Online scams are costing Americans more than ever before. A 2026 report from the Consumer Federation of America projects that Americans, across all generations, are losing an estimated $148.2 billion every year to online scams. That’s over $1,000 per household! The good news? Staying safe online doesn’t require a background in cybersecurity. A little healthy skepticism and a few consistent habits go a long way. Read on for common scams and simple habits that keep your identity, accounts, and retirement secure.

🖥️Common Scams

Some common scams according to the FBI include:

• Consumer Fraud: Fraudsters set up fake e-commerce sites or don’t deliver goods after payment.
• Identity Theft: A cybercriminal uses your private personal or financial information without your permission. Thieves do this to commit fraud, steal money, or break the law in your name.
• Ransomware Attacks: Malicious software that takes over your computer and asks for money to release your device or files.
• Spoofing: A fraudster sets up a very legitimate looking email, phone number, or website. They hope to trick you with a fake.
• Phishing: A successful spoofed email, phone number, or website lures you in to take the “bait” and share sensitive information.
• Tech Support Scams: Fraudsters pose as tech support representatives and claim that your computer has a virus or security issue. They ask for remote access to your device or request payment for their services.
• Dating and Romance Scams: Cybercriminals pretend to be someone they’re not on dating apps and websites, manipulating their victims into sending gifts or money.

🚩Habit 1: Watch for Red Flags

Scammers love to create a sense of urgency to prey upon their victim’s initial reactions. Think before you click! Hover over links before clicking to see where they lead and be cautious of unexpected attachments. When in doubt, skip the click and visit the company’s website directly. Watch out for these other situations:

• An unexpected call, text, or email says your account, Social Security number, or benefits are “in danger.”
  WHAT TO DO: Consider an identity theft prevention service to help monitor and secure your digital life while giving you peace of mind against scams.
• A pop-up tells you to call “Microsoft,” “Apple,” a bank, or a government agency about a virus.
  WHAT TO DO: Turn on automatic updates and use strong security software to ensure your devices are protected.
• Someone claims to be a grandchild, law enforcement officer, or Medicare representative and needs money immediately.
  WHAT TO DO: Take a deep breath and confirm if the person you are communicating with really is who they say they are. Verify the request yourself using official contact information.
• You’re asked to pay with gift cards or cryptocurrency.
  WHAT TO DO: Stop communication and report the scammer to the Federal Trade Commission or your local authorities. Legitimate payment requests would never include gift cards or cryptocurrency.

🌐Habit 2: Use Passwords that Protect You

Strong passwords are your first line of defense against hackers. Here are some tips for creating passwords that will give cybercriminals a run for their money:

• Go Long: Set up passwords that are at least 12-16 characters.
• Mix It Up: Beef up your password with uppercase letters, lowercase letters, numbers, and special characters (! @ # $ % ^ & *).
• Skip Personal Information: Hackers will try to use publicly available information, like social media, to guess your password.
• Try a Passphrase String together several words to create a memorable phrase. Example: F0rtyPandasP!cked@pples
• Be Unique: Use a different password for every account you own.
• Store Securely: Skip writing your passwords down. Can’t remember them all? Try a password manager to store your passwords securely.

🔒Habit 3: Add Extra Layers of Security

Use Multi-Factor Authentication (MFA)

Strong passwords are still susceptible to sophisticated hacking techniques. Double down on your security and set up multi-factor authentication (MFA) on any account where it is available. When you enable MFA, you must provide a combination of two or more methods of authentication to verify your identity. Popular forms of MFA might look like an email containing a one-time password or a text message with a code, but be on alert of potential spoofs. Your best bet? An authenticator app or biometric authentication (fingerprint or face scanning technology) are the safest, less-easily spoofed multifactor authentication options.

Sign up for ID.me

FPPA has implemented ID.me as a method to securely sign in to the Member Account Portal (MAP). ID.me is certified against federal standards and provides secure login and identity verification across a variety of government, healthcare, and other organizations. Your verified identity helps FPPA ensure that the person logging in to your account is really you and not someone pretending to be you. Visit FPPAco.org/id-me-faqs to learn more.

 

If you suspect you've been targeted by a scam, don't stay silent. Report it to the Federal Trade Commission at ReportFraud.FTC.gov, or file a complaint with the FBI's Internet Crime Complaint Center at IC3.gov.