Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsiTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
About nine in 10 Americans have encountered at least one digital scam or cyberattack, according to a 2026 Consumer Reports survey conducted with Aspen Digital and the Global Cyber Alliance. The finding measures exposure or targeting—not confirmed financial loss—and the published article does not provide the survey’s sample size, field dates, weighting, or full methodology.
Consumer Reports also found a sharp drop in confidence that sensitive personal data is protected. Artificial intelligence did not cause the survey’s victimization rate, but experts say it is making familiar fraud tactics faster, cheaper, more personalized, and easier to run at scale.
What the Consumer Reports survey found
The headline result is broad exposure: nine in 10 Americans said they had faced at least one digital scam or cyberattack. “Faced” can include an attempted phishing message, fraudulent call, malicious link, account attack, or another form of targeting; it should not be read as nine in 10 people losing money or having an account breached.
Consumer Reports CEO Phil Radford described the result as “almost everyone we serve” and said that “AI is making fraud faster, cheaper and more personal, and no one can outsmart that alone.” The available published account does not state how many people were surveyed or explain the survey’s sampling and weighting, so the percentage should be treated as the organization’s reported 2026 estimate rather than a precisely reproducible population count.
#1 Best Overall
Confidence in personal-data privacy fell
The same annual Consumer Reports survey found that 29% of U.S. adults were not at all confident that sensitive personal data was protected in 2026, up from 16% in 2025. Only 32% said they were confident in the privacy of sensitive data, down from 48% the previous year. Those figures describe perceptions, not a technical audit of every respondent’s accounts or devices.
How AI changes scams
AI is best understood as an amplifier of existing scams rather than a wholly new category of attack. Scammers can use generative tools to draft convincing messages, translate them, imitate a company’s tone, and tailor a request to information about a particular person. Automation also lets one operator produce and send far more attempts.
Consumer Reports policy fellow Stacey Higginbotham said AI will make it easier to create personalized scams at scale and reduce the effort needed to craft and send them. A polished message therefore proves less than it once did: correct spelling, familiar phrasing, a realistic voice, or a plausible logo are no guarantee that a request is genuine.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →What the evidence does—and does not—show
The survey establishes widespread targeting and declining privacy confidence. It does not establish that AI caused the nine-in-10 exposure rate, nor does it quantify how many reported incidents used generative AI. The sensible conclusion is narrower: AI lowers the cost and increases the potential scale and personalization of fraud methods that already existed.
How worried should you be?
Assume that unsolicited digital contact may be hostile, but do not treat every message as proof that your identity has been stolen. Risk is highest when a message combines urgency, secrecy, an unexpected payment or login request, a demand for a verification code, or a link to a site you did not open independently.
Older adults face a particularly serious financial impact. The FBI’s 2026 Internet Crime Report summary says Americans reported nearly $21 billion in losses through cyber-enabled crimes and filed 1,008,597 complaints. People over 60 reported approximately $7.7 billion in losses. These are reported complaints and losses, not a count of everyone targeted, so they cannot be directly compared with the Consumer Reports exposure percentage.
Protection steps that provide the most leverage
-
Use a different strong password for every important account
Reused passwords let a criminal who obtains one credential try it on email, banking, shopping, and social accounts. Use long, unique passwords or passphrases for each service. A password manager can generate and store them so you do not have to memorize every value.
Recommended Free Tools
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Turn on multifactor authentication
Enable multifactor authentication (MFA) for email first, then financial, cloud-storage, social-media, and shopping accounts. An authenticator app or security key generally provides stronger protection than text messages, but any available second factor is safer than a password alone. Never give a caller or texter a one-time verification code.
-
Leave automatic software updates enabled
Install operating-system, browser, app, and router updates promptly. Automatic updates reduce the time that known security flaws remain exploitable, especially on devices people rarely check manually.
-
Verify before clicking, paying, or replying
Consumer Reports said 69% of respondents reported checking texts and emails before clicking. Do the same with messages that appear to come from a bank, delivery company, employer, relative, or government agency. Open the official app or type the known website address yourself; do not use the message’s link or phone number.
-
Slow down high-pressure requests
Ask the person to explain the request through a separate, trusted channel. For a supposed family emergency, call a known number. For a workplace payment change, confirm with a colleague using the organization’s directory. A request that cannot survive an independent check should be treated as fraudulent.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Protect recovery paths
Secure the email account and phone number used to reset other accounts. Review recovery addresses, authentication devices, forwarding rules, and logged-in sessions. Remove anything you do not recognize and update recovery information when it changes.
What people are already doing—and where the gaps are
| Reported behavior | Share in the 2026 Consumer Reports survey | Why it matters |
|---|---|---|
| Checking texts and emails before clicking | 69% | Separates verification from an attacker-controlled link or attachment. |
| Using multifactor authentication | 60% | Adds a second authentication requirement if a password is exposed. |
| Enabling automatic software updates | 48% | Shortens the window in which known vulnerabilities can be exploited. |
These are self-reported behaviors, not proof that each person configured them correctly or used them consistently. The gap between the three figures also shows why a layered approach matters: no single habit addresses phishing, stolen credentials, unpatched devices, and account recovery abuse at the same time.
If you may have responded to a scam
- Clicked a link but entered nothing: close the page, update the device and browser, and watch the account or service the message impersonated.
- Entered a password: change it immediately from the real service, change it anywhere it was reused, and sign out other sessions.
- Shared a verification code: contact the account provider through its official channel, reset authentication, and review recent sign-ins and recovery settings.
- Sent money or financial details: contact the bank, card issuer, payment service, or wire provider immediately and ask what reversal or fraud procedures are available. Preserve messages, phone numbers, receipts, and transaction records.
- Installed unfamiliar software or granted remote access: disconnect the device from the network, remove the software or seek qualified technical help, and change passwords from a separate trusted device.
The practical bottom line
Being targeted is now close to normal online; successful compromise is not inevitable. Treat unexpected contact as untrusted until independently verified, use unique passwords and MFA, keep software updated automatically, and protect the email and phone accounts that control password recovery. AI raises the volume and plausibility of attacks, which makes disciplined verification more valuable—not less.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →
