losses to BEC scams involving AI. The old advice to “look for typos” no longer holds.
Here is the uncomfortable part for a broker or lender. Your shop may never touch the closing funds. But your inbox holds the details that make a fake instruction convincing. If the breach starts with you, the borrower will remember whose email it came from. That is why mortgage wire fraud prevention has to start inside your own shop.
What the FTC Safeguards Rule may expect from your shop
Whether the FTC Safeguards Rule applies to you depends on your entity and your regulator. Confirm it with counsel. That said, the FTC’s own guidance names mortgage lenders and mortgage brokers among its examples of covered financial institutions. Lenders owned by or supervised as banks generally answer to their banking regulator instead. State mortgage regulators may add their own requirements on top.
For covered firms, the rule requires a written information security program. The FTC lists nine elements. Several map directly to mortgage wire fraud prevention:
- A Qualified Individual who implements and supervises the program. This person needs real-world know-how, not a specific degree or title.
- Multi-factor authentication for anyone accessing customer information on your systems.
- Staff training, with regular refreshers.
- Service provider oversight, including contracts that spell out security expectations and periodic reassessment.
- A written incident response plan with clear roles, decision authority, and documentation steps.
There is also a reporting duty. If a security event involves the unauthorized acquisition of unencrypted information about at least 500 consumers, the rule requires notice to the FTC no later than 30 days after discovery. A compromised loan officer mailbox can hold far more borrower files than most owners expect.
Firms that keep customer information on fewer than 5,000 consumers are exempt from certain provisions, not the whole rule. Read the full guidance at the FTC’s Safeguards Rule page.
The practical point: the controls behind mortgage wire fraud prevention are largely the same controls the rule describes. You are not building two programs. You are building one and documenting it.
The mortgage wire fraud prevention control plan
None of these controls requires new software to start. Each one needs an owner and a record that it happened.
1. Name one owner for wire safety
Pick the person who decides what happens when something looks wrong. In a 25-person brokerage, that is often the operations manager or compliance lead. If the Safeguards Rule applies to you, this may be the same person as your Qualified Individual. Write the name down. When a suspicious email lands at 4:45 on a Friday, nobody should wonder whose call it is.
2. Set a callback rule your team cannot skip
Any change to payment instructions gets verified by phone, using a number from your file or a known directory. Never use the number in the email that requested the change. This applies to borrower payoffs, vendor invoices, and broker compensation. This one rule is the core of mortgage wire fraud prevention. Make it a written procedure, then train on it. A rule that lives only in someone’s head disappears during a rush close.
3. Warn borrowers early and more than once
Tell borrowers at application, again with disclosures, and again in the closing week. The message is short: your firm will never send new wire instructions by email alone, and they should call a known number before sending money. Put it in your email signatures and your portal. A borrower who expects the warning is far more likely to pause.
4. Review the title and settlement partners you send borrowers to
Your borrower’s money moves through partners you recommend. Ask each title, escrow, or settlement partner how they verify wire instructions and protect their own email. Record the answers and review them at least once a year. If the Safeguards Rule covers you and a partner receives borrower information from your firm, this also supports your service provider oversight requirement.
5. Lock down the mailboxes criminals want most
Loan officers, processors, and closers hold the most useful details. Require multi-factor authentication on every account. Check regularly for hidden forwarding rules, a common sign of a compromised mailbox. Remove access quickly when people leave. Then have staff practice spotting a spoofed closing email before a real one arrives.
The first hour after a misdirected wire
Speed decides how much money comes back. In 2025, the IC3 Recovery Asset Team ran its Financial Fraud Kill Chain on 3,900 incidents involving $1.16 billion in attempted theft. It helped freeze $679 million, a 58% success rate. One case involved a couple closing on a home who got an email impersonating their attorneys. They wired more than $449,000. After they filed with IC3, the receiving bank confirmed the full amount was still on hold.
Your written incident response plan should cover these steps in order:
- Call the sending bank immediately. The borrower (or your firm, if your wire went out) requests a recall and asks the bank to contact the receiving bank.
- File at ic3.gov regardless of the amount. Include full transaction details. IC3 states that time is of the essence.
- Alert the title or settlement company using a known phone number, so they can stop any related disbursements.
- Preserve the evidence. Do not delete the fraudulent email or wipe the affected account. Capture headers, forwarding rules, and login history.
- Contain the mailbox. Reset credentials, revoke sessions, and confirm MFA on the affected account.
- Decide on notifications. Your owner, with counsel, determines whether borrower information was exposed and whether FTC or state notice duties apply.
- Write it down. Record what happened, who decided what, and what you changed afterward.
Most small shops lose the first hour to guessing. Who calls the bank? Does anyone call the borrower? Which person decides whether this is reportable? A plan written on a quiet afternoon answers those questions before anyone is panicking.
Turning mortgage wire fraud prevention into an operating rhythm
A one-time policy fades. A rhythm holds. Here is a simple cadence a 10 to 150 person shop can run:
- Assess (annually): Inventory where borrower information lives, who can reach it, and which partners receive it.
- Prioritize (annually): Rank the gaps. For most mortgage shops, missing MFA and an unwritten callback rule top the list.
- Train (quarterly): Short refreshers on spoofed closing emails, payment changes, and phone impersonation.
- Review vendors (annually, and at onboarding): Re-ask your title and settlement partners how they protect wires and email.
- Prepare for an incident (twice a year): Walk through the first-hour steps as a tabletop exercise. Update the plan after each one.
Keep records of each step. When a lender partner, auditor, or examiner asks how you protect borrower information, you can show the work instead of describing it.
Mortgage wire fraud prevention FAQ
Does the FTC Safeguards Rule apply to mortgage brokers?
The FTC lists mortgage brokers and mortgage lenders among its examples of covered financial institutions. Coverage still depends on your activities and whether another regulator, such as a banking agency, supervises you. Confirm your status with counsel.
Who is responsible when a borrower wires money to a fraudster?
It depends on the facts, the contracts, and state law. Liability disputes can involve the lender, broker, agent, and title company. The safer question is whether your firm can show it trained staff, warned borrowers, and responded quickly.
Mortgage wire fraud prevention in practice
How fast do we need to act after a fraudulent wire?
Immediately. The FBI advises contacting your financial institution to request a recall and filing at ic3.gov regardless of the amount. Recovery odds fall as funds move to additional accounts.
What is the single most effective wire fraud control?
A mandatory callback to a known phone number before acting on any changed payment instructions. It is cheap, simple, and stops many email-based schemes. It only works if everyone follows it every time.
Do we have to report a compromised email account to the FTC?
Only if you are covered by the Safeguards Rule and the event involves unauthorized acquisition of unencrypted information about at least 500 consumers. Then notice is due within 30 days of discovery. State breach laws may also apply.
Does a small brokerage really need a written incident response plan?
If the Safeguards Rule covers you, a written plan is one of its required elements. Even if it does not, a short plan saves the first hour of a crisis, which is when recovery odds are highest.
What does mortgage wire fraud prevention look like for a small brokerage?
A named owner, a mandatory callback rule for changed payment instructions, repeated borrower warnings, documented reviews of title and settlement partners, multi-factor authentication on every mailbox, and a written incident response plan your team has practiced.
Put an owner and a record behind the plan
Most mortgage shops already know wire fraud is a risk. What they lack for real mortgage wire fraud prevention is a named owner, a training schedule, partner reviews on file, and an incident plan someone has actually practiced. defend-id gives smaller firms one place to assign that work and document it, with employee security training, vendor management, and 24/7 incident response and breach support. Your firm still owns its program. We help you run it and show the records when a lender, auditor, or examiner asks.
