A caller offers you a free phone upgrade or an exclusive deal from your mobile provider. A new phone arrives at your home. So far, everything seems to check out.

Then comes another call: There’s been a shipping mistake. You received the wrong phone, and the company needs you to send it back. You send it back, but the phone never reaches your provider, leaving you with a large charge or long-term contract to pay.

Now police are warning about this scheme after residents lost devices and were left facing the associated payments.

How phone return scams work

The scam usually starts with a call from a spoofed number. In the US we’re seeing several examples in anonymized Malwarebytes Scam Guard records of the impersonated company being Canadian mobile provider Rogers.

The Canadian Anti-Fraud Centre warns:

“After collecting personal information required for credit checks, they’ll order a new phone in your name.”

Next, a genuine device arrives through a legitimate delivery service. That delivery makes the next part of the story easier to believe.

The caller gets back in touch and claims something went wrong. Perhaps the company sent the wrong device, or an extra phone arrived by mistake. To put things right, you need to send it back using the label or shipping QR code they provide.

The shipping label is the real trick. Rather than directing the package to the provider’s returns facility, it sends the device to an address chosen by the criminals.

The result: You no longer have the phone, but your provider has not received it back. Victims can be left facing a contract, financing agreement, or monthly payments for the missing device.

How to stay safe

The most important protection against most types of scams is having someone you can trust and help you decide whether something is a scam. Malwarebytes Scam Guard can be that partner if you’re on your own.

You don’t need to decide on the spot about whether a caller sounds convincing. Break the conversation and verify the offer separately. Pause and check if you encounter any of the following:

• An unexpected call offering a free phone, loyalty reward, or unusually attractive upgrade.
• A caller asking for personal, financial, or account information to arrange the offer.
• A follow-up call claiming the wrong device was shipped or that another delivery mistake needs correcting.
• Instructions to use a return label or QR code supplied by that caller.
• A return destination that you have not confirmed directly with your provider.

If you’ve already sent a phone, contact your mobile provider immediately using verified contact details. Explain that you believe you were targeted by a phone return scam, identify the affected orders, and ask for a fraud investigation.

If you shared your account password or PIN, change it through the provider’s official channels. Rogers advises customers who disclosed their credentials to reset them and contact customer service to check for unauthorized transactions.

Keep the evidence: messages, emails, the shipping label, tracking details, order confirmations, bills, and a timeline of the calls. These records can help support a billing complaint and fraud report.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

When your pet goes missing, it can be totally heartbreaking.

So hearing that they’ve been found is no doubt very welcome news. Even better to see a photo of them looking safe and well.

But while the photo may look exactly like your pet, that doesn’t mean the person who sent it has your pet or even ever saw it.

The BBC reports how criminals are sending owners AI-generated images of their missing pets, demanding money for their return, and sometimes threatening to harm the animals when owners refuse to pay.

The BBC interviewed two targets of this scam who were both contacted after posting a missing pet message on social media. The scammers sent them pictures of their beloved pets and demanded a ransom for their safe return.

Messages like these exploit two powerful emotions in quick succession: relief that a beloved pet has been found, followed by fear that something terrible will happen unless the owner acts immediately.

The scam typically follows this pattern:

• A scammer finds a missing pet appeal, which is typically posted to social media or local sites with an accompanying photo and contact details.
• The scammer contacts the owner and claims to have found the animal. An image fabricated with the help of AI makes the claim appear more convincing.
• They ask for money which may be described as a reward or as payment for emergency treatment.
• They add pressure. They might refuse to meet until payment arrives, or threaten to sell or harm the pet.

Our data backs this report up. Over the last month, people anonymously submitted three distinctive types of pet related scam attempts to Malwarebytes Scam Guard:

• “We found your missing cat” message, with photos: Someone claimed to have found a user’s missing cat and had images of it.
• Found pet callback lure: A voicemail claimed to have found a lost cat and supplied a callback number.
• Humane Society impersonation and payment demand: A caller claimed a missing cat needed emergency surgery, and demanded successive Zelle payments.

How to stay safe

Sadly, while it can be very useful to use social media to retrieve lost pets, it also attracts scammers and other abuse.

You don’t have to stop asking for help online, but you can put some safeguards between an unexpected message and any payment.

• Keep some identifying details private. Leave a distinctive feature out of the public description so you can ask a supposed finder about it later.
• Do not pay in advance to secure a reunion. Be particularly wary of someone who insists that you send money before they will let you see the animal. Arrange any legitimate handover in a safe, public location, and verify that it is your pet before paying a reward.
• Verify veterinary claims independently. If someone says your pet is at an animal hospital, find the hospital’s contact details yourself and call it directly. Do not rely on the number or payment link in the message.
• A second pair of eyes can help you assess a demand without the same emotional pressure. Malwarebytes Scam Guard can help you identify whether a message might be a scam and how to proceed.
• If someone is threatening your pet, remember that when they make threats to your pet, it is very likely they don’t have a clue where it is either, so don’t let them extort you.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

A page we found promises a $750 Apple Cash reward if you complete a quick “device verification.” There is no reward, and the page does not verify your device. Instead, it sends you to app offers through affiliate tracking links.

The page is not affiliated with Apple. If you’ve landed on a page like this, close it.

Why Apple makes such good bait

Apple is one of the world’s most recognized brands, and scammers use that familiarity to make fake offers seem credible. Apple’s own scam guidance lists fake promotions offering free products and prizes among common tricks.

Current Apple news gives scammers useful cover. The new iPhone Duo is in the headlines, and we recently found a fake preorder page whose code tried to exploit older iPhones as soon as the page opened. With the iPhone Duo starting at $1,999, a promise of $750 in Apple money may catch people’s attention.

The word “verify” may also sound timely. Starting November 9, Green Dot Bank, which issues Apple Cash, will require some users to verify their identity before they can reload their balance. A fake page asking people to “verify your device” to get Apple Cash may seem more plausible in that context.

Apple Cash isn’t an Apple Gift Card

The page blurs two different things:

• Apple Cash is money you send, receive and spend through Apple Wallet.
• An Apple Gift Card adds money to your Apple Account balance for Apple purchases.

Apple warns that its gift cards can only be used for Apple purchases, and that someone asking you to pay them with one is probably a scammer. But neither Apple Cash nor an Apple Gift Card comes from a website that “unlocks” it after you install an app.

The fake site leans hard on Apple’s name. It calls the app it promotes an “Official Apple Partner” that is “Verified by Apple Cash,” and its footer claims “Copyright © 2026 Apple Inc.” None of that is true.

A “verification” that verifies nothing

We looked at the code behind the page’s three steps: Eligibility Check, Verify Device and Claim Reward.

The eligibility check is a timer. The four items that tick green, including “Location: United States,” are just labels that light up on a schedule. The page never checks where you are or what device you use. Everyone passes in under four seconds.

The device verification is an app install. The page tell users to download an app called Reco Social, then tells them to create an account, and install and play a game. We found no evidence that Reco Social or its developer created or operated the fake reward page.

When you tap Download & Open App, the page opens a link in a new tab. Five seconds later, it starts showing “Verifying device…”. Nothing is being verified. The page has no way of knowing whether you installed anything, created an account or played a game.

The reward is the same link again. Ten minutes after you tap the button, the page moves on by itself and announces “Device Verified Successfully,” whether or not you installed anything. The Claim Your $750 button doesn’t add anything to your wallet. It opens the same link as the download button.

