I. Executive Summary
The phone rings and it’s a family member. They sound panicked. They say they’ve been in an accident, and the police are holding them until they can post bond. They hang up abruptly. The phone rings again. This time, the caller claims to be a police officer and says your family member will not be released until $10,000 is paid immediately.
But neither call is real. The family member’s voice has been cloned using artificial intelligence, and the second caller has spoofed the police department’s phone number. These technologies can make familiar forms of fraud more convincing and more difficult for consumers to recognize.
This is just one example of how technology is changing consumer fraud. In 2025, the FBI’s Internet Crime Complaint Center (IC3) received more than one million complaints involving over $20 billion in reported losses due to consumer frauds and scams,[1] while the Federal Trade Commission (FTC) reported approximately $16 billion in consumer fraud losses, the highest of any year on record.[2]
But these figures only capture part of the problem because many victims never report fraud and scams. According to one independent analysis, Americans lose approximately $148.2 billion to online scams each year, once unreported losses are considered.[3] Economic loss is only one of the costs; fraud and scam victims may also face recurring misuse of personal information, as well as emotional and psychological harm.
Responding to fraud after consumers have already been harmed is no longer enough. Policymakers need to focus on the systems that enable fraud and scams to operate at scale. Interventions should target the data, technologies, infrastructure, and services that enable frauds and scams to flourish. But upstream interventions will not stop everything. Prevention and post-exploitation enforcement therefore also need to be coupled with investment and support for consumer protection measures — using technologies to protect individual consumers from the bad actors that evade even the best detection and enforcement methods.
This paper examines the interconnected economic, technological, and data-driven forces shaping modern fraud. It then analyzes three key enablers of fraud at scale: the widespread availability of detailed consumer data, advances in artificial intelligence and automation, and the shared digital infrastructure and services that fraudsters increasingly exploit. The paper offers concrete recommendations, including:
Strengthen Cybersecurity and Authentication - Government and industry should strengthen cybersecurity and authentication practices to make it harder for fraudsters to access sensitive information, compromise accounts, impersonate trusted entities, and misuse services to facilitate fraud. Establish Best Practices for Preventing Fraudulent Use of Digital Infrastructure - Policymakers should work with technology companies, cybersecurity providers, communications providers, and other relevant stakeholders to establish industry best practices for preventing digital infrastructure from being used to facilitate consumer fraud. Technology Needs to Be Part of the Solution - Even effective infrastructure-level interventions will not stop every scam. When fraud reaches consumers, consumer-facing technology should provide an additional layer of protection. Mozo, ReasonLabs’ consumer platform, uses technology to identify and proactively block scams before the first user click, stopping fraud before it reaches the consumer. The technology can detect malicious campaigns across email, text messaging, social media, online advertising, and the web, identifying fraud as it emerges rather than after consumers have already suffered losses. Create a Cross-Sector Information Sharing Hub - Policymakers should establish a cross-sector mechanism for sharing fraud indicators, including malicious domains, sender addresses, phone-number pools, advertiser profiles, and other attributes associated with fraudulent campaigns. Bringing together information across the fraud ecosystem, including consumer-side observations, can help organizations connect activity across channels to identify and disrupt related fraud earlier. Make Prevention a Consumer-Protection Performance Metric - Government agencies should measure the effectiveness of prevention. Today, most reporting mechanisms focus on complaints, losses, recoveries, and enforcement mechanisms. While these metrics are important, they measure what happens after consumers have already been exposed to fraud. Policymakers should also measure whether prevention efforts are disrupting fraud before it reaches consumers. II. Background and Problem
Consumer fraud is one of the fastest-growing and costliest threats facing individuals, with significant increases in both losses and attack sophistication. In 2025 alone, the FBI’s Internet Crime Complaint Center (IC3) received more than one million complaints involving over $20 billion in reported losses, due to consumer frauds and scams,[4] while the FTC reported approximately $16 billion in consumer fraud losses, the highest of any year on record.[5] These figures capture only a portion of the problem. Many victims never report fraud or scams. According to one independent analysis, Americans lose $148.2 billion to online scams each year once unreported losses are taken into account.[6] Financial loss is also only one of the many costs. Fraud and scam victims also face recurring misuse of personal information, as well as emotional and psychological harm.