Related articles
by Brian Thompson | Aug 19, 2026 | Employee Benefits, Identity Theft, Scams
Identity theft protection voluntary benefit interest just posted its biggest jump in years. The timing lines up directly with the window most HR teams use to lock 2027 plan year decisions. Gallagher’s newest benefits benchmarking data, published this month, shows employer interest in the benefit climbing to 42 percent. That is up eight points since 2023, and it is not a marginal shift. It signals something bigger. Identity theft protection has moved from a nice-to-have line item to a benefit finance now expects on the enrollment menu.
Last Updated: August 2026
Open enrollment planning is underway right now for most 100 to 500 employee organizations. The benefit keeps showing up on the same short list as supplemental health, legal plans, and pet insurance. What changed since last year is not the concept. It is the size of the number behind it. Breach costs hit a new record this year, and it has become far cheaper to add the benefit than to absorb the productivity drain when an employee’s identity gets compromised on company time.
What you’ll get in this guide:
- How voluntary benefit priorities shifted heading into the 2027 plan year
- The updated business case HR can bring to Finance
- What to require from a provider before signing
- Rollout tips that earn executive buy in without a big lift
Heads up: after Section 3 you will find a call out box. It links to defend-id’s free ROI Calculator and Incident Response Checklist, built for exactly this conversation with your CFO.
1. Voluntary Benefit Rankings for the 2027 Plan Year
Gallagher’s 2026 US Benefits Benchmarks report surveyed more than 3,700 US organizations between January and March 2026. It found employer interest in identity theft protection at 42 percent, up eight points from 2023. Pet insurance and employee perk programs grew too. But identity theft protection posted one of the sharpest gains among financial wellness benefits in the entire survey.
That growth sits on top of a longer trend. A separate Gallagher survey found that nearly one third of employers plan to expand their voluntary benefit offerings by 2027. Seventy percent said a comprehensive benefits package is a driving reason for adding new options at all. Two thirds of employers now call voluntary benefits an important part of their financial wellbeing strategy, not just a retention perk.
2. Why Identity Theft Protection Keeps Climbing the List
Three forces are pushing this benefit up the priority stack at the same time.
Breach costs hit a record high. IBM’s 2026 Cost of a Data Breach Report puts the global average breach cost at 4.99 million dollars. That is a 12 percent jump and a new record. US organizations averaged 11.5 million dollars per breach. AI enabled attacks now account for roughly one in four malicious breaches, and they add close to an extra million dollars in cost on average.
Breach volume is not slowing down. defend-id’s own analysis of the Identity Theft Resource Center’s H1 2026 Data Breach Report found 471.2 million victim notices issued in just the first six months of the year. That figure already exceeds the full year 2025 total. Q2 2026 alone accounted for the second highest single quarter of compromises on record.
Employees expect it. Interest in voluntary benefits keeps growing across every generation in the workforce. Identity theft protection sits near the top of what employees say they would enroll in without an employer subsidy. That last point matters more to Finance than almost anything else in this article. It means the benefit rarely requires new budget to launch.
3. The HR and Finance ROI Case (Share These Numbers)
Javelin Strategy and Research’s 2026 Identity Fraud Study came out in April. It tells a more nuanced story than a simple year over year increase, and that nuance is worth bringing into the room with Finance rather than avoiding it.
Combined identity fraud and scam losses fell to 38 billion dollars in 2025, down from 47 billion dollars in 2024. On its own, that reads like good news. Look one layer deeper and the picture changes. New account fraud is the category most likely to touch payroll direct deposit and HR systems. It rose 13 percent to 7 billion dollars in losses. Victims climbed 31 percent to 5.4 million. Average resolution time also climbed, from 9.5 hours in 2023 to 10.4 hours in 2025. The headline number improved. The category that actually lands on HR’s desk got worse.
Most cases resolve quickly. Bureau of Justice Statistics research found that 56 percent of victims spend a day or less resolving a fraud incident. But a meaningful minority do not. The FTC puts average new account fraud resolution at 77 hours. The Identity Theft Resource Center’s Aftermath Study has documented severe cases running as high as 600 hours, spread over 6 to 22 months. Almost all of that time lands during business hours. That is the productivity cost that rarely makes it into a benefits budget conversation until someone asks for it directly.
4. How to Vet a Provider for Your Identity Theft Protection Voluntary Benefit
Not every product marketed as identity theft protection delivers the same thing once an employee actually files a claim. Use this shortlist before signing.
| Must Have Feature |
Why It Matters |
Quick Check |
| Fully managed restoration |
Offloads the hours-long resolution burden from the employee and from HR |
Ask whether a dedicated advocate handles the case start to finish, not a call center reading a script |
| Dark web and credential monitoring |
Finds leaked Social Security numbers and payroll credentials before fraud escalates |
Confirm real time alerts, not a weekly digest email |
| Identity theft insurance up to 1 million dollars |
Covers lost wages, legal fees, and childcare during a long recovery |
Verify the issuer and ask to see the actual claims process, not just the coverage limit |
| Easy payroll deduct or employer paid setup |
Low friction drives higher adoption than a benefit employees have to self administer |
Ask for a sub-30-day implementation timeline in writing |
| Security and compliance documentation |
Reduces enterprise risk and speeds up your own vendor review process |
Request SOC 2 or ISO documentation plus a breach assist playbook |
| Adoption and outcome reporting |
Proves ROI to Finance instead of asking them to take it on faith |
Confirm quarterly reports on adoption rate, cases resolved, and hours saved |
defend-id checks every item on that list. Small group pricing runs down to two employees, built for the 100 to 500 employee range most HR teams are managing this benefit for.
5. Implementation Tips That Impress Leadership
- Frame it as risk mitigation, not a perk. Map projected hours lost against your own internal salary data. Then reference the IBM 2026 breach cost figures when you present it. That framing moves the conversation from “nice extra” to cost avoidance.
- Pair it with cyber awareness training. Employers who launch identity protection alongside a short training refresh see stronger uptake. They also see fewer incidents in the first year than employers who launch the benefit alone.
- Pilot with a high exposure department first. Payroll and finance staff handle the most sensitive personal data internally. Early adopters there tend to become the strongest internal advocates once colleagues see how it works.
- Measure and report from day one. Track adoption, hours restored, and incidents resolved. Fold that data into your quarterly HR dashboard instead of waiting for an annual review to look at it.
- Budget with real numbers. Employer paid plans typically benchmark in the 3 to 5 dollar PEPM range. Voluntary payroll deduct plans run 5 to 15 dollars PEPM depending on tier and family coverage. Either way, net employer cost stays close to zero.
Quick Reference: Talking Points for Your CFO
- “The global average data breach cost hit a record 4.99 million dollars in 2026, up 12 percent year over year.” (IBM 2026)
- “New account fraud, the category that touches payroll systems directly, rose 31 percent in victims last year.” (Javelin 2026)
- “471.2 million breach victim notices went out in the first half of 2026 alone, already ahead of all of 2025.” (ITRC H1 2026)
- “42 percent of employers now show interest in this benefit, up 8 points since 2023, and most employees will enroll without a subsidy.” (Gallagher 2026)
Frequently Asked Questions
When should we finalize a voluntary identity theft protection benefit for the 2027 plan year?
Most group carriers need 6 to 8 weeks to load a new voluntary benefit into open enrollment systems and generate payroll deduct codes. For a plan year starting January 1, 2027, that puts the practical decision deadline in October or early November 2026. Waiting until December risks pushing the benefit to a 2028 effective date instead.