Fake urgency

The page is built to stop you from thinking too long:

• “Only 47 spots left today” always starts at 47. It drops by one every 30 seconds and stops at 3, so it never runs out.
• The “claimed $750” pop-ups are generated at random from a list of 15 first names and 15 US states, with a random “minutes ago.” Every visitor sees a new one every 8 to 15 seconds.
• The 10-minute “Session Expires” countdown doesn’t end anything when it hits zero.

Who gets paid?

The download button doesn’t go directly to the App Store. It first goes through a tracking link on taprkr[.]com. These links can be used in affiliate marketing to credit clicks and installs to whoever sent the traffic.

The link carries a label, “recosocial-cpr.” CPR can stand for “cost per registration,” a deal where a promoter earns money when someone signs up. That label alone doesn’t confirm how this offer pays.

The destination varied in our tests. The link led to an offer labeled “playful-rewards-revshare” on iPhone and an ad network on PC. A revshare (revenue share) deal usually pays the promoter a cut of what users later spend, such as on in-app purchases.

The tracking labels suggest that promoters may earn money from registrations or spending in promoted apps, but they don’t confirm how this offer pays. Users don’t receive the promised $750.

We have no evidence that Reco Social or any app at the end of these links is behind the fake Apple page. Deceptive affiliate promoters can send traffic to legitimate apps because they may earn money for installs or signups regardless of how users were persuaded.

The page also loads a TikTok tracking pixel, which advertisers use to measure campaigns. This could mean the operators are measuring traffic from TikTok, but it doesn’t show where the link was shared.

What’s the harm if it’s “just” an app install?

Compared to a page that steals passwords or card numbers, this one can look harmless. But you still pay a price:

• You give away personal data. Creating an account means handing over your email address, phone number or social login to a service you only signed up for because of a lie.
• You may be encouraged to spend. Many mobile games make their money from in-app purchases, and with a revenue-share deal, someone profits when you spend.
• You may be set up for the next scam. Fake reward offers often come in chains. The next one may ask for your Apple Account details, card number, or a “small processing fee.”
• You lose time chasing a reward that was never coming.

How to stay safe

Keep these points in mind if you come across an Apple Cash or other Apple-related offer online:

• Don’t expect an app install to pay you in Apple Cash. Be suspicious of any “Apple” offer that asks you to download a third-party app, create an account or play a game to receive Apple Cash or an Apple Gift Card.
• Verify Apple Cash only in Settings. The real identity check is in Settings > Wallet & Apple Pay > Apple Cash. Treat any website or message that asks you to “verify” Apple Cash somewhere else as suspicious.
• Be extra careful around launches and holidays. iPhone Duo deals, giveaways and preorder offers will keep circulating. Go to apple.com or the Apple Store app yourself instead of following links.
• Check the address bar. Apple’s website is apple.com. A page on a domain like applecashgiftcard[.]com is not Apple, however much it looks like it.
• Treat countdowns and “spots left” as red flags. Fake urgency is there to rush you past the moment you’d ask, “Why would anyone give me $750 for this?”
• Already installed an app from a page like this? You didn’t earn a reward, so you can delete the app. Delete any account you created through it, cancel any subscriptions in your App Store settings, and change that password on any other accounts where you reused it.
• Never pay with gift cards, and never pay to receive a prize. As the FTC puts it, “No real business or government agency will ever tell you to buy a gift card to pay them.” If a “reward” asks for a fee, your card details or gift card codes, it’s a scam.
• Report it. Apple asks people to forward suspicious Apple-themed messages to reportphishing@apple.com. You can also report the ad or post to the platform where you saw it and, in the US, report fraud at ReportFraud.ftc.gov.

How Malwarebytes helps

Malwarebytes can help block known scam pages. Use Browser Guard with a supported browser, or Web Protection in Malwarebytes for iOS when browsing with Safari.

If you’re not sure whether a link, text or offer is real, you can ask Malwarebytes Scam Guard before you click.

“One of the best cybersecurity suites on the planet.” 

According to CNET. Read their review →

Recently, our team exposed sophisticated scam kits designed to steal sensitive data and trick consumers. But underground marketplaces are not just for malware and stolen passwords. They also offer services designed to manipulate your opinion of the products and services you buy every day.

In our latest research, we examined cybercrime forums where sellers advertise illicit “reputation management” services. For the right price, these underground operators offer to flood a product with glowing, five-star ratings or remove negative reviews. This shadowy industry works both ways—artificially boosting reputations and deliberately hiding legitimate complaints.

A major shift we are seeing in this space is the adoption of new technology. We also found that cybercriminals are using AI to automate these fake review campaigns. This could allow them to quickly generate realistic, human-sounding feedback in large volumes without much manual effort.

5 stars as a service

In the first example, discovered on a major English-language underground forum, a seller operating under the handle “aqenova” advertises both five-star review generation and negative review removal services. 

The seller’s operations span widely used platforms, including Google, Trustpilot, Yelp, and various mobile app stores. By simply asking prospective buyers, “Just tell me which platform reviews you need?” the seller presents reputation manipulation as something buyers can just order on demand.

Decoding the seller’s FAQ 

Analyzing another seller’s (TrustForge) “Frequently Asked Questions” section revealed some surprising details about how these operations reportedly run behind the scenes. 

First, the seller emphasizes that real people manually post these reviews, offering a guarantee for both successful delivery and “non-drop”—meaning the platform won’t flag and remove the feedback later. 

Remember, a real person posting a review doesn’t mean they’re a real customer. The important question is whether they actually used the product or service and are describing an honest experience.

Second, it appears this is a well-coordinated team effort rather than a solo operation, as the seller charges an extra fee if a buyer wants the main operator to write the review text personally. 

However, what caught our attention most was their confidence in beating platform checks. The seller guarantees their fake reviews will stay active, claiming they rely on a closely guarded “private method.” According to TrustForge’s own statements, this method has allowed them to post more than 10,000 fake reviews.

The clean-up crew: Making bad reviews disappear

A single negative review is often all it takes to create a bad first impression of a product or service. When those negative comments start to pile up, they can completely ruin a business’s reputation and bottom line.

Recognizing how desperate businesses can be to protect their image, our research team discovered underground services specifically offering to remove “fake” or “unfair” reviews from major platforms like Google and Trustpilot. 

Of course, the boundary between what is genuinely fake and what a business simply considers “unfair” can be blurry. Businesses can legitimately challenge fabricated reviews, but these services raise concerns about whether genuine customer complaints could also be targeted.

If legitimate customer complaints disappear, consumers lose information that could help them decide where to spend their money. 

On average, having a single review removed through these underground services costs between $100 and $200. However, the pricing jumps dramatically depending on the platform.

For instance, one seller advertised Airbnb review removal for around $1,100 per review.

When you check a business’s reviews, you’re looking for patterns in other customers’ experiences. If genuine complaints disappear, you could miss repeated problems with refunds, product quality, or customer service.

Artificial intelligence, artificial reviews

During the last few months, our research team spotted an interesting thread on an underground forum where two users discussed using AI to mimic human E-E-A-T.

E-E-A-T stands for Experience, Expertise, Authoritativeness, and Trustworthiness. It is a quality evaluation framework outlined in Google’s Search Quality Rater Guidelines, which human evaluators use to assess content quality. E-E-A-T itself is not a direct ranking factor.

