At a time when smartphones serve as digital wallets, online storefronts, life organizers and social networks, it’s no wonder fraudsters are focusing their efforts on mobile-based scams.

Bad actors increasingly use social engineering tactics to exploit human behavior, tricking victims into unwittingly revealing personal information or providing access to sensitive data. Unfortunately, today’s easy access to sophisticated AI tools and advanced manipulation techniques means no one is immune to these types of attacks.

Today, fraudsters are blending old tricks with new tech to bypass security features and exploit human behavior. Here’s what you need to know about the latest mobile scams — and how to outsmart them.

“Always on” means always at risk

Americans spend an average of 5 hours and 16 minutes on their mobile devices every day. As they become the central hub for everything from banking and healthcare to package tracking and social media, scammers recognize mobile phones are a gateway to consumers’ digital lives.

With more sensitive transactions taking place via apps, texts and calls — and with data from past breaches fueling highly personalized attacks — mobile users are on the front lines of fraud. The reasons they’re especially vulnerable include:

• Always-on behavior. Many mobile users check their phones frequently, often while distracted. This can make them more likely to impulsively click or respond.
• Credential reuse. A great number of consumers still recycle passwords across accounts. Once one set is breached, attackers can test it elsewhere.
• Blurred work-life lines. Remote and hybrid work has made personal devices a key part of professional life and vice versa, creating even more access points for scammers.
• SIM swaps and account takeovers. With enough information, fraudsters can hijack a phone number to intercept calls, texts and multifactor authentication codes.

Scams to watch in 2025

Mobile users are increasingly targeted by more convincing scams or techniques that are easy to fall for. Some examples of effective scams now making the rounds include:

 The “Say Yes” scam.

This voice phishing (vishing) scam often starts with just a simple question: “Can you hear me?” It may seem innocent, but the fraudster’s goal is to record you saying “yes” in response. Once in their possession, it can potentially be used to authorize fraudulent transactions or misrepresent your consent in automated systems.

Wrong-number texts.

This scam starts with a casual message that appears to be intended for someone else. You may see no harm in responding — even just to alert them to the wrong number — but your engagement is part of the plan. A scammer might simply be attempting to validate the phone number or seeking a person willing to engage so you can be targeted in the future. Or, they may be hoping to extract even a small amount of personal information that can be exploited for financial gain, as TransUnion Director of Global Incident Response Eder Ribeiro explained in a CNBC interview.

 Fake delivery texts.

These “smishing” scams — a phishing-style scam sent over SMS text messaging — might claim a package couldn’t be delivered or ask you to confirm a shipment. The message may contain links that look like legitimate carriers, but beware, it leads to phishing sites designed to steal your personal information or payment details.

Malicious QR codes.

QR codes have become a commonplace shortcut for accessing things like menus, apps and events. Scammers are placing their own malicious QR codes in high-traffic public spaces or within phishing emails, hoping someone scans it. These QR codes link to fraudulent login pages or install malware that tracks your keystrokes and passwords, enabling the scammer to steal credentials or personal information.

Government imposter scams. In these calls, scammers claim to represent trusted institutions like the IRS, Social Security Administration or local law enforcement. The caller may threaten legal action, demand payment or claim you’re due a refund that requires immediate identity verification.

Protecting against mobile scams

No one can prevent every scam attempt, but you can help reduce your risk of falling victim to them by staying informed and taking the right precautions. Follow the steps below to help keep yourself safe:

• Treat unexpected calls or texts with skepticism. If you receive an unsolicited message — even it accurately references your name, account or recent activity — don’t share personal details or click on links. Instead, call back using a verified number you retrieve from the company’s official website.
• Stay silent if you aren’t sure. If an unknown call starts with a question or vague prompt, stay silent or hang up. If you’re unsure whether the call is legitimate, hang up and contact the company directly using a verified number. If you suspect your voice response may have been recorded, monitor your credit and financial outlets for strange activity.
• Regularly monitor your credit and identity activity. Monitoring tools track the activity across your credit file, financial accounts and other personal information, alerting you if your data has been exposed in a breach, is being traded on the dark web or potentially misused. These notifications provide an early warning so you can act quickly to mitigate potential risks.
• Activate multi-factor authentication (MFA). MFA is an important tool for identity verification, adding an extra step for authentication. Whenever possible, it’s recommended to use app-based authenticators or hardware tokens rather than SMS text messages. In recent years, fraudsters have shown the capability to intercept SMS codes if they gain access to your phone via SIM swap or malware.
• Know what information has already been compromised. Identifying what information has been exposed in past data breaches can help you understand how you might be targeted by scammers in the future. Technology is advancing identity protection tools to assess breach exposure and recommend the most beneficial protective actions.
• Have experienced support ready when you need it. If your identity is stolen or misused after a mobile scam, fraud resolution services can save a lot of time and stress. Specialists can help identity theft victims navigate their way through recovery steps and resolve lingering issues.

Hacking your mobile device is difficult. Meanwhile, cybercriminals prefer to take the path of least resistance. Since social engineering attacks involve psychological manipulation of individuals, its is much easier than breaking modern cybersecurity defenses. Your best defense is to stay alert and aware of scams, and learn to recognize when people are trying to manipulate you. Combine that with proactive measures, and you’re well on your way to staying a step ahead of mobile scammers.