Should this go through our existing benefits broker or get set up separately?
Most brokers who already handle voluntary benefits like accident, critical illness, or legal plans can add identity theft protection through the same enrollment platform. That keeps deduction codes and open enrollment communication in one place. Confirm early, since not every broker platform supports every carrier’s data feed format. A mismatch here is the most common cause of a delayed launch.
How fast can a program actually go live once we sign?
Providers built for group enrollment typically finish implementation in under 30 days once a census file and plan design are finalized. The identity theft protection vendor is rarely the bottleneck. Waiting on final headcount data from payroll or the HRIS system usually is. Starting that data pull early shortens the real timeline more than anything else.
What should we actually measure after launch to prove ROI to Finance?
Track three numbers on a quarterly cadence: enrollment rate against eligible headcount, average case resolution time for any employee who files a claim, and HR hours spent handling identity related issues before versus after launch. A provider that cannot discuss all three during the sales conversation will not report on them after the contract is signed either.
We already carry cyber liability insurance. Isn’t this redundant?
No. Cyber liability insurance protects the company’s own systems and covers the company’s costs if it is breached. It does not monitor, alert on, or help resolve identity fraud committed against an employee’s personal Social Security number, bank accounts, or tax filings. None of that runs through company systems. The two coverages sit next to each other, not on top of each other.
What is the single most important question to ask a provider before signing?
Ask exactly who performs the recovery work once an employee’s identity is compromised. Some providers route employees to a call center that reads from a script and hands them a list of phone numbers to call themselves. Others assign a dedicated advocate who works the case directly with banks, credit bureaus, and government agencies on the employee’s behalf. That distinction decides whether the insurance figure on the sales sheet ever translates into hours actually saved.
Conclusion
The identity theft protection voluntary benefit has moved well past nice-to-have status heading into the 2027 plan year. A turnkey program shields employees from disruptive fraud. It also protects your organization from the hidden productivity drain that lands on payroll and HR’s desk long before it ever shows up in a benefits budget line. With the right partner, rollout stays close to as simple as flipping a payroll switch.
| Action |
Best For |
| Schedule a 15 minute discussion |
You have budget authority and specific questions |
| Download the ROI Calculator and Checklist |
You need hard numbers before proposing this internally |
| Subscribe for weekly HR security insights |
You are still exploring options |
Protect your people. Protect your bottom line. defend-id can help you do both.
Related Articles
by Brian Thompson | Aug 5, 2026 | Breach, Identity Theft, Scams
Deepfake scams have moved past the experimental stage. Criminals no longer need hours of footage or a Hollywood budget. A LinkedIn video, a voicemail greeting, or a few seconds of audio pulled from a webinar recording is now enough to build a convincing fake of your CEO, your CFO, or your employee’s own family member. What used to take a skilled forger a week now takes a scammer minutes.
Last Updated: August 2026.
This article breaks down how deepfake scams are being used against businesses right now and the numbers behind why this threat is accelerating faster than almost any other fraud category. It also covers what actually happens to an employee after they have been the one fooled. That last part is the piece most security blogs skip. It is also the part that matters most once the wire transfer is already gone.
What Is a Deepfake, and Why It Is an HR Problem Now
A deepfake is synthetic media, video, audio, or images, built with artificial intelligence to convincingly mimic a real person’s face, voice, or expressions. Three years ago, deepfake scams required a data set of hours. Today they require far less:
- A handful of public photos
- A short video from a company website, webinar, or LinkedIn post
- As little as three seconds of clean audio
That last point is the one that should worry HR and finance leaders most. Voice cloning models trained on just three to ten seconds of speech can already produce a convincing match. That is enough to fool a coworker on the phone, according to testing cited by Fox News. Every recorded all-hands meeting, sales call, or conference talk your executives have given is now raw material for deepfake scams.
The 2026 Numbers: How Fast Deepfake Fraud Is Accelerating
The scale of this problem has changed dramatically even in the last year. Three data points define the current threat landscape:
- Deepfake fraud attempts are up 2,137 percent over the last three years. Deepfakes made up just 0.1 percent of all fraud attempts three years ago. Today they account for roughly 6.5 percent, according to Signicat’s Battle Against AI-Driven Identity Fraud report.
- The FBI now tracks AI fraud as its own category. The FBI’s 2025 Internet Crime Report, released in April 2026, broke out artificial intelligence complaints for the first time in the Internet Crime Complaint Center’s 25-year history. That new category alone covered 22,364 complaints and nearly $893 million in reported losses. The FBI stated the real number is likely higher, since most victims never realize AI was involved in the scam that hit them. Read the full release from the FBI’s National Press Office.
- Per-incident losses are climbing. Industry surveys of business leaders in 2026 put the average cost of a single deepfake fraud incident close to $500,000. Financial services firms report losses well above $600,000 per incident, while small businesses typically lose tens of thousands rather than hundreds of thousands. These figures vary by methodology and industry, so treat them as directional rather than exact.
None of this is a one-time news event. Deepfake scams are a live, accelerating trend. The businesses least prepared for it are the ones still picturing deepfakes as a novelty rather than a Tuesday-morning phone call.
How Cybercriminals Use Deepfakes to Target Your Business
Deepfakes fit naturally into the fraud tactics businesses already deal with. They just make each one far more convincing:
- Wire transfer fraud. A video call or voice message from “leadership” requesting an urgent payment, often timed for end of day or before a holiday when verification is slower.
- Credential harvesting. A cloned voice posing as an IT admin who needs a password reset “right now” to fix a supposed outage.
- Data access manipulation. An impersonated executive requesting sensitive files, HR records, or payroll data.
- Vendor and partner scams. A cloned voice leaving a voicemail about “updated” banking details for an upcoming invoice.
What changed in the last year is the sourcing. Attackers used to need a leaked recording or a hacked voicemail system to get audio of an executive. Now they pull it from the same LinkedIn video your marketing team posted to build the CEO’s personal brand. The more visible your leadership is online, the more raw material a scammer has to work with.
Real-World Example: $25 Million Lost to a Single Video Call
In one widely documented case, a finance employee joined a video call that appeared to include the company’s CFO and several familiar colleagues. Every face and voice on the call matched people the employee had worked with for years. The “CFO” instructed the employee to process a transfer, and the employee complied. By the end of the call, this deepfake scam had moved more than $25 million to accounts controlled by criminals.
Every person on that call, other than the victim, was a deepfake. Nothing about the request felt unusual because everything about the delivery felt normal. That is the core danger of deepfake scams: they do not exploit a technical vulnerability. They exploit the trust employees place in their own eyes and ears.
Red Flags: What Employees Can Still Catch
Deepfake technology keeps improving, but most attacks in the wild still carry small tells. Slow down and check for these before acting on any urgent request:
Visual cues
- Lips slightly out of sync with the audio
- Unnatural blinking or stiff facial movement
- Lighting or shadows that do not match the rest of the frame
- Body movement that does not track with speech cadence
Audio cues
- A flat or slightly robotic tone
- Repetitive phrasing or odd word choices
- Background noise that cuts in and out unnaturally
- Speech rhythm that feels a little off compared to how the real person talks
These cues will not always be obvious, and they will get harder to spot as the technology improves. That is exactly why verification habits matter more than visual scrutiny alone.
Verification Habits and Organizational Protections
Modern security awareness is not about spotting every fake. It is about pausing long enough to verify. Before acting on an unusual request, employees should ask themselves three questions: Is this request unusual for this person? Would acting on it cause serious harm if it turns out to be fake? Is there a second way to confirm it?
Organizations can make deepfake fraud far harder to pull off with a few concrete steps:
- Require a callback or shared passphrase for any request involving a wire transfer, password reset, or sensitive data, confirmed through a channel the attacker does not control.
- Turn on multi-factor authentication everywhere sensitive systems live, so a cloned voice cannot substitute for a stolen credential.
- Limit public exposure of executive voice and video where practical, and be aware that any public appearance is now training data for attackers.
- Run regular security awareness training that specifically covers deepfake and voice-cloning scenarios, not just email phishing. Our phishing awareness guide and vishing attacks breakdown are good starting points for that training.
- Give employees identity protection as a benefit, not just a corporate firewall. Deepfake scams frequently start with stolen personal data. Employees need somewhere to turn when their own identity, not just the company’s bank account, is what gets hit.
What Happens to the Employee After the Call
Most coverage of deepfake scams stops at the wire transfer. That is a mistake, and it is the gap defend-id was built to close.
The $25 million case above involved a corporate account. But a growing share of deepfake and voice-cloning fraud targets employees personally, not just their employer. A cloned voice claiming to be a family member “in trouble” convinces someone to wire money from their own savings. A fake HR representative talks an employee into confirming a Social Security number “to update payroll.” A spoofed executive persuades a new hire to share personal banking details during onboarding. When that happens, the damage lands on the individual employee’s credit, bank accounts, and peace of mind, not just the company’s balance sheet.
This is where the employer/HR angle actually pays off. Generic IT-security content stops at “train your employees.” It rarely addresses what happens to that employee after they have already been tricked. Their own identity is now compromised, and they do not know where to turn. That is a retention and trust question as much as a security one.
Offering identity theft protection as an employee benefit means someone on your team has support the moment this happens. Monitoring catches misuse early, and recovery advocates handle the calls, disputes, and paperwork so the employee is not fighting it alone. It is the difference between an employee quietly absorbing a financial disaster and an employee who knows their employer had their back when it counted. For the fuller case, see our 2026 HR guide to identity theft protection as a benefit.
Related reading: our breakdowns of deepfake job applicants targeting HR teams and workplace identity theft hijacking employee paychecks cover two more angles on this same trend.
Frequently Asked Questions
What is a deepfake scam?
A deepfake scam uses AI-generated video, audio, or images to impersonate a real person, such as an executive, IT admin, vendor, or family member. The goal is to trick someone into sending money, sharing credentials, or handing over sensitive data.
How much audio does it take to clone someone’s voice in 2026?
Current voice-cloning tools can produce a convincing match from as little as three to ten seconds of clean audio. That audio is often pulled from public sources like a LinkedIn video, webinar recording, or voicemail greeting.
How fast are deepfake scams actually growing?
Deepfake fraud attempts have increased 2,137 percent over the last three years, according to Signicat. The FBI also added AI fraud as its own tracked category for the first time in its 2025 Internet Crime Report. That new category covered more than 22,000 complaints and nearly $893 million in losses.
Can employees really detect a deepfake without special tools?
Sometimes. Lip-sync issues, unnatural blinking, flat vocal tone, and odd background audio are still common tells. But detection alone is not a reliable defense as the technology improves, which is why verification protocols matter more than visual scrutiny.
What happens to an employee personally if they are tricked by a deepfake scam?
It depends on the scam. Employees can lose personal savings, have their Social Security number or banking details exposed, or become targets of follow-up fraud. Identity theft protection benefits give them monitoring and recovery support for exactly this scenario.
What should a business do if it suspects a deepfake attack in progress?
Stop the interaction and verify the requester’s identity through a separate, trusted channel, such as a known phone number. Do not proceed with any transfer or data disclosure until that verification is confirmed.
Awareness and Systems Are Your Best Defense
Deepfake scams work because they exploit the one thing humans trust most, our own eyes and ears. You cannot stop the technology from improving. You can build the habits and systems that keep your organization, and your employees, ahead of it. Slow down. Verify identity through a second channel. Use passphrases for high-risk requests. Give employees somewhere to turn when the fraud gets personal.
defend-id provides the automated layer that protects employees when identity-based attacks slip past training and policy. Monitoring, alerts, and full recovery support reduce risk and distraction. Your team stays focused on the work instead of untangling a stolen identity on their own time. Talk to us about adding identity protection to your benefits package.
Related Articles
by Brian Thompson | Jul 8, 2026 | General, Identity Theft, Scams
On July 7, 2026, the IRS and its Security Summit partners launched a five week campaign called “Protect Your Clients; Protect Yourself.” It targets tax professionals squarely, and it makes the case for identity theft protection for tax professionals plainly: small tax and accounting firms are a preferred target for identity thieves, not an afterthought.
Last Updated: July 2026 | Reading time: ~10 minutes
If you run a small tax prep shop, bookkeeping firm, or accounting practice, this campaign is about you. Here is what it covers, why your firm faces exposure, and what to do about it before the next filing season, not during it.
Table of Contents
- Why Tax and Accounting Firms Are a Preferred Target
- What the IRS Summer Campaign Actually Covers
- The Scams Making the Rounds Right Now
- What Smart Firm Owners Are Doing Differently
- What to Look for in Identity Protection Coverage for Your Staff
- Frequently Asked Questions
Why Tax and Accounting Firms Are a Preferred Target
A ten person tax prep firm can hold more concentrated identity data than a mid sized retailer. Names, Social Security numbers, dates of birth, W-2 and 1099 records, bank routing numbers, dependents’ information, sometimes years of returns going back a decade. It is a single, dense target, and most small firms protect it with a shared office password and whatever antivirus came with the computer.
The Security Summit has run this awareness campaign for eleven years for a reason. Tax professionals keep getting hit, and the fallout does not stay contained to the firm. A single breached preparer can hand a criminal ring the raw material to file fraudulent returns in hundreds of clients’ names, each one a multi month recovery process for the victim and a reputational hit for the firm that lost the data.
Small firms also face structural exposure in ways large firms do not. Fewer dedicated IT staff. No formal incident response plan. Client documents moving over email instead of a secure portal. Seasonal staff get a login in January and are gone by May, sometimes with nobody ever revoking their access.
What the IRS Summer Campaign Actually Covers
The 2026 “Protect Your Clients; Protect Yourself” series runs five weekly releases, timed to coincide with the IRS Nationwide Tax Forums running through September (Chicago, then New Orleans August 4 to 6, New York City August 18 to 20, Orlando September 1 to 3, and San Diego September 15 to 17). Here is what each week covers, according to the IRS:
- Week one, new and emerging scams. IRS impersonation by email, text, and spoofed calls. Misleading “tax hack” advice circulating on social media. Fake prospective clients sending malware disguised as tax documents. Phishing attempts targeting a preparer’s EFIN, PTIN, or CAF number specifically.
- Week two, phishing, spear phishing, and whaling. How targeted attacks differ from generic phishing, and the “Security Six” protections the IRS recommends every firm put in place.
- Week three, the written security plan. Federal law requires paid preparers to maintain a Written Information Security Plan. The IRS is using this week to push firms that do not have one, or have not updated it, to fix that.
- Week four, tools that actually help. Multi factor authentication, Identity Protection PINs, IRS Online Accounts, and Tax Pro Accounts.
- Week five, recognizing and reporting theft. What the early signs of a breach look like and the reporting steps that limit the damage, including contacting your local IRS Stakeholder Liaison and your state tax agency through the Federation of Tax Administrators.