In the discussion we observed, one user asked the community if it was possible to use AI to effectively fake these qualities when writing product reviews and artificially boost website rankings. The answer was a resounding yes. 

Another user claimed they had never experienced problems getting Google to index their completely AI-generated reviews.

Behind the scenes: The IP addresses for fake reviews

To keep fake reviews from being flagged and deleted, scammers need to look like everyday consumers. To help do this, they can use something called “residential and mobile proxies,” which route their traffic through other internet connections to disguise where it comes from.

Think of an IP address as your computer’s caller ID. When scammers use bulk IP addresses from giant data centers, platforms may spot and block that traffic as coming from commercially hosted infrastructure. Residential proxies, on the other hand, route traffic through real, physical home internet connections—just like the Wi-Fi you use in your living room. Mobile proxies work the same way, but use real cellular networks.

Our team recently discovered a seller on an underground forum acting as a direct supplier of these residential and mobile connections. The seller explicitly advertises them as perfect for running fake review campaigns.

How to avoid being misled by fake reviews

The main goal of this research isn’t to make you panic or stop trusting every online review you read. We want to raise awareness about what happens behind the scenes, so you can make more informed buying decisions.

If a product or offer seems too good to be true, but is backed by a mountain of perfect five-star reviews, take a moment to pause. Scammers often use these artificially boosted ratings to make a bad deal look reassuring.

Read recent reviews and some of the middle-rated ones, rather than relying on the overall score. Look for recurring details about the things that matter to you, such as durability, delivery, or getting your money back.

Look for repeated wording or sudden bursts of glowing feedback. These signs don’t prove a review is fake, but they’re reasons to take a closer look. Check the seller’s contact details and return policy, too.

Malwarebytes Browser Guard can also help block scam, phishing, and malicious websites you may encounter while shopping.

Unsure about an offer, even with glowing reviews? Share the link or a screenshot with Malwarebytes Scam Guard for help checking for signs of a scam before you buy.

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

Using a fake DOB or leaving the field blank when making an online account can offer protection from identity theft

You get a call from your bank saying there has been suspicious activity on your account. They read out your name, address and date of birth so you are happy it is a legitimate caller.

But you are talking to criminals who have used your date of birth as part of a web of verifying information to convince you they are someone else.

Elections give scammers plenty to work with: urgent deadlines, familiar faces, passionate supporters, and messages asking people to take action.

Some want you to “fix” your voter registration. Others want a donation, an answer to a survey, or payment for merchandise supposedly endorsed by your favorite politician. The details change, but the objective stays the same: get your money, your personal information, or both.

Here are five election-themed scams to watch out for.

Scam 1. “We’ll help you vote”

Not every election-themed lure starts with a threat. Some offer to make voting easier.

“Get your ballot on autopilot,” reads one text message we reviewed. It encourages recipients to join a permanent absentee list so their ballots arrive at home for every election, adding the reassuring words: “Verified. Tracked. Counted.”

The message is a scam, though it borrows the language of a real Minnesota voting service. Minnesota does have a permanent absentee voter list, but the link in this text is fraudulent. To check or sign up, go directly to your election authority’s official website.

Other messages take the opposite approach: instead of offering convenience, they warn that you could lose your chance to vote.

A message might say you are not registered to vote, your details are incomplete, or your registration is about to be cancelled. Then it offers a link to sort everything out.

The FBI recently warned about messages that send recipients to fraudulent voter-registration pages. Instead of helping people vote, these sites collect personal information that criminals can use for further fraud.

In Brazil, scammers used a fake WhatsApp account with the Superior Electoral Court’s logo. It claimed to be the court’s “Customer Service Department” (which doesn’t exist) and told people to download an app called “Soluciona Pendência,” roughly translated as “Resolve an outstanding issue.” The message falsely warned that people could lose access to banking or government services.

Scam 2. “Donate now to help your candidate win”

A fundraising appeal arrives just as an election reaches a critical moment. It uses the candidate’s photograph, familiar campaign language, and an urgent request for money.

That does not necessarily mean the campaign sent it.

The FBI warns that scammers impersonate candidates and political fundraising organizations to collect supposed campaign contributions. Victims believe they are supporting a legitimate organization, but the money goes to criminals instead.

Before donating, find the campaign or organization’s official website yourself and check who will receive the payment. Don’t let a countdown, a matching-donation claim, or a message about an impending defeat rush your decision. The Better Business Bureau (BBB) advises researching political fundraising requests and resisting pressure to act immediately.

Scam 3. “Take our political survey and claim your reward”

Not every political poll is suspicious. But a request for your opinion can also be an opening for a scam.

The BBB warns about fraudulent polling calls that promise a prize in exchange for answering questions. After the “survey,” the caller asks for credit card information to cover shipping, taxes, or other costs associated with the supposed reward.

At that point, the questions about candidates have served their purpose: keeping you engaged long enough to introduce a payment request.

Other election-themed messages ask people to complete surveys through links. Treat those links with the same caution you would an unexpected donation or registration request. A familiar political organization’s name does not establish who operates the website.

You can decline an unsolicited poll. You should not need to hand over payment details simply to share your political views or claim a surprise reward.

Unsure where a link goes? We’ll check it.

Check now

Scam 4. “Pay this electoral fine” or “Report for election duty”

Few things make a message feel urgent quite like an official-looking demand backed by a possible penalty.

Brazil’s Superior Electoral Court (TSE) has warned about messages falsely claiming people had an unresolved voting issue. The messages link to fake government websites designed to steal personal information or trick people into paying.

Brazil does have legitimate electoral fines, which can be paid through official channels, including Pix. So a fine or Pix request alone doesn’t prove a message is a scam. If a message says you owe money or must perform election duty, check with the relevant authority using contact details from its official website. Don’t use the message’s phone number, link, or QR code.

Scam 5. Your favorite politician “wants you to buy this”

A politician’s name can be used to sell more than a political message.

Criminals use candidates’ names, photographs, logos, and slogans to advertise merchandise that never arrives. What looks like a way to support a candidate becomes an ordinary shopping scam wrapped in campaign branding.

Apply the same skepticism to a “commemorative,” “patriotic,” or supposedly collectible product advertised using a politician’s name. Before buying, ask:

• Is the seller actually affiliated with the politician or campaign?
• What, exactly, are you buying?
• Is there evidence for claims about the product’s quality, usefulness, or future value?
• What are the total price, refund terms, and any recurring charges?

A product does not become useful, valuable, or a sound investment because an ad places it beside a politician’s photograph. Nor does a photograph prove that the politician endorsed it.

There is also a difference between a product you consider poor value and a fraudulent offer. A product being poor value doesn’t automatically make it a scam. Look for clear deception: a fake endorsement, false claims, hidden fees, or an order that never arrives.

How to stay safe from election scams

You don’t need to work out every detail of a suspicious message before deciding whether to act on it. Verify the message through a route the sender does not control.

• Go directly to official election websites to check registration, voting requirements, deadlines, and alleged penalties.
• Verify donation requests independently. Find the campaign or organization yourself and confirm where your money will go.
• Keep payment details out of unsolicited surveys. A political poll that turns into a request to pay for a prize is a red flag.
• Check sellers before buying political merchandise. A candidate’s name or logo does not authenticate the shop.
• Don’t mistake personal details for proof. A message can contain accurate information about you and still be a scam.
• Keep political choices separate from requests for money or personal information. You can support a cause without responding to an unexpected message.
• Use real-time web protection to help block known malicious websites.
  

