Scams Have Gone Omnichannel: New Global Report Tracks Fraud Across Web, SMS, Social and Voice

Every year, scams drain more than $450 billion from consumers and economies worldwide. That is not “petty fraud.” That is roughly half the annual GDP of Switzerland or Poland disappearing into criminal infrastructure, mule accounts, fake investment platforms, malicious ads, call centers and messaging-app operations.

At this scale, scams are not an internet nuisance, but rather an underground economy with the financial weight of a developed nation, operating across borders, platforms and languages, with victims recruited through ads, social media feeds, SMS messages, WhatsApp conversations, websites and phone calls.

Key takeaways

• Scams have gone omnichannel: fraud now moves across web, SMS, social media, messaging apps, email and voice calls, often as coordinated campaigns.
• Social media is a major scam delivery channel: malicious ads and fake promotions now blend into feeds, reels, sponsored posts and platform-native content.
• Trust is the main attack surface: scammers abuse familiar brands, caller ID, business accounts, compromised profiles and messages from people victims already know.
• Financial scams dominate: investment fraud, banking phishing, crypto lures and fake support schemes remain among the most persistent and damaging scam categories.
• Consumers need cross-channel skepticism: “spot the bad email” is obsolete; people must verify links, calls, payment requests and account alerts independently.

Bitdefender’s Global Scam Intelligence Report 2026 looks at this problem from the front lines. The report is based on telemetry and analysis collected throughout 2025, including web threats, SMS campaigns, social media scam ads, WhatsApp conversations, voice-call activity, honeypot interactions and consumer-facing scam patterns.

The central finding is that scams have matured into a global business model. They now move across platforms, countries and communication channels with the efficiency of legitimate digital marketing campaigns. The product is “fraud” and the customer acquisition funnel is “everyone”.

Scams are now a global financial risk

The report notes that scams inflicted roughly $442 billion in consumer losses in 2025. Bitdefender’s 2025 Consumer Cybersecurity Survey of 7,000 people across seven countries also confirms that 1 in 7 consumers, or 14%, fell victim to a scam in the past year. The US had the highest reported victim rate at 17%, followed by the UK and Australia at 16% each.

That puts scams in a category of their own. Scams have moved away from cybercrime and became a consumer protection issue, a financial safety issue and, increasingly, a trust issue affecting the platforms and services people use every day.

Key findings from the report

Social media has overtaken email as a primary attack vector. Scams no longer wait to get clicked in inboxes. They appear in feeds, promoted posts and paid ads, often beside legitimate content, targeted for the right audience with the right keywords. The report shows how malicious ads exploit the credibility of major platforms and reach users in moments when they are not expecting danger.

Young people are now twice as likely to fall for scams as older generations. The report links this to the platforms where scammers concentrate their efforts. Younger users spend more time in social environments where malicious ads, fake promotions, gaming lures and account-takeover schemes circulate quickly.

Finance scams dominate across channels. Investment fraud, banking phishing and crypto-themed scams appear repeatedly across SMS, social ads, WhatsApp, voice calls and email. The lure changes, but the objective remains the same: move the victim toward a financial decision before skepticism catches up.

Scam operations behave like businesses. Call activity, campaign timing and seasonal patterns show structured operations, not random chaos. The report’s call telemetry shows activity patterns that mirror working schedules, including weekday peaks and lower activity on Sundays. Fraud has shifts, scripts, conversion targets and performance metrics. What once was petty crime is now a grim, but organized business.

Trust is the main vulnerability. Many of the most effective scams do not come from obvious strangers. They come through compromised accounts, recognizable brands, verified-looking business profiles, sponsored ads and messages from people victims already know. Scammers increasingly hijack context, not just credentials.

Geography shapes risk. The report shows clear regional variation. Germany shows unusually high SMS scam rates. Romania stands out for scam ad exposure. France shows strong delivery fraud patterns. These differences suggest scammers adapt their lures to local behavior while keeping the same operational backbone.