Behind those numbers are vulnerable consumers. Recently, Kimberly Fudge, a 38-year-old finance manager in Florida, received a call from someone claiming to be a sheriff’s deputy who told her she had missed federal jury duty and that a judge had issued a warrant for her arrest. The caller cited personal details—including her Social Security number, recent text messages, and internet searches—to convince her the threat was real and told her she could avoid being taken into custody by following their instructions. Over the next ten hours, a team of at least five scammers, each playing a different law enforcement role, kept her on the phone and escalated the pressure whenever she questioned the process. They directed her to withdraw cash and deposit it into cryptocurrency ATMs. By the time her husband recognized the warning signs and called 911, the scammers had stolen $25,000.[7]
The scheme targeting this woman is just one example of the many forms consumer fraud can take. Consumer fraud includes investment scams, which lure victims with fraudulent financial opportunities or platforms;[8] employment scams, which use fake jobs or recruiters to obtain money or personal information;[9] romance scams, which build relationships and trust before requesting money;[10] and government and business impersonation scams, which exploit the authority of trusted officials and institutions.[11]
Although their modes of operation differ, all of these frauds and scams share and benefit from underlying factors. These include the widespread availability of consumer information, combined with advances in artificial intelligence (AI), automation, digital advertising, online communications, and cloud infrastructure. Detailed information about consumers is easier to obtain at scale, giving fraudsters more information to identify and target potential victims. AI and automation make that information easier to aggregate and analyze while enabling the rapid creation of personalized and convincing content. Digital advertising and communications platforms provide efficient ways to reach potential victims, while websites, domains, and other digital infrastructure can be launched, abandoned, and replaced rapidly.
ReasonLabs’ data illustrates the resulting scale and speed of this ecosystem: an estimated 2,000–3,000 new scam websites come online each day, while more than 100,000 fraudulent messages and advertisements reach American consumers daily through email, text messaging, and social media. Ultimately, these factors have changed the economics of fraud by lowering the cost and effort required to carry out sophisticated fraud at scale.
That scale is possible in part because fraud operators do not have to build every capability themselves. What consumers experience as individual scams are often supported by a broader ecosystem operating behind the scenes. Fraud operators can draw from a common pool of consumer data, technical infrastructure, and commercial services. They rely on networks of data brokers, lead generators, online advertising services, communications platforms, hosting providers, payment processors, affiliate marketers, and other intermediaries that collectively enable fraud to scale.
Understanding fraud as an ecosystem has important implications for policy because it shows where intervention can be most effective. The sheer volume of frauds and scams makes it nearly impossible to tackle message-by-message or victim-by-victim. A policy framework focused primarily on identifying and responding to individual scams risks an endless game of whac-a-mole.
Instead, policymakers need to focus on the systems that allow fraud and scams to operate at scale. Interventions should target the data, technologies, infrastructure, and services that enable frauds and scams to flourish. The goal should be to disrupt the underlying conditions that make fraud easy to launch, scale, and repeat. Upstream interventions will not stop every scam, so prevention and post-exploitation enforcement also need to be coupled with consumer protection measures that protect individuals from the bad actors who evade even the best detection and enforcement methods.
To develop this argument, this paper examines the interconnected economic, technological, and data-driven forces shaping fraud. It then analyzes three key enablers of fraud and scams at scale: the widespread availability of detailed consumer data, advances in artificial intelligence and automation, and the shared digital infrastructure and services that fraudsters increasingly exploit. The paper also explains why demographic targeting matters to prevention as fraud operators increasingly use data and timing to identify the consumers most likely to respond. Building on that analysis, the paper proposes prevention-focused strategies that target these enabling systems, raise the costs of fraudulent activity, reduce consumer exposure, and ultimately shift intervention upstream—to stop fraud before the first click.
III. Consumer Fraud Operates as an Ecosystem[12]
Consumer fraud is commonly understood as a collection of individual scams. Law enforcement agencies, regulators, policymakers, and consumer protection organizations typically organize fraud into categories such as investment scams, employment scams, romance scams, phishing, government impersonation, and identity theft. These categories reflect how fraud appears to consumers and provide a practical way to track and report it. This approach also helps agencies identify emerging threats, educate consumers, allocate resources, and pursue targeted enforcement actions.
However, scam categories describe how fraud is experienced – not necessarily how it operates. From the perspective of a fraud operator, the distinctions between scam categories are far less significant. A fake job offer, fraudulent loan solicitation, investment opportunity, sweepstakes promotion, or government impersonation scheme may tell the consumer a different story, but producing and delivering each requires many of the same underlying capabilities.
Fraud operators must identify potential victims, obtain information to target or persuade them, develop a credible lure, reach them through communication channels, establish trust or urgency, and ultimately, extract something of value. What is extracted may differ: a scheme may seek an immediate financial transfer, account credentials, or personal information that can be monetized, resold, or used to facilitate subsequent fraud. But despite these differences, the process of moving a consumer from initial contact to exploitation remains largely the same.
ReasonLabs’ investigations demonstrate how this operates in practice. In some cases, a single operator reuses the same operational infrastructure across multiple scam narratives. They have observed:
One operator running loan, settlement, sweepstakes, benefits, housing-assistance, and job lures through the same rented sending system. An auto-warranty operator running many thousands of sending domains behind a single shared redirect kit that served six different lure types. And an operator maintaining dozens of rented sub-accounts on one email platform alongside a parallel estate on a second, with both going dark on the same day.
In each case, scams that appear different to the consumer were simply different manifestations of the same underlying operation.
But the capabilities that enable fraud do not always reside within a single operation. Increasingly, they are distributed across specialized actors that provide the data, infrastructure, communications, and other services needed to carry out fraud at scale. This specialization allows fraud operators to draw on capabilities they don’t necessarily need to build or maintain themselves.