Pro tip: Unsure whether a message is a scam? Check it with Malwarebytes’ Scam Guard for an assessment and advice on what to do next.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

Google is extending scam-call protection to Android 15 and earlier, adding safeguards against malicious apps that abuse accessibility permissions.

The post Your Older Android Phone Is Getting a New Scam Defense — Here’s What Google Changed appeared first on TechRepublic.

‘Session cookies’ are a primary target for hackers letting them hijack and use your accounts

You’ve had a busy morning of life admin, logging into various accounts to check balances and make payments. At the end of a productive few hours you close your laptop and move on to your next job.

What you don’t know is that fraudsters have hijacked your session with the bank and are now able to access your account. You are the victim of cookie theft, which belongs to a type of fraud known as “session hijacking”.

According to the FTC, the defendants allegedly used websites and sponsored search results to attract travelers, collect personal and financial information, and mislead consumers about the services they would receive. The complaint was filed in the U.S. District Court for the District of Puerto Rico.

How the Government Impersonation Scheme Allegedly Worked?

The FTC alleges that, since at least October 2023, GovAssist, Entry and Zuckerman operated websites including GovAssist.com, Entry.com and IVS.us, offering passport applications, passport-related services, visa applications and visa renewals.

The complaint states that the websites presented themselves as affiliated with the U.S. State Department, although the defendants were neither the federal government nor authorized government-affiliated providers of passport-related services.

The alleged operation relied on paid search ads to reach people looking for official passport information. Searches such as “apply for a new passport,” “passport renewal,” and “passport renewal online” routinely returned IVS.us and Entry.com pages among Google’s top sponsored results, according to the FTC.

This approach allegedly placed commercial services in locations where users might expect to find official government resources. The distinction matters because consumers searching for essential documents may not recognize that a sponsored result belongs to a private company rather than a government agency.

Misleading Passport Service Claims and Hidden Costs

The FTC alleges that the defendants made false promises about what their services could deliver, including claims that they could directly issue U.S. passports. In many cases, consumers allegedly received only a completed passport application that was available for free through the State Department’s website.

The complaint also challenges the companies’ pricing disclosures. Although their advertisements or websites reportedly stated that services started at $89, the FTC alleges that the lowest available price was $119, plus a $29 shipping fee, bringing the total to $148.

Consumers also needed to pay the State Department when submitting their passport applications. According to the complaint, the defendants prominently displayed their own prices while omitting or downplaying the additional government fee, potentially leaving customers unaware that they would have to pay again.

Delivery claims are another part of the case. The FTC alleges that the defendants advertised expedited passport services promising delivery in as little as six to 10 business days or three to four business days. The agency contends these promises were false because the timelines were faster than the quickest expedited service available through the State Department, the only source of U.S. passports.

Fake Reviews and Consumer Trust

The complaint further alleges that the defendants used fake positive reviews to make their services appear legitimate. Their websites reportedly highlighted excellent ratings based on consumer feedback published on Trustpilot and other review platforms.

According to the FTC, those ratings relied on high numbers of fake positive reviews. If established, the allegations would show how misleading reviews can reinforce the credibility created by sponsored search placements, making it harder for consumers to distinguish legitimate services from deceptive offerings.

The alleged combination of deceptive ads and fake reviews is central to the case because consumers may rely on both search rankings and customer feedback when deciding which service to trust.

FTC Alleges Violations of Three Federal Laws

The FTC alleges that the defendants violated the FTC Act, the Impersonation Rule and the Gramm-Leach-Bliley Act. The complaint targets the alleged impersonation of government services, misleading representations about passport processing and pricing, and the use of false consumer reviews.

Zuckerman, identified as the owner and sole member of GovAssist and Entry, allegedly operated the scheme while subject to an FTC order in an earlier, unrelated case involving Support King LLC. That case concerned stalkerware and resulted in a final administrative order addressing data privacy.

The FTC said its staff received assistance from the U.S. Postal Inspection Service, the U.S. Attorney’s Office for the District of Puerto Rico and the U.S. Department of State. The Commission authorized the complaint in a 2-0 vote.

What the Case Reveals About Online Consumer Fraud

The allegations illustrate how consumer fraud can exploit the gap between what users expect from an online search and what a website actually provides. A sponsored result may appear prominently, but its placement does not establish that the service is government-operated or officially authorized.

The case also highlights the role of pricing transparency and review authenticity in online trust. Claims about faster processing, low starting prices, and positive customer experiences can influence purchasing decisions, particularly when consumers need time-sensitive travel documents.

The FTC has emphasized that filing a complaint does not establish that the defendants violated the law. The case will be decided by the court.

For consumers, the allegations underscore the importance of distinguishing official government services from third-party providers and checking fees, processing claims, and reviewing credibility before sharing personal or financial information. The FTC also states that it will never demand money, threaten consumers, instruct them to transfer money, or promise them a prize.

Verify you are human

Checking your browser before accessing this site.

Click to verify →

Then you will be redirected to the requested content.
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare

site-verification-ok

Verify you are human

Checking your browser before accessing this site.

Click to verify →

Then you will be redirected to the requested content.
Ray ID: 8f3a2c1b9d4e5f6a · Performance & security by Cloudflare

site-verification-ok

The warnings are everywhere these days. Don’t click this. Don’t open that. Don’t scan this. Don’t download that. These messages of caution, however well-intended, are so ubiquitous and constant that it should come as no surprise that some people have started to tune them out.

How many people? About one in three, according to our recent study.

Keeping up with every warning can feel exhausting. Meanwhile, scammers are finding new ways to target people and phones give them plenty of opportunities.

Mobile phones give scammers multiple ways to reach people, from text messages and calls to social media posts. According to a 2022 Federal Communications Commission report cited by the Federal Trade Commission (FTC), texting is a more common communication method than voice or email.

Criminals appear to be taking advantage of that fact. Consumers reported losing $470 million to text scams in 2024, up 26% from $373 million the year before and more than five times the amount reported in 2020. The FTC cites estimates that text message open rates run as high as 98%, compared to just 20% for email. People’s tendency to open and read their texts helps explain their appeal to scammers.

Meanwhile, AI is making scams harder to detect, but better at impersonating people and companies to steal money, passwords, and identities.

Voice phishing, or “vishing,” was a vanishingly small category of crime just a few years ago, but AI has made it considerably more convincing. Vishing doubled in the first half of 2026, according to CrowdStrike’s 2026 Threat Hunting Report. Meanwhile, 16% of adults in the Malwarebytes survey said they had received a voice-cloned phone call impersonating someone they knew in the past year.

Our data also shows how difficult people find it to recognize scams: 85% of survey respondents said it’s hard to tell a scam from the real thing, up from 66% a year ago. And 84% said convincing video evidence no longer feels like the rock-solid proof it once was.

Here are five ways to protect yourself

1. Treat unexpected texts and social media posts with suspicion

 Legitimate institutions generally won’t ask for payment or personal information through unsolicited texts. And if the message is marked “urgent,” all the more reason to pause. Instead, go directly to the company’s official website and inquire there.

AI-generated images and videos are making it harder to tell what’s real online, so don’t rely on what you see as proof that a request is legitimate. If the content involves someone you know, contact them directly using a number you already trust.