Web threats remain the delivery backbone

Between January and December 2025, Bitdefender scanned 2.8 trillion URLs across browsers, email clients and messaging apps. Phishing remains the dominant global scam category, accounting for roughly 24.5% of reported incidents. It is followed by financial and investment scams, fake shops and advertising scams, job scams, social media scams and delivery scams.

This matters because URL and web telemetry captures exposure, not just complaints. Many victims never report scams. Many attempts are blocked before a user clicks. A global sensor network helps show how scam infrastructure is built, distributed and reused across channels.

SMS still works because it feels personal

SMS remains a high-trust channel because messages land beside legitimate alerts from banks, delivery companies, employers and government services. According to the report, 5.16% of analyzed SMS traffic was associated with risky campaigns. In plain English, that is about 1 in 20 analyzed SMS messages showing traits consistent with scam infrastructure or coordinated fraud.

Finance scams dominate SMS activity, but delivery, government, healthcare, insurance, toll tax and prize scams remain persistent. The mix changes by region, which is exactly what mature scam operations do: they localize.

Social media scams are built for accidental exposure

Social media advertising scams are different because victims do not need to open a suspicious email or respond to a strange message. The scam comes to them as an ad.

The report found that scam interaction rates on social media reached 36% overall, with health, style and beauty, and entertainment scams outperforming other categories. This is not surprising. These categories exploit curiosity, aspiration and habit. People scroll quickly, ads blend into the feed and platform design reduces friction. Scammers know this, and they buy their way into the stream.

WhatsApp scams exploit proximity

WhatsApp scams are especially effective because they spread through social proximity. A message from a contact feels safer than a message from a stranger, even when the contact’s account has already been compromised.

The report highlights risky WhatsApp conversations, abuse of business accounts and scams that turn victims into distributors. In one common pattern, users are asked to vote in a fake contest and enter a verification code. That code is actually their WhatsApp authorization code. The victim loses the account, and the scam continues from a more trusted identity.

The report also found that a significant share of risky WhatsApp conversations originated from business accounts, which can display brand names, logos, descriptions, catalogs and sometimes verification indicators. To a scammer, that is not branding. It is camouflage.

Voice scams are call centers with criminal intent

Voice remains one of the most persuasive scam channels because attackers can react in real time. They can apply pressure, answer objections, create urgency and keep a victim engaged long enough to extract money or information.

In 2025, Bitdefender analyzed nearly 150 million incoming calls to understand how fraud sounds like on the phone. More than 23 million were classified as unwanted, meaning roughly 1 in 6 incoming calls reaching protected devices was unwanted. The system processed calls from more than 52 million unique phone numbers, with more than half a million identified as unwanted numbers.

The key point is no longer just about volume, but also about diversity. Scammers rotate numbers, spoof identities and use structured workflows that resemble legitimate outbound sales or support operations. Scripts, escalation paths, human operators, KPIs - the whole depressing office starter pack has now moved to cyber-criminal operations with yields dramatically dwarfing legitimate businesses.

What consumers should take away

The report’s prevention advice comes down to a few hard rules:

• Do not treat urgency as evidence of legitimacy. Real companies and institutions do not need you to make instant decisions under threat. Never share passwords, one-time codes, PINs or recovery phrases. Do not pay “fees” through gift cards, crypto or wire transfers. Verify requests through a second channel, using official contact information rather than numbers or links provided in the message.
• Do not trust caller ID. Do not assume a sponsored post is safe. Do not assume a verified-looking badge makes an account legitimate. Check domains carefully before entering credentials, use multi-factor authentication, keep devices updated and use security tools that block malicious links and scam domains before a bad decision is even on the table.
• Most importantly, talk about scams with family members. Scams spread through trust, but so does awareness.

Read the full report

The Global Scam Intelligence Report 2026 gives a broader view of how scams evolved in 2025 across web, SMS, social media, WhatsApp and voice calls. It shows how fraudsters adapt to platforms, countries, seasons and news cycles, and why defending against scams now requires more than telling people to “be careful.”

Careful is useful, but visibility and early heads-up warnings are better.