The “Security Six,” Explained
Week two is worth pausing on, because the “Security Six” gets referenced constantly in tax industry guidance without much explanation of what it actually requires. Under IRS Publication 4557, the six baseline protections are:
- Anti-virus and anti-malware software, kept on automatic updates so it catches newly identified threats daily.
- Firewalls, both hardware and software, to block unwanted traffic before it reaches a workstation or server.
- Multi factor authentication, on every system that touches client data, not just email.
- Backup software or services, with critical files routinely copied to an external or cloud source.
- Drive encryption, so a stolen or lost laptop does not hand over readable client files.
- A virtual private network, for any connection made outside the office, including a preparer’s home Wi-Fi during a slow afternoon.
None of this is new advice, exactly. What is new is the IRS spelling out, in public, that tax professionals remain a soft and valuable target heading into the back half of 2026.
The Scams Making the Rounds Right Now
Per the IRS’s week one release, four patterns account for most of the current activity against tax professionals:
- IRS impersonation. Scammers use email, text, direct messages, and spoofed caller ID, sometimes with computer generated voices, to push preparers or their staff toward a malicious link or a request for sensitive information.
- “New client” phishing. A fraudster poses as a prospective client and sends an attachment disguised as a tax document. Opening it hands over firm and client data at once.
- EFIN, PTIN, and CAF number theft. These are the credentials that let a preparer file on a client’s behalf. Once stolen, they let a criminal file fraudulent returns that look, on paper, like they came from a legitimate practice.
- Viral tax misinformation. Social media “hacks” convince taxpayers to claim credits they do not qualify for or file with false information, which then lands on the preparer’s desk as a compliance headache, and sometimes as an accusation that the preparer enabled fraud.
What Smart Firm Owners Are Doing Differently
The firms that stay off next year’s breach notification list treat this as an operating requirement, not a once a year training video.
Write the security plan and actually follow it. A Written Information Security Plan is a federal requirement for paid preparers, not a nice to have. If your firm does not have a current one, the IRS publishes a template. If you have one from three years ago, assume it is out of date.
Turn on multi factor authentication everywhere client data lives. Tax software, email, cloud storage, the works. This single step stops the majority of credential based break ins.
Verify before you trust a “new client.” A legitimate prospective client will tolerate a phone call to confirm identity before you open their attachment. A fraudster will not.
Lock down access the day someone leaves. Seasonal and part time staff need offboarding discipline as much as full time employees. Revoke logins the day the engagement ends, not whenever someone gets around to it.
Protect the people who handle the data, not just the data itself. Your staff’s own identities are a target too. A preparer or bookkeeper whose personal Social Security number ends up on the dark web is one incident away from a very bad month, and a distracted employee is a bigger risk to your clients’ data. Offering identity theft protection as a benefit is not just goodwill. It is a control that keeps your team focused and your firm out of a second, unrelated breach story.
What to Look for in Identity Protection Coverage for Your Staff
If you are evaluating identity protection as a benefit for your firm, whether it is three employees or thirty, the features that matter are the same ones that matter for any small business:
- Dark web monitoring, so you find out if an employee’s credentials or Social Security number are circulating before a criminal uses them.
- SSN and credit file monitoring, which flags new accounts or inquiries early, the first sign something is wrong.
- Fully managed recovery, meaning a dedicated advocate handles the calls, disputes, and paperwork if a criminal compromises an employee’s identity, rather than handing them a checklist during your firm’s busiest season.
- Family plan coverage, since a compromised household member’s finances can distract an employee just as much as their own.
- U.S. based support with real response times, measured by how fast someone picks up, not by a features list.
Frequently Asked Questions
Does my small tax practice really need a Written Information Security Plan?
Yes. It is a federal requirement for any paid tax return preparer, regardless of firm size. The IRS publishes a template (Publication 5708) that firms can adapt rather than build from scratch.
What is an EFIN, and why do criminals want it?
An Electronic Filing Identification Number is what the IRS issues to authorize a preparer to e-file returns. A stolen EFIN lets a criminal file fraudulent returns that appear to come from a legitimate firm, which is why this year’s campaign calls out phishing attempts targeting EFINs, PTINs, and CAF numbers specifically.
What should I do if I think my firm has been breached?
Contact your local IRS Stakeholder Liaison immediately so the IRS can move to block fraudulent returns filed under your clients’ names. Also report the incident to your state tax agency through the Federation of Tax Administrators’ data breach reporting page, and follow the FTC’s data breach response guidance for businesses.
Is offering identity theft protection to my employees actually useful, or just a nice-to-have benefit?
Both. For a firm handling client SSNs and financial data all day, a compromised employee identity creates both a distraction and a risk vector at the same time. Coverage that includes dark web monitoring and managed recovery limits how much of your busiest season gets eaten up by one employee’s personal identity theft crisis.
What exactly are the IRS’s “Security Six” protections?
Six baseline controls defined in IRS Publication 4557: anti-virus and anti-malware software, firewalls, multi factor authentication, regular data backups, drive encryption, and a VPN for remote connections. The IRS treats these as the minimum, not a finish line.
How should I handle security for seasonal or part-time tax prep staff?
Treat their offboarding with the same discipline as a full time employee’s. Revoke login credentials, tax software access, and shared drive permissions the day the engagement ends, not weeks later when someone remembers to do it. A seasonal preparer’s forgotten login is one of the more common ways firm data stays exposed long after filing season closes.
The Window to Fix This Is Now, Not January
Tax season is when firms discover their security gaps. Summer is when firms actually have time to close them. The IRS is using its five week campaign to make that case publicly. Use the slow season to write or update your security plan, turn on multi factor authentication, and decide whether your team has the identity protection coverage they need before next filing season puts everyone back under pressure.
If you are evaluating identity theft protection as a benefit for your practice’s employees, defend-id works with small businesses to provide identity theft protection and recovery services for employees and their families. A dedicated, U.S. based recovery advocate is what matters most when something actually goes wrong.
Articles related to protecting tax and accounting firms
by Brian Thompson | Jul 1, 2026 | Identity Theft, Scams
Summer travel scams cost Americans real money every year. The FTC’s most recent Consumer Sentinel data shows travelers reported $274 million in losses tied to travel, vacation, and timeshare fraud. That covers more than 58,000 reports. Most scam victims never file a complaint at all, so the real number is almost certainly higher.
Last Updated: July 2026
What makes summer travel scams different this year isn’t just volume. It’s who’s behind them and how convincing they’ve gotten. AI voice cloning tools that used to require a Hollywood studio now run on a laptop. Travel companies you trust with your booking details are getting breached at a pace that should worry every family planning a trip. If you’re heading out this summer, or you’re an HR leader protecting employees who travel for work, last year’s advice needs an update.
Why Summer Travel Scams Look Different in 2026
Two things changed the landscape this year. First, generative AI made impersonation cheap and convincing. Booking.com’s head of internet safety told attendees at the Collision technology conference that the platform has seen a 500 to 900 percent increase in AI-driven travel scams over the past 18 months. Fake listings and phishing emails that used to have obvious typos now read like they came from a professional copywriter.
Second, the travel companies themselves keep getting breached. Amtrak disclosed a data exposure in April 2026 affecting more than 2.1 million customer accounts. The exposed data included names, email addresses, and support records. Carnival confirmed a breach in June 2026 after a social engineering attack compromised a single employee account. Nearly 6 million people had names, contact details, dates of birth, and in some cases government-issued ID numbers exposed. Security researchers have also tracked a sharp rise in scams impersonating Booking.com, with some travelers receiving fraudulent messages that quote real reservation details before the company even announced a problem.
Put those two trends together and the risk compounds fast. A fake message might already know your real hotel, your real dates, and your real confirmation number. That context makes people less skeptical. It also makes them far more likely to hand over exactly what a scammer needs to open new credit in their name.
Common Summer Travel Scams in 2026
Fake QR Codes at Airports and Hotels
Scammers print stickers that look identical to official QR codes. They place them over real ones on parking meters, menus, and airport signage. Scanning one can send you to a phishing site built to steal login credentials, or trigger a malicious download. Look for signs of tampering before you scan, like a sticker sitting slightly off center. When in doubt, type the website address in manually instead.
AI Voice Cloning (“Vishing”) Calls
Voice cloning tools can now recreate a familiar voice from just a few seconds of audio, often pulled from a social media video. Scammers use the cloned voice to call a family member claiming to be stranded or in legal trouble abroad. They pressure the listener to wire money immediately. The same technique shows up in fake airline and cruise line calls, where an AI-generated agent walks a traveler through a fraudulent refund. If a call creates urgency and asks for money or personal information, hang up. Call the person or company back using a number you look up independently. We cover the mechanics of these calls in more detail in our guide to vishing attacks.
Fake Booking and Rental Websites
Cloned booking sites and hijacked vacation rental listings remain some of the most expensive summer travel scams. They’ve also gotten harder to spot. Scammers now scrape real listing photos and reviews, then advertise the same property at a lower price. They push you to pay outside the platform. Once the payment method is a wire transfer, gift card, or cryptocurrency, the money is effectively gone. Book directly through the hotel’s official site or a platform you’ve used before. Treat any request to pay off-platform as a hard stop.
Travel-Themed Text Message Scams
Expect a wave of texts this summer claiming your flight changed or your booking needs verification. Some promise a refund if you click a link. These messages often arrive with real-looking airline or hotel branding. The urgency is designed to make you tap before you think. Never click a link in an unsolicited travel text. Log into your airline or hotel account directly instead, or call the number printed on your original confirmation. Our smishing breakdown walks through how to spot these messages before you tap anything.
Fake Hotel and Airport Wi-Fi
Public networks with names like “Airport_Free_WiFi,” or a near match to your hotel’s actual network name, can let an attacker see everything you send while connected. That includes login credentials and session data. Confirm the exact network name with staff before connecting. Avoid logging into banking or work accounts on any public network unless you’re running a VPN.
Lost or Stolen Phones and Devices
A lost phone is more than an inconvenience while traveling. It’s often the fastest route into someone’s full identity. Phones typically hold saved passwords, banking apps, and two-factor authentication codes. Use a strong passcode and enable Find My Phone or an equivalent tracking feature. Remove stored passport or payment card details from apps before you leave home.
How to Protect Yourself Before and During Your Trip
- Turn on multi-factor authentication for email, banking, and any travel accounts before you leave. Confirm it also works on payroll or benefits portals if you’re traveling for work.
- Use a VPN on any public Wi-Fi, whether that’s an airport lounge, hotel lobby, or coffee shop.
- Pay with credit cards, not debit cards. Credit cards generally offer stronger fraud protection and faster dispute resolution.
- Set up transaction alerts on the cards you plan to use. That way you catch unauthorized charges within minutes, not weeks.
- Verify unexpected contact through a second channel. This applies to a call from a “relative in distress” or an email about a canceled flight. Call the person or company back using a number you already have.
- Enroll in identity monitoring before you travel, not after something goes wrong. Services like defend-id watch for signs your information is being misused and alert you the moment something changes.
What to Do If You Think You’ve Been Scammed
Speed matters more than almost anything else once a scam happens. Take these steps in order:
- Contact your bank or card issuer immediately. Dispute the charges and lock down the affected account.
- File a report at IdentityTheft.gov. This gets you a personalized recovery plan from the FTC.
- Place a fraud alert or credit freeze with one of the three major credit bureaus. They’re required to notify the other two.
- Document everything. Save dates, names, confirmation numbers, and copies of any messages from the scammer.
- Get help if the case involves a real financial loss. Identity theft cases with financial impact are far less likely to resolve without support. This is exactly the gap defend-id’s restoration advocates are built to close. They handle the calls and paperwork so you don’t have to untangle it alone.
🚩 Free Travel Safety Checklist
Download our Travel Safety Checklist here and keep it on your phone for quick reference before and during your trip.
Travel Safety FAQ
Should I use public charging stations at airports?
No. Public USB charging ports can be compromised in an attack known as juice jacking. A modified port can install malware or pull data while your phone charges. Bring your own charger and wall adapter, or carry a portable battery instead.
Is it safe to book travel deals I found on social media?
Treat social media travel ads with caution. Scammers routinely build convincing ads for fake vacation rentals and discounted packages. Verify any deal on the company’s official website before entering payment information. Be skeptical of prices that are dramatically lower than everywhere else.
What should I do if I lose my passport while traveling internationally?
Contact the nearest U.S. embassy or consulate immediately to begin the replacement process. Keep a digital copy of your passport’s photo page stored securely before you leave. It speeds up the replacement significantly.
What if I lose my phone during my trip?
Use Find My Phone or your device’s equivalent to lock or wipe it remotely. Then change the passwords on any accounts that were logged in on that device. Start with email and banking.
Are AI voice cloning scams really that convincing?
Yes. Modern voice cloning tools need only a few seconds of audio to generate a convincing fake of someone’s voice, often pulled from a public social media post. The defense isn’t spotting the fake by ear. It’s verifying any urgent request for money through a second channel before acting.
How is a summer travel scam different from identity theft?
A travel scam typically targets your money directly, like a fake booking charge. Identity theft happens when a scammer uses information collected during that scam later. That can mean your name, date of birth, or passport number used to open new accounts or file fraudulent claims. That’s why even a small travel scam is worth monitoring for months afterward.
For HR Teams: Protecting Employees Who Travel This Summer
Summer means more employees booking personal vacations and more teams traveling for conferences and client visits. Both create exposure that eventually lands on HR’s desk as lost productivity or a compromised work account. A few low-lift steps make a real difference:
- Send a short, five-point security reminder before major travel windows instead of relying on an annual policy document nobody reads.
- Confirm MFA is enabled on payroll and benefits portals specifically, not just email.
- Share the Travel Safety Checklist in your next newsletter or pre-trip email.
- Offer an identity protection benefit like defend-id so employees have a fast, professional resource if something goes wrong on the road.
If work travel specifically is your priority, we go deeper on device security, payroll portal risk, and pre-trip protocols in our guide to preventing identity theft during work travel.
Conclusion
Scammers have better tools this year. The fundamentals of staying safe haven’t changed nearly as much as the threats have. Verify before you trust. Pay with a credit card. Keep your accounts monitored, and treat any unexpected urgency as a reason to slow down rather than speed up. A few minutes of caution before you leave is a lot cheaper than months spent untangling identity theft after you get home.
Related Articles:
by Brian Thompson | Apr 22, 2026 | Breach, Identity Theft, Scams
Last Updated: April 2026 | Reading time: ~10 minutes
You already know not to click suspicious links in email. Smishing attacks, however, phishing delivered by text message, now account for 35% of all phishing attempts and grew 40% year-over-year in 2025. (SentinelOne 2026; Keepnet 2025)
Email spam filters have gotten sharper, but your text inbox is wide open. Text messages carry a 98% delivery rate, and smishing click-through rates reach as high as 36%, nearly three times the average for email phishing. (Keepnet Labs 2026)
This guide explains exactly how smishing works in 2026, what the newest attack types look like, how to spot one before you click, and what your business should do about it.
Table of Contents
- What Is Smishing?
- Why Smishing Works So Well
- Smishing by the Numbers (2025-2026)
- The Most Common Types of Smishing Attacks
- How AI Is Making Smishing More Dangerous
- Real-World Smishing: The Toll Scam Surge
- How to Recognize a Smishing Text
- How to Protect Yourself and Your Employees
- How to Report a Smishing Attempt
- Frequently Asked Questions
What Is Smishing?
Smishing, short for SMS phishing, is a cyberattack delivered by text message. Rather than targeting your email inbox, criminals send fraudulent texts designed to trick you into clicking a malicious link, revealing personal information, downloading malware, or authorizing a fraudulent payment.
The word combines “SMS” (the protocol that powers text messaging) and “phishing” (the practice of baiting victims into handing over sensitive data). At its core, it uses the same manipulation as email phishing, just on a channel where most people’s guard is lower and spam filters are weaker.
Most smishing messages impersonate someone you trust: your bank, the IRS, a package carrier, your employer, or a government agency. Attackers create urgency, then give you one easy action to take, usually a link to click or a number to call.
Why Smishing Works So Well
Smishing exploits a simple psychological truth: most people trust text messages more than email. When a text arrives from what looks like your bank or your delivery carrier, the instinct is to treat it as legitimate and respond quickly.
Three structural advantages make smishing especially effective:
- No spam filters. Email providers run billions of messages through threat detection algorithms daily. Your SMS inbox has almost none of that protection, so messages land directly and unfiltered.
- Small screens hide red flags. On a mobile screen, URLs get truncated. A link to
bankofamerica-secure-login.xin may appear as nothing more than a short string, and the visual cues that tip people off on desktops become invisible on phones. According to Zimperium’s 2024 research, 83% of phishing websites are now designed specifically for mobile screens.
- The channel feels personal. Email inboxes are crowded with marketing and spam. A text from a recognizable sender name, whether your bank, your employer’s payroll provider, or the IRS, arrives in a space normally reserved for people you actually know. That familiarity compresses the time between reading and acting.
Only 36% of Americans can correctly define what smishing is, according to Proofpoint data. Nearly two out of three people don’t know the threat exists by name, let alone know how to identify it.
Smishing by the Numbers (2025-2026)
| Statistic |
Source |
| Smishing accounts for 35% of all phishing attacks |
SentinelOne, 2026 |
| SMS-originated scams grew 40% from 2024 to 2025 |
Barclays / Keepnet, 2025 |
| 19% of breaches now originate from smishing or vishing combined |
Verizon DBIR, 2025 |
| Smishing click-through rates reach up to 36% |
Keepnet Labs, 2026 |
| Americans lost $470 million to text scams in 2024, a fivefold increase from 2020 |
FTC, 2025 |
| FBI IC3 received 59,271 toll-related smishing complaints in 2024 alone |
FBI IC3, 2025 |
| 83% of phishing websites are now designed for mobile screens |
Zimperium, 2024 |
| Smishing attacks grew to 39% of mobile threats in 2026 |
Keepnet, 2026 |
| Average financial loss per smishing victim: ~$800 |
Keepnet / industry average |
The trajectory is clear. Smishing is no longer a niche threat. It’s a primary attack vector growing faster than most organizations’ defenses can keep pace with.
The Most Common Types of Smishing Attacks
1. Credential-Stealing Texts
A message arrives claiming your bank account is locked, your PayPal password needs resetting, or your employer’s HR portal requires immediate verification. The link leads to a fake login page that looks nearly identical to the real thing. Once you enter your credentials, attackers capture them instantly, often in real time, with automated tools that relay stolen information to a live operator.
Workplace accounts are frequent targets. A smishing message disguised as an IT security alert or payroll notification can hand an attacker access to company systems before anyone realizes what happened.
2. Delivery and Package Notification Scams
One of the most persistent smishing formats involves a text claiming USPS, FedEx, or UPS has a package requiring your attention. You’re asked to “confirm your address” or “pay a small customs fee,” and the link harvests your payment details and personal information. These scams are especially effective because most people have packages in transit at any given time.
3. Toll and Government Agency Impersonation
Since late 2024, a Chinese cybercriminal network known as the “Smishing Triad” has executed one of the largest organized smishing campaigns ever documented, impersonating E-ZPass, SunPass, FasTrak, and state DMVs across at least eight states. More detail on this is in the section below.
4. MFA Bypass Attacks
Multi-factor authentication was supposed to stop credential theft. Attackers adapted. In a real-time relay attack, a criminal logs in to a target account using stolen credentials and simultaneously triggers an MFA code sent to the victim’s phone. A smishing message then asks the victim to “confirm” the code, and they enter it without realizing they’ve just handed over the final key. According to Proofpoint, at least 55% of suspected smishing messages contain malicious URLs, many designed for exactly this purpose.
5. “Call-Back” Smishing
Rather than a link, some messages contain only a phone number. The person who answers is a trained social engineer who references real details about your bank, a recent transaction, or your employer to build trust before requesting sensitive information. Because no link is involved, many people don’t recognize this format as a smishing attack at all.
6. Fake Job Offer and HR Texts
Texts impersonating HR departments, payroll providers, or recruiters are increasingly common, particularly targeting employees who’ve recently changed jobs or are listed on professional networking sites. Attackers use these messages to request direct deposit information, Social Security numbers, or benefit enrollment data.
How AI Is Making Smishing More Dangerous
For years, smishing was relatively easy to spot: awkward phrasing, generic lures, obvious typos. Generative AI has erased most of those tells.
Attackers now use AI tools to accomplish four things they couldn’t do effectively before:
- Personalize at scale. Public data, including LinkedIn profiles, company websites, and data breach databases, is fed into AI systems that generate customized messages referencing your employer, your role, your name, and even recent company news. A text reading “Hi [Name], this is [Company] payroll. We need you to verify your direct deposit account before Friday’s run” is far harder to dismiss than a generic lure.
- Remove linguistic red flags. AI-generated smishing messages are grammatically clean, contextually accurate, and tonally appropriate. The old advice of “look for bad grammar” no longer applies reliably.
- Automate RCS and iMessage delivery. RCS (Rich Communication Services) is replacing SMS as the standard protocol for Android messaging, and Chinese smishing operations have already integrated RCS into their delivery infrastructure. RCS messages can include sender branding, images, and interactive buttons, making fake bank or employer notifications significantly more convincing.
- Combine smishing with vishing. AI voice cloning tools can replicate a person’s voice from just three seconds of audio. Coordinated campaigns now use a smishing text to prime the victim, then follow up with a spoofed voice call from a “known” person, a manager or bank representative, to deliver the actual ask. Vishing surged 442% between the first and second half of 2024 (CrowdStrike, 2025).
Commercial anti-smishing tools blocked only 25-35% of threats in 2025. AI-powered detection solutions reached 96.2% rates, a gap that shows how far ahead attackers currently sit. (Keepnet, 2026)
Real-World Smishing: The Toll Scam Surge
Starting in late 2024, the FBI, FTC, and state cybersecurity agencies began issuing warnings about an unprecedented wave of smishing attacks impersonating U.S. toll collection agencies. By the end of 2024, the FBI’s Internet Crime Complaint Center had received 59,271 complaints tied specifically to toll-related smishing, and the FTC reported Americans lost $470 million to text scams that year overall, a fivefold increase from 2020.
The scam follows a consistent pattern. A text arrives claiming you have a small unpaid toll, often just $3 to $5, from E-ZPass, SunPass, FasTrak, or your state’s tolling authority. The message warns of escalating fines or license suspension if you don’t pay immediately, and the link leads to a convincing fake payment page that collects your name, address, and payment card information.
The operation behind these texts, tracked by researchers as the “Smishing Triad,” registered over 60,000 fraudulent domain names, many ending in “.xin,” and has been linked to phishing kits marketed under names like “Lighthouse” and “Darcula.” Sold on criminal forums and Telegram channels, these kits enable even low-skill attackers to run large-scale campaigns. Confirmed targets include residents of Washington, Florida, Pennsylvania, Virginia, Texas, Ohio, Illinois, and Kansas, among others.
This is not a fringe operation. It’s a professional criminal supply chain targeting everyday text messages to millions of Americans at once.
Key takeaway for employees and employers: Government agencies, toll operators, courts, and law enforcement do not collect payments via text message. If you receive one of these texts, do not click. Report it and delete it.
How to Recognize a Smishing Text
Run through these five questions before responding to any unexpected text:
1. Did I initiate this?
Legitimate authentication codes, delivery updates, and account alerts are triggered by something you did first, such as logging in, placing an order, or requesting a password reset. Any text that arrives without a preceding action on your part deserves skepticism.
2. Is there urgency or a threat?
Attackers manufacture pressure: “Your account will be closed,” “Final notice,” “Respond within 24 hours.” Legitimate organizations rarely communicate via text when immediate action is required. Official apps, secure portals, and verified phone calls are the standard channels for urgent account matters.
3. Does the link match the sender?
Before clicking, press and hold the link (don’t tap) to preview the destination URL. A message claiming to be from your bank that links to secure-update-bankofamerica.xin or any unrecognized domain is a smishing attempt. Even plausible-looking URLs can be spoofed, so when in doubt, go directly to the official website by typing it yourself.
4. Is it asking for information the sender should already have?
Your bank already has your account number. Employers already has your direct deposit details. Your delivery carrier already has your address. Any text requesting information the sender should already possess is a red flag worth taking seriously.
5. Does it ask you to reply to make a link clickable?
Some smishing campaigns instruct victims to reply with “YES” or “STOP” to activate a link. This bypasses Apple’s iMessage link-blocking feature. Never reply to unknown senders, not even to opt out.
How to Protect Yourself and Your Employees
For Individuals
- Never click links in unexpected texts. Go directly to the official website or app instead.
- Avoid replying to unknown senders. Even a one-word reply confirms your number is active and increases future targeting.
- Verify independently. If a text claims to be from your bank, call the number on the back of your card, not any number provided in the message.
- Enable spam text filtering. Both iOS and Android offer built-in filters, and most carriers provide free blocking tools as well.
- Use phishing-resistant MFA. Hardware security keys or authenticator apps that don’t rely on SMS codes are significantly harder to bypass than one-time codes sent by text.
- Report suspicious texts. Forward smishing messages to 7726 (SPAM), a free service most carriers support, and file a complaint at reportfraud.ftc.gov or ic3.gov.
For Employers and HR Teams
- Train employees on smishing specifically, not just email phishing. Most security awareness programs overlook SMS as an attack channel, and that gap is increasingly costly.
- Run smishing simulations. Behavioral training using realistic fake texts outperforms lectures. Employees who’ve been tested respond better when a real attempt arrives.
- Establish a verification protocol for financial requests. Any text requesting a wire transfer, direct deposit change, or payroll action should require verbal confirmation through a known phone number, no exceptions.
- Audit which employees have work credentials tied to personal phone numbers. MFA codes sent to personal devices are a bypass risk if that device is compromised through a smishing attack.
- Offer identity theft protection as an employee benefit. When smishing succeeds, and sometimes it does even against trained employees, recovery speed matters. Employees with access to live restoration advocates can contain damage significantly faster than those navigating the process alone.
How to Report a Smishing Attempt
Reporting helps authorities track campaigns, take down fraudulent domains, and warn others. Here’s where to go:
- Forward the text to 7726 (SPAM), supported by most major U.S. carriers and free to use.
- File a complaint with the FTC at reportfraud.ftc.gov
- Report to the FBI’s IC3 at ic3.gov, particularly important for toll scams and financial fraud.
- Notify your mobile carrier directly if you’re receiving repeated attacks from the same number or domain.
- If you clicked a link or shared information, visit IdentityTheft.gov for step-by-step recovery guidance.
Frequently Asked Questions About Smishing
What is the difference between smishing and phishing?
Phishing is a broad term for social engineering attacks that trick victims into revealing sensitive information. Smishing is specifically phishing delivered via SMS or text message. Both rely on manipulation and deception, but smishing exploits the higher trust and weaker defenses associated with text messaging. Email phishing has the advantage of volume; smishing has the advantage of immediacy and a personal feel. The two are increasingly combined in coordinated multi-channel attacks.
Can smishing attacks install malware on my phone?
Yes. Some smishing messages contain links leading to sites designed to download malicious apps or exploit browser vulnerabilities. On Android devices in particular, attackers may direct victims to install APK files, which are apps from outside the official app store, that grant full access to contacts, messages, and stored credentials. iOS devices are harder to compromise through malware downloads, but smishing remains effective as a credential-harvesting and social engineering tool regardless of device type.
Why are smishing attacks increasing so fast?
Several factors are converging at once. AI tools lower the cost and effort of creating personalized, convincing messages. Phishing kits sold on criminal forums enable low-skill attackers to run large-scale campaigns. RCS and iMessage deliver richer, more believable messages than traditional SMS. On top of that, most people still don’t recognize smishing as a category of threat. The explosive growth of mobile-first communication combined with the relative weakness of carrier spam filtering has created conditions that are nearly ideal for attackers.
How do attackers get my phone number?
Smishing campaigns draw from multiple sources: data breaches that exposed phone numbers (major breaches in 2024 and 2025 collectively exposed hundreds of millions of records), scraped social media profiles, purchased marketing lists, randomly generated number ranges targeted by automated dialers, and numbers leaked through third-party apps. Your number can end up in an attacker’s database without you having done anything wrong.
What should I do if I already clicked a smishing link?
Act immediately. If you entered credentials, change your passwords on the affected account and any account sharing the same password, enable MFA if it wasn’t already active, and alert your bank or employer depending on what information was involved. If you entered payment card data, contact your card issuer to freeze the card and dispute any fraudulent charges. In both cases, run a security scan on your device, monitor your accounts closely for the next 30 days, and file a report at IdentityTheft.gov. If a workplace account or work-related credentials were involved, notify your IT or security team right away because time matters for containing a potential breach.
Do smishing attacks target businesses specifically?
Yes, and with increasing sophistication. Business-targeted smishing includes payroll redirect fraud, W-2 and HR data theft, wire transfer authorization scams impersonating executives, and credential theft targeting employees with access to company systems. Verizon’s 2025 Data Breach Investigations Report found that 19% of breaches now involve smishing or vishing as an entry vector. Small businesses face particular exposure because they’re less likely to have formal verification protocols for financial and credential requests.
Is there software that protects against smishing?
Yes, though no tool provides complete protection. Mobile threat defense (MTD) solutions can detect malicious links before they load. Carrier-level filtering blocks many known smishing domains, and email and communication security platforms increasingly include SMS monitoring for enterprise deployments. Commercial solutions achieved 25-35% blocking rates in 2025, while AI-powered tools reached 96.2%, but that still means a meaningful percentage of attacks get through. Technology reduces risk; awareness and verification habits are what actually eliminate it.