2. Keep your operating system updated

This is one of the most effective things you can do to keep your phone safe. Security updates patch vulnerabilities that malware takes advantage of. Malwarebytes’ threat research found Android malware detections rose 151% in the first half of 2025. On both iPhone and Android, automatic updates help decrease risk.

3. Protect your accounts

Use a strong, unique password for every account. A password manager can create and store them for you. Where available, use a passkey—a way to sign in using your device, often with your fingerprint, face, or PIN—that resists phishing.

Turn on two-factor authentication, also called 2FA, for all your apps that allow it. This one step makes it harder for criminals who have your password to gain access to accounts on your phone.

4. Be skeptical of voice calls, even from your mom

This can be the hardest one to get your head around, but also one of the most dangerous and fastest-growing. AI-synthesized audio fraud has made it easier for scammers to sound convincingly like a loved one in trouble. Agree on a private code word with family members and friends in case of doubt or emergency. If you’re unsure, hang up and call the person on a number you already have. If the caller claims to be your bank, hang up and call back on a number you look up independently.

5. Check links before you tap, including links in QR codes

Before opening a link in a text, email, or social media post, check the web address for misspellings or an unfamiliar domain. You can also copy it into the free Malwarebytes Scam Link Check for help assessing it.

QR codes can hide suspicious links, too. Scammers sometimes place fake sticker overlays on top of legitimate QR codes in public spaces, and QR code phishing is morphing so fast that the FBI issued an alert in January about North Korean hackers using QR codes to target think tanks and government officials. Look for signs of tampering and check the web address your phone displays before opening it. If you’re not sure, don’t open the link. Instead, go directly to the organization’s official website or app.

Scammers rely on speed and pressure, so the best defense is to slow down. If a message or call feels off, step away and check it through a channel you already trust.

“One of the best cybersecurity suites on the planet.” 

According to CNET. Read their review →

The EU's Booking.com DSA investigation targets fake listings, Booking.com phishing scams and hidden ads. Fines could hit 6% of global turnover.

Related Posts:

• Claude Duet AI Agent Takes On OpenAI Dots and Muse
• Gemini in Apple CarPlay Arrives on Google Maps
• Chrome ClickFix Protection Scans Risky Clipboard Commands

The post EU Opens Booking.com DSA Investigation Over Fake Listings and Phishing Scams appeared first on Daily CyberSecurity.

On August 27, YouTube announced that Amazon had joined its Shopping Affiliate Program. Eligible creators can now tag Amazon products in their videos and earn a commission on sales.

Weeks later, we found a wave of sites offering YouTube creators what looks like another Amazon opportunity: an invite-only advertising deal with Amazon Music. The site shows creators their own channel stats, then asks them to “verify” their channel with Google before it reveals a personalized offer.

That verification step is a phishing attempt designed to steal Google sign-in details, putting the creator’s account and YouTube channel at risk.

If you receive one of these offers, don’t enter your Google password or verification codes. If you already have, secure your Google account immediately using the steps below.

What the real Amazon and YouTube partnership looks like

The real partnership lets eligible creators in the YouTube Partner Program and YouTube Shopping affiliate program tag Amazon products in their videos, Shorts, and livestreams, and earn a commission when viewers buy. YouTube’s setup guidance also describes linking Amazon and YouTube accounts, with a notification in YouTube Studio once tagging is enabled.

The real program does include a step where you connect and verify your channel. But it happens inside an Amazon account you already have, on Amazon’s own site, and YouTube confirms it in YouTube Studio. It doesn’t involve invite-only Amazon Music ad campaigns, payout calculators, or a third-party “creator portal.”

An invite-only deal that doesn’t exist

The site, hosted at amazonyt[.]com, calls itself the “Amazon Artists Music — Creator Portal.” The name resembles Amazon’s real Amazon Music for Artists service, helping it feel familiar at first glance.

It promises “advertising collaborations with Amazon and Amazon Music,” describes the program as invitation-only, and tells visitors to use “the link from your Amazon Music Artists outreach email.”

There’s even an earnings calculator. You pick one of four packages (a Shorts package, an integration in a planned video, a dedicated video, or a “full campaign package”), set your average views, add “boosters” like extra Shorts or a livestream mention, and choose how exclusive the deal should be. The page then shows an “estimated payout” and compares it with the “endless back-and-forth and delayed payments” of ordinary brand outreach.

The calculator does real math on the numbers you enter. But a working calculator doesn’t make the payout real. The estimates give creators a reason to keep going before the site asks for their sign-in details.

The site is available in nine languages: English, Spanish, Indonesian, Portuguese, Russian, Urdu, Arabic, Hindi, and Thai, suggesting the operators are targeting creators across multiple countries.

Your own channel, used as bait

Next, the site asks for your YouTube channel link.

Once you paste it, a dashboard displays your real channel data: subscriber count, total views, recent and top-performing uploads, playlists, topics, and thumbnails. Seeing your own data on an Amazon-branded page makes the offer feel tailored to you.

To pull this data, the site queries YouTube’s own public API directly from your browser. The code includes 20 Google API keys and automatically switches to the next one if a key hits its usage limit or is rejected.

This data is public, so looking it up isn’t theft in itself. What it buys the criminals is credibility. A site that knows your subscriber count and your latest upload can look as though someone has already assessed your channel for a deal.

The offer itself stays locked until you “verify” your channel.

The fake “Continue with Google” button

To unlock it, you have to “complete the required step: Verify Your Channel.” The page says you need to sign in with Google to confirm you own the channel and “unlock your Amazon Music collaboration brief,” and shows a familiar white button with the colored Google logo: Continue with Google.

The site does contain genuine Google sign-in code, the same kind legitimate sites use. But it’s inactive: the setting that would connect it to Google is empty, so it never runs.

Instead, clicking the button opens a full-screen frame on top of the page. The frame loads content from a second domain, youtubechannelverification[.]com. Its background is almost completely transparent, so whatever the second site draws appears to sit over the Amazon page. Meanwhile, your browser’s address bar still shows amazonyt[.]com.

This is similar to what we described in our recent look at a fake Claude Max giveaway: when the sign-in window lives inside the page, the criminals control nearly everything you see.

The second-stage code shows what it’s after. In the version we analyzed, it sent the email address and password entered into the form to its own server, and it supported steps for multi-factor authentication (MFA) challenges. In other words, it’s built to collect not just your password but also verification codes that could help the criminals get past an additional layer of account protection.

A fake offer to keep you reassured

What happens next depends on how the second stage responds.

The fake window has no close button of its own. It closes only when the second-stage site tells it to. When that happens, the page displays, “Verification failed. Please try again.”

However, the second-stage configuration we analyzed also pointed to a “success” address back on amazonyt[.]com. Visiting that page marks your channel as verified and returns you to the dashboard, where the offer is now unlocked: a fit score, campaign tier, budget band, estimated reach, and a pitch that quotes your recent average views back to you.

You can even negotiate. A counter-offer editor lets you choose deliverables, toggle social media usage rights, and leave a note for “Amazon Music.” When you click Request this collaboration or submit your counter-offer, a “Request received” screen says the Amazon Music partnership team will review your channel and reach out with next steps.

For the creator who reaches this screen, everything appears to have worked. They verified their channel, saw a convincing offer, and sent a request. That reassuring ending may give the criminals more time before the victim suspects anything.

