Ransomware and data breaches get all the airtime. Everybody flinches at those words, even folks who couldn’t tell you what a firewall does. The quieter stuff gets ignored. Honestly, that’s where a lot of the damage happens. Maybe you think you’re too savvy to get caught. Maybe the scam you remember from a few years back has changed more than you realize.
Tech keeps moving, and how much can change in a year tends to catch even careful people off guard.
Five threats deserve a closer look. Here’s what each one does and what actually helps.
How Does AI-Powered Phishing Work?
The old giveaways are mostly dead. You used to spot a scam email by the mangled grammar or the stranger with a fortune to hand over. Now anyone with ChatGPT can produce a believable message in about ten seconds, and the more details about you float around online, the easier it gets to aim that message right at you. Your employer, your bank, the gym you tagged in a photo last spring. It all feeds the draft.
The click rates tell the story. Brightside AI’s research, covered in reporting on AI-written phishing emails, found that 54% of AI-generated phishing emails got clicked, against 12% for standard ones.
So don’t judge an email by how well it’s written. Judge it by what it wants. Pressure to act fast is the tell. So is a reward that sounds too good to be true. Before clicking, make sure the link actually points to the sender’s real site. A password manager does this for you, since it simply refuses to fill in your login on a lookalike page. If the subscription price stings, NordPass discount codes are worth a look.
What Is Quishing, and Why Is It Spreading?
Scanning a QR code feels harmless. Menus, parking meters, flyers, delivery slips: you point, you tap, you move on. Even people who’d never click an email link will scan one of these without thinking. Spam filters struggle with them too, because the dodgy URL hides inside an image instead of sitting in the message text.
It’s growing quickly. Keepnet Labs found QR codes in 12% of phishing attacks in 2025, up from under 1% in 2021. Researchers tracked QR phishing emails climbing from 46,000 in August 2025 to nearly 250,000 by November. In the UK, Action Fraud logged 1,386 quishing reports in 2024, compared with 100 in 2019, and some of those involved criminals sticking fake codes over real ones on parking meters.
A bad scan can send you to a fake login page, drop malware on your phone, or walk you through a “payment” that hands over your card number.
Two habits cover most of the risk:
- Skip any code you find lying around unless you know who put it there.
- Preview the web address your phone shows before you open it, the way you’d treat any odd link.
Is Public Wi-Fi Still Dangerous?
Less than it was, but the story didn’t end there. HTTPS is standard now, so grabbing a password off a café network is far harder than it used to be. Attackers adapted instead of quitting. With session hijacking, they steal the login session itself while you’re signed in on a weak network, and then they walk right in without ever needing your password. You won’t notice a thing.
Modern work makes this worse. Consider how developers jump between environments all day, from home Wi-Fi to a coffee shop to an airport lounge. Plenty of us live that way now. Each new network is another place for someone to listen in.
A VPN on public Wi-Fi is the obvious fix, because it encrypts your traffic and leaves little to grab. I’d add one habit on top: log out of your important accounts and back in every so often. That refreshes your cookies and session data, so an attacker sitting on an old copy gets locked out.
What Is MFA Fatigue?
Multi-factor authentication is still one of the best moves you can make for an account. It has one soft spot, though, and that spot is you.
Picture an attacker who already has your password. They try to log in, and your phone buzzes with an approval request. They keep trying. Over and over, often at 2 a.m., when you’re half asleep and just want the noise to stop. Eventually somebody taps “approve.”
That’s roughly how Uber got breached in September 2022. An attacker flooded a contractor with push requests for hours, then messaged them on WhatsApp pretending to be IT support and telling them to accept one. The contractor did. The attacker was inside Uber’s network. Microsoft made the number match the default in Microsoft Authenticator in May 2023, in response to attacks like this.
Real IT teams don’t ask you to approve a prompt to make it stop, so treat any request you didn’t start as hostile and deny it. If your app only offers “allow” or “deny,” switch to code-based verification or number matching.
How Do Deepfake Scams Work?
Voices are the scariest part. McAfee’s research found that three seconds of audio can produce a voice match of roughly 85%, and three seconds is a voicemail greeting or a clip from someone’s social feed. Video fakes have improved just as fast, to the point where trusting your own eyes and ears doesn’t cut it anymore.
AI-powered scams in 2026 lean on this, and the sums are big. The Italian firm Fideuram sent out €95 million after fraudsters impersonated executives over WhatsApp with an AI-cloned voice. Investigators clawed back about €55 million. The other €39.5 million is gone.
Companies are targets, and many leaders assume security budgets are already adequate. Fideuram suggests a bigger budget alone won’t stop a convincing voice on the phone. Everyday people get hit too, especially anxious parents and older relatives, because a panicked voice on the line shuts down careful thinking fast.
If the caller pushes hard for money, hang up. Call back on a number you already have. Then pick a safeword with your family now, something only the real person would know. Two minutes of awkward conversation beats losing your savings.
How Can You Stay Safe From Cybercrime?
Plenty of people fall for these scams. Most of them thought it couldn’t happen to them. That’s sort of the whole point. Nobody expects to be the one until they are.
The fixes are small and a little boring: pause before clicking, use a code instead of a tap, call back on a number you trust. Many of the work precisely because they hide inside moments like scanning a menu or glancing at a late-night notification. You don’t have to live in fear. A bit of suspicion goes a long way, even when the risks feel uncomfortably close to home.
Related: How Can Generative AI Be Used in Cybersecurity? AI vs AI Threats Explained (2026)