Why this campaign stands out

Fake sponsorship offers have targeted creators for years. This one combines several features that make the trap more convincing:

• The password collection happens on a second domain. The amazonyt[.]com page itself doesn’t contain the sign-in form. That form is loaded from youtubechannelverification[.]com only after you click. A split like this can make the first page look cleaner to anyone checking it, and it lets the operators change the second stage without touching the lure.
• The success page is designed to evade suspicion. Victims who hand over their details aren’t left at an error page. They’re returned to an unlocked offer and a “Request received” confirmation, giving them a reason to wait for a reply.
• Personalization is automatic. Every visitor gets a dashboard and offer built from their own channel’s real numbers.
• It may be part of a reusable kit. The code contains leftover error messages that have nothing to do with this site, like “Please enter the product ID” and “This channel is not in the list, please connect the invited channel.” The link to the second stage also carries a ref value, which the second-stage code we analyzed stored as a workerCode. That could mean more than one person sends traffic to it, though we can’t confirm how the kit is shared.

Why criminals want YouTube channels

YouTube creators have been a target for years. In 2021, Google’s Threat Analysis Group described a campaign that lured creators with fake collaboration offers, used malware to take over their channels, and then sold them on or used them to broadcast cryptocurrency scams.

A hijacked channel comes with an audience that already trusts it. That gives criminals a ready-made platform for reaching potential victims.

How to spot a fake sponsorship offer

• Treat “verify your channel” requests with caution. Legitimate services may use Google’s official sign-in to confirm channel ownership. The important distinction is where you sign in: Your Google password and verification codes belong on Google’s genuine sign-in page.
• Check the browser’s real address bar. If you’re asked for your Google password, the actual browser tab or separate browser window should show accounts.google.com. An address bar drawn inside the webpage can be faked.
• Check the domain, not the logo. The domains amazonyt[.]com and youtubechannelverification[.]com are part of this phishing campaign. Familiar branding and accurate channel stats don’t make them official.
• Know what the real program offers. The Amazon and YouTube Shopping partnership lets eligible creators earn commissions on tagged products. A supposed Amazon Music sponsorship needs to be verified separately.
• Verify the offer independently. Contact the company through its official website, using contact details you find yourself rather than those supplied in the message.

If you already entered your details

Change your Google password through Google’s official site. Review your devices and sign out of unfamiliar sessions in your Google Account security settings, and remove any third-party apps you don’t recognize. Also check that your recovery email address and phone number haven’t changed.

If you entered an MFA code or approved a sign-in prompt, treat your account as potentially compromised.

In YouTube Studio, check Settings > Permissions for anyone you didn’t add. If your channel is connected to a Brand Account, check that account’s permissions too. If you’ve lost access, follow YouTube’s guidance for recovering a hacked channel, starting with the Google account associated with it.

How Malwarebytes spots scams like this

Once a phishing page loads, the criminals control almost everything you see, which is why it’s best to stop it before it opens. 

Malwarebytes Browser Guard blocks phishing and scam domains before the page can load. If you’re unsure about a sponsorship offer, you can ask Malwarebytes Scam Guard to check it before you reply or click anything.

Indicators of compromise

• amazonyt[.]com
• youtubechannelverification[.]com

Stop threats before they can do any harm.

Malwarebytes Browser Guard blocks phishing pages and malicious sites automatically. Free, one click to install. Add it to your browser →

A 49-year-old bricklayer sold his belongings before traveling 2,000 km by bus from his home in Brazil to meet “Jéssica,” an online influencer he had fallen for. Yet despite having a social media account with more than 300,000 followers, she never existed.

Edimar Rocha Martins lives in Imperatriz, a city in northeastern Brazil. He says he struck up an online conversation with Jéssica Fazendeira, who supposedly lived near the southeastern city of Belo Horizonte.

The AI persona promising love

The online persona’s name, “Fazendeira,” loosely translates as “female farmer.” She described herself as living on a farm.

Martins said that he had been talking with the persona online since 2020. He decided to visit her after she offered to pay for his trip and have him live on the farm with her, he said. The account’s operator disputes this, saying the character was created in 2025 and denying any private messages with him.

A video posted on one of her online accounts (captured here by Brazilian news service Imirante) asked for a man to come and live with her and offered to fund the trip.

The AI-generated farmer says, translated:

I’m not joking, my intentions are serious. I want to meet someone who wants to build something real and beautiful with me. If you’re a simple man who likes peace and quiet and a calm life, then maybe we’d get along really well.

After selling his possessions to fund the bus trip, Martins arrived in Belo Horizonte and began asking about the woman. Unable to find her, he approached a local radio station, where staff explained that she was an AI-generated character.

Without enough money to return, he received food, support, and a bus ticket to Augustinópolis, in Tocantins, from the city’s migrant assistance service. He later returned to Imperatriz, where he stayed with relatives.

The account’s operator hits back

The account’s administrator posted a message through the AI character’s TikTok account denying any kind of scam. Translated, it said:

This profile is pretty much abandoned, but I’ve come here to state the obvious. I’m made of artificial intelligence, and I’ve never talked to anyone on this profile. The aim was to get engagement for sales. I never spoke directly to anyone, much less brought anyone to Belo Horizonte.

The operator told reporters that the character was created to attract viewers and promote products through affiliate sales. They said they did not know whether other people had reused the character’s content on other accounts.

Another video shows messages people have reportedly sent the account, with the character explaining that it keeps telling viewers it’s an AI. It complains:

And then it’s still my fault, right? These people are lost.

In another video, where it is being interviewed by an AI-generated male character, the persona explains that it deactivated and then reactivated its account. It said:

I was the first AI to get canceled for absolutely nothing.

These are scripted responses published through a fictional character, rather than an AI independently defending itself.

Police said they could not establish at that stage whether a crime had occurred.

One outlet reported that Martins has been struggling with loneliness following his mother’s death.

Videos published to the reactivated TikTok account are labeled as AI generated. It also links to an Instagram account with videos of the character, where videos carry similar labels. Those current labels don’t establish what Martins saw before his trip.

Social media already encourages parasocial relationships, where viewers feel a personal connection with someone who doesn’t know them. AI-generated personas add another complication: The person viewers feel connected to may be entirely fictional.

In our Face value report, 88% of adults surveyed said it’s becoming harder to tell what online content is genuinely human or real.

The AI plot thickens

June saw reports of a 72-year-old man who traveled 4,000 km from his home in Boa Vista to … Belo Horizonte. He visited after seeing a farm woman on a social network who was offering a job opportunity and perhaps something more. Unable to return home, he sought help from social workers.

In August, 71-year-old Alberto da Costa traveled from Manaus to the same city after watching videos featuring the same woman, according to Itatiaia. He paid almost R$3,000 for a flight, then sought help from the outlet when he couldn’t afford to return home.

The videos simulated personal conversations, giving viewers the impression that the woman was speaking directly to them. The account reportedly had nearly a million followers.

The reporting doesn’t establish whether this woman was AI-generated or whether the account was connected to Jéssica’s. Nor does it establish that the men sent money to the account operators. But the costs can still be real: selling possessions, paying for travel, and finding yourself stranded far from home.

Protect yourself and others

The same advice applies here as to romance scams, but with some extras. Don’t send money or travel to see someone you’ve never met without independently checking who they are.

Don’t rely on video calls alone. Scammers now use deepfake video calls to dupe victims live. And check whether you’re exchanging private messages or watching public videos that anyone can see.

Look for information beyond the account itself. Search their name and profile pictures, and research where they say they work. Be cautious if their story doesn’t add up or they avoid questions about their identity.

When you feel close to someone, questioning that connection can be difficult. Before sending money or booking travel, talk to a friend or family member and get their perspective. And if you’re worried about someone who may be in a similar situation, check in without judgment and offer to look through the account together.

Images courtesy of Jam Press

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

This week on the Lock and Code podcast…

At just 17 years old, Jordan DeMay was murdered by strangers online.

That’s how Jordan’s father, John DeMay, described what happened to his son four years ago. At home in Michigan, Jordan was readying for a weekend trip when he received a friend request on Instagram. The invite was sent by a user named “dani.robertts” whose profile showed an attractive young woman. After accepting the request, Jordan and the account chatted about nothing in particular—teenage matters, getting to know one another—before “dani” became flirtatious, eventually sending Jordan what she claimed was a nude photograph of herself.

Jordan responded in kind with an explicit photograph of himself.

But here, a trap was revealed.

“Dani Robertts” was not a young, friendly, interested woman. Dani Robertts was several men, sending messages from thousands of miles away in Lagos, Nigeria, who had followed a script to pressure young men into handing over their money. This was not the first time these men had run this scam. But with a great deal of investigative work, it hopefully has become the last.

What happened to Jordan can happen to anyone—and it has happened to far too many young men and women today. It is a type of attack commonly referred to as “sextortion.”

Today, on the Lock and Code podcast with host David Ruiz, we speak with John DeMay about his son Jordan, his family’s relationship with social media, and what parents should know.

Tune in today to listen to the full conversation.

Show notes and credits:

Intro Music: “Spellbound” by Kevin MacLeod (incompetech.com)
Licensed under Creative Commons: By Attribution 4.0 License
http://creativecommons.org/licenses/by/4.0/
Outro Music: “Good God” by Wowa (unminus.com)

Listen up—Malwarebytes doesn’t just talk cybersecurity, we provide it.

Protect yourself from online attacks that threaten your identity, your files, your system, and your financial well-being with our exclusive offer for Malwarebytes Premium for Lock and Code listeners.

AI can help you send more job applications. But when you lose track of where you’ve applied, a fake recruiter’s message can start to look like the reply you’ve been waiting for.

Job hunting can feel like shouting into the void. You send applications, rewrite cover letters, and wait for replies that may never arrive. Then a message lands on your phone: someone wants to talk about a job.

But was it one of the jobs you applied for? It is hard to keep track when you’ve sent out a lot of them.

Two reports highlight an uncomfortable overlap. The BBC describes jobseekers using AI to apply for large numbers of roles, a strategy known as “spray and pray.” Meanwhile, research reported by The Independent suggests many young adults are receiving unsolicited job offers and worry that ignoring those offers could mean missing a real opportunity.

Neither report establishes that mass applications cause people to fall for recruitment scams. But together, they point to a useful security question: When you’re expecting replies from practically everywhere, how do you recognize a message from someone you never contacted?

The scams

Job offer scams come in different forms. We’ve talked about fake interview apps that are spyware, Calendly interview invites that steal social media credentials, so-called parcel expert jobs, advance fee scams, task scams, and recruiters stealing Google credentials.

There are many more, unfortunately. These examples illustrate some of the risks of a bogus recruitment approach: financial fraud, malware installation, and account theft.

Scam or legit? Scam Guard knows.

TRY IT NOW

An anonymized message submitted to Scam Guard, which appears to falsely claim to be from legitimate UK marketing firm The Goat Agency, showed signs of a possible task scam:

“Hello! I’m a representative from the HR team at goatagency. We’ve recently reviewed your CV and believe you could be a great fit for a remote online opportunity we’re currently offering. This is a flexible part-time or full-time remote position, with responsibilities focused on assisting merchants by providing product reviews. The work is straightforward, and we will provide full training to help you get started quickly. Work just 60-90 minutes per day Daily earnings range from £500 to £1,000, depending on your availability Work anytime, from anywhere If you’re interested in joining us, please contact us via WhatsApp:”

But scammers don’t even need to offer a dream salary. Almost half of UK 18- to 24-year-olds surveyed in research commissioned by Virgin Media O2 said they had received messages offering jobs they had never applied for. Without the obvious red flag of an “easy cash” promise, a scam message can look even more like a legitimate contact from a recruitment agency.

The approach can also start with a phone call. The Independent reports warnings about automated calls asking recipients to add a number on WhatsApp, sometimes in connection with supposed part-time work.

Other approaches use a familiar employer’s name to make requests look credible. We previously reported on fraudulent job postings that imitate real businesses and seek applicants’ personal information or money, including supposed payments for office equipment.

How to stay safe

One simple rule can spare a lot of harm: Keep the applications and verify anyone who contacts you about a job. You don’t need to abandon AI-assisted applications or assume every recruiter is fake, but a plausible opportunity still needs checking

• Keep a simple application log. Record the employer, role, application date, and original listing so you can check when someone contacts you.
• Verify both the vacancy and the recruiter independently. Find the employer’s website yourself and use its published contact details. The existence of a real vacancy doesn’t prove the person messaging you represents that employer.
• A familiar logo doesn’t prove anything. Scammers imitate legitimate companies and may use real employees’ details to support the impersonation.
• Never pay to unlock earnings. A request to deposit money before you can withdraw supposed commissions is a hallmark of a task scam.
• Pause before sharing sensitive information, installing software, or signing in through a recruitment link. Verify the approach first, especially if it arrives unexpectedly.
• Enable multi-factor authentication on your important accounts to make them harder to take over, even if someone steals your password.
• Use up-to-date anti-malware protection with real-time scanning to help detect and block malicious downloads.

An application log can help you check whether a message relates to a job you applied for. Even when it does, verify who’s on the other end before sharing information or taking the next step.

From reporting threats to removing them.

Cybersecurity risks should never spread beyond a headline. Keep threats off your devices by downloading Malwarebytes today.

Maybe it’s a text saying your package couldn’t be delivered, with a link to reschedule. Or an email from your bank asking you to verify your account. Or perhaps it’s an invitation from someone you know to view a document. 

The message looks real enough, but something about the link feels fishy. Do you click it? 

Malwarebytes Scam Link Check is a new free tool that lets you check a suspicious link before you click.  

Simply paste the link into Scam Link Check, and Malwarebytes will scan it for signs of phishing, scams, malware, and other online threats. You’ll know within seconds whether the link appears safe or might be dangerous.  

What is Malwarebytes Scam Link Check? 

When you paste a link, Malwarebytes Scam Link Check analyzes the website using our threat intelligence technology. Along with a safety verdict, you’ll learn more about what we found, including: 

• Information about the website’s domain and reputation 
• Signs that the site may be impersonating a known brand 
• Where the link ultimately leads 
• A preview of the website 
• Recommended next steps 

When should you check a link? 

Scam links can show up pretty much anywhere: text messages, emails, social media posts, messaging apps, QR codes, and even search results. 

It’s a good idea to check a link whenever you’re unsure about where it may lead, especially if the message asks you to log in, make a payment, share personal details, or act quickly. 

For instance, you might want to investigate a link if you receive a message claiming: 

• You missed a package delivery 
• There’s a problem with your bank account 
• You need to reset a password or verify your identity 
• You owe a toll, fine, or other payment 
• You’ve won a prize or are eligible for a refund 

How to check if a link is safe 

Using Malwarebytes Scam Link Check is simple and takes just a few steps: 

1. Copy the suspicious link without opening it. 
2. Paste the link into the tool.  
3. Wait while Malwarebytes scans the site for potential threats. 
4. Review the results.  

If we can’t determine whether a link is safe, it’s best not to click it yet. Instead, reach out to the company using the contact details listed on its official website. 

Check before you click 

Scammers are getting more adept at creating convincing copies of a brand’s site, making it even harder to decipher what’s real and what’s not.  

With Malwarebytes Scam Link Check, you don’t have to figure it out on your own.  

The Federal Trade Commission (FTC) has filed a complaint accusing Digital Forensics Corporation of exploiting people already targeted by sextortionists.

We have talked about sextortion and recovery scams in the past, but we never looked specifically at the combination. Apparently, there is a lot of money to be made for those ruthless enough to take money from victims already in a state of panic.

The FTC has accused Digital Forensics Corporation, its owner Dmitry Belkin, and affiliated companies of misleading sextortion victims into paying at least $60 million for assistance that, in numerous instances, they did not provide. A federal court has temporarily halted the defendants’ activities while the case proceeds.

Most of the time, sextortion emails are a bluff sent to a large number of targets to see if one takes the bait. But sextortion can also involve intimate images that someone really possesses. In those cases, a criminal threatens to share the material unless the victim pays, sends more images, or complies with other demands.

In those cases, victims can feel desperate, especially when the demands keep coming, and may look for help to make it stop. According to the FTC, Digital Forensics targeted people searching for that help through advertisements on Google, YouTube, X, and other platforms. The company allegedly claimed it could track down criminals worldwide, identify perpetrators, and provide law enforcement with evidence needed to make arrests.

Digital Forensics allegedly charged between $1,499 and $20,000 for a “Phase 1” package. That was supposed to include communicating with the sextortionist, tracking their location, producing an investigative report, and reporting the crime to law enforcement.

According to the FTC, Digital Forensics Corporation changed the victims’ account settings to block the sextortionist, fabricated chat transcripts, and presented pre-saved coordinates, often in Nigeria or the Philippines, as the sextortionist’s location.

After collecting the first payment, the company allegedly pressured customers to purchase “Phase 2” services, supposedly providing ongoing account monitoring and further assistance. The FTC says the company did not follow through on those promises either.

Another huge red flag was that the company also allegedly discouraged victims from blocking their blackmailers, contrary to law enforcement and expert advice.

The allegations against Digital Forensics Corporation have not yet been decided by the court.

How to stay safe

Be wary of anyone who promises to stop the threats or pressures you to pay immediately. Help should offer clear information and realistic options. It should not turn your fear into another payment deadline.

If someone is threatening to share intimate images, you do not have to handle it alone.

• Preserve the threats and account details. Keep the messages, usernames, and payment demands. Block the offender but do not delete your account or the messages, since they may help real investigators.
• Stop communicating and block the blackmailer. Do not pay them or give them access to your devices or financial accounts. Report the account using the platform’s safety tools.
• Tell someone you trust about the sextortion. A friend, family member, counselor, or other trusted adult can provide support while you decide what to do next.
• Report the crime. Contact local police. In the US, you can also report sextortion to the FBI. If it involves a minor, report it through the National Center for Missing and Exploited Children’s CyberTipline.

If you have already paid a service that you believe misled you, keep its ads, messages, contract, and receipts, and report your experience to the FTC through ReportFraud.ftc.gov.

If you’re unsure whether something is a scam or not, ask Malwarebytes Scam Guard. It can help you assess it and provide advice on next steps.

Something feel off? Check it before you click.  

Malwarebytes Scam Guard helps you analyze suspicious links, texts, and screenshots instantly.  

Available with Malwarebytes Premium Security for all your devices, and in the Malwarebytes app for iOS and Android.  

Try it free → 

A scam crackdown on West Africa scam centers by Meta, tech firms and police removed 3.7M accounts, led to 28 arrests and freed 117 victims.

Related Posts:

• DOJ Charges Engineer After OpenAI Recording Device Arrest
• DOJ Disrupts DPRK IT Worker Schemes Across More Than 70 US Companies
• Ivanti Connect Secure Zero-Day Chain CVE-2026-104935 Exploited by UTA0576 to Gain Root Access

The post Meta, Tech Firms and Police Hit West Africa Scam Centers in Joint Operation That Led to 28 Arrests appeared first on Daily CyberSecurity.

Scammers are finding different ways to use personal details exposed in data breaches to lure people into conversations.

Last week, we showed how a Facebook Marketplace listing used the recipient’s name to make a text asking “Is this still available?” more convincing.

The one we got this week was a lot simpler. No suspicious link. No overdue payment. No warning that your account is about to be closed. No fake images.

Just your name, followed by a question mark.

It’s a remarkably small opening for what could become a much bigger problem. A message like this invites an almost automatic response: “Yes?” Or perhaps, “Who’s this?”

That’s because a scammer needs to get you to engage before they can persuade you to hand over money or personal information. Sometimes, the first thing they ask you to give them is simply a reply. The Federal Trade Commission (FTC) has warned about similarly brief, apparently harmless messages that scammers use to start conversations.

The text in our example gives the recipient very little information, but leaves an obvious question unanswered: Who wants to know? Using the correct name makes that question more compelling. This is not just a generic “Hello” that could have gone to anyone. It looks as though the sender is trying to reach you specifically.

It’s tempting to think, “They have my name and number, so this must be someone I know.” But having those details is not evidence they know you. As we discussed in the Marketplace article, name-and-phone-number combinations can come from breached data traded by cybercriminals.

What follows depends on the scheme. The first message doesn’t tell us which route this scammer planned to take. But documented scams show how an innocuous introduction can develop:

• A supposed wrong-number exchange becomes a friendly conversation.
• The sender builds a relationship rather than immediately asking for money.
• An investment opportunity eventually enters the discussion.
• The victim is encouraged to send money to a fraudulent investment scheme.

The FBI describes how cryptocurrency investment scammers build trust before introducing fake investments, and identifies unsolicited texts as one way they approach victims.

Even if the conversation goes no further, your reply can still be useful to the scammer. As we explained in our earlier article on wrong-number texts, it shows that you are willing to engage. Your number can then be reused or sold for other scam campaigns.

How to stay safe

A scam doesn’t have to begin with an outrageous promise or an urgent threat. Sometimes it begins with something much more ordinary: your name, a question mark, and the expectation that you will be polite enough to answer.

Don’t reply. Even “Who’s this?” or “Wrong number” tells the scammer you are willing to respond. If you think it might be someone you know, contact them through a number or channel you already trust.

Report before you block. Use your messaging app’s reporting option, then block the sender. If you have already replied, stop engaging.

Make yourself harder to profile. Review privacy settings on messaging apps and social media. Limit who can see your profile photo, status, last seen, and phone number.

Run a Malwarebytes Digital Footprint Scan to check for personal information exposed in known breaches and on the dark web. It helps to be aware of what can be used to target you.

Use Malwarebytes Scam Number Check to see whether the sender’s number has been flagged for scams or spam.