Researchers have described this transformation as the “industrialization” of fraud, characterized by “diverse organizational structures and specialized roles” that increasingly resemble those found in legitimate industries.[13] The United Nations Office on Drugs and Crime similarly observes that fraud involves “an extended sequence of actions and events” in which “tasks are distributed across a multitude of loosely connected criminal actors,” allowing participants to specialize and develop expertise. This division of responsibilities can improve the efficiency and scalability of fraud operations while also “dispers[ing] culpability and reduc[ing] the risk that any single participant will be identified or disrupted by law enforcement.”[14]
The result is an interconnected fraud ecosystem. Different actors can contribute at different points in a scheme—from identifying and profiling potential victims to developing deceptive content, distributing communications, facilitating payments, monetizing stolen information, and supplying technical infrastructure. A single campaign may depend on several of these actors, while the same services or infrastructure may support multiple campaigns.
ReasonLabs’ investigations provide evidence of these connections at the infrastructure level. ReasonLabs has identified shared SMS number pools in which one sequential block of numbers served at least eight unrelated scam operators and another served more than a dozen. Unlike the examples above, where a single operator reused its infrastructure across different scam narratives, these number pools connected operators that otherwise appeared unrelated. In these cases, the underlying infrastructure appears to function as a shared service available across separate fraud operations.
Consumer information can move through the ecosystem in similar ways. Information collected through one fraud or scam may be sold, shared, or otherwise passed to other actors and used to target consumers again. Regulatory enforcement provides evidence of this. The FTC’s investigations have documented cases in which deceptive websites and online forms collected sensitive consumer information, then routed it through commercial data networks and deployed it directly into unauthorized debits and targeted scam campaigns.[15] In other words, the output of one stage of the fraud lifecycle frequently becomes the input for the next, creating a self-reinforcing system that grows more adaptive, efficient, and resilient over time.
ReasonLabs’ broader data suggests that these connections are widespread. ReasonLabs tracks scam campaigns individually, with each campaign investigated and attributed on its own evidence. When those campaigns are subsequently compared, approximately 79%—nearly four in five—share at least one concrete indicator with another campaign in the dataset, including a sending domain, sender address, phone number, landing-page host, or advertiser profile. Individual indicators recur across as many as six separate campaigns.
Importantly, these campaigns were not initially grouped based on shared infrastructure or other connections. They were investigated independently, and the connections emerged only when the campaigns were later compared. The finding provides measurable evidence of the ecosystem itself: nearly four in five campaigns that appeared distinct when examined individually were connected to at least one other campaign through a concrete operational indicator. Further understanding how this ecosystem operates therefore requires examining the resources and capabilities that sustain it.
IV. Consumer Data: The Fuel of the Ecosystem
Consumer data has become a critical fuel for the fraud ecosystem. As we have seen, it can be exploited directly by threatening to release sensitive information unless a victim pays. It can also help fraud operators identify potential victims, understand their circumstances, and determine how best to target them.
Because consumer information can make targeting more effective, it can carry economic value of its own. Consumer information can be collected, combined with other data, refined, sold, and reused. In many cases, fraud operators do not need to steal personal information themselves—they can simply purchase it from commercial data brokers. For example, in 2021, Epsilon Data Management agreed to pay $150 million to resolve Department of Justice charges that it knowingly sold targeted consumer marketing lists to perpetrators of elder fraud schemes. Those lists were used to identify individuals—particularly elderly and other vulnerable consumers—who were most likely to respond to fraudulent sweepstakes and astrology solicitations promising nonexistent prizes or personalized psychic services. Epsilon admitted that it sold more than 30 million consumers’ data to fraudulent schemes over nearly a decade.[16]
While Epsilon admitted to knowingly selling consumer information to perpetrators of fraud, that is not always the case. Data brokers may have no knowledge that information collected or sold for legitimate commercial purposes will ultimately be obtained or misused by bad actors. Nevertheless, regardless of whether that misuse is known or intended, consumer-data markets can reduce a significant barrier to carrying out fraud: identifying and profiling potential victims. As the Senate Joint Economic Committee recently observed, “data brokers can enable scams by making consumers’ personal information available to bad actors, who can then use details like Social Security numbers, home addresses, or banking information to develop customized and convincing scams.”[17]
Commercial data brokers, however, represent only one source of consumer intelligence. Fraud operators increasingly combine commercially available information with data obtained from public records, prior data breaches, social media activity, lead-generation websites, mobile applications, online advertising, and consumers’ own digital interactions. Information from these sources can be assembled into detailed profiles that reveal not only who a consumer is, but their circumstances, interests, and behaviors.
ReasonLabs’ investigations show how this information can be used in fraud campaigns. In a range of home-equity and refinancing scams for example, fraudsters were able to trick consumers by personalizing their offers with a consumer’s real name and street address. In other campaigns, consumers were directed to forms already populated with identifying information and asked to provide additional details the operator did not yet possess.
These examples show how fraud operators use information about a consumer to increase the efficacy and believability of their outreach. That information can shape both who is targeted and the type of scheme used to target them. Knowing that a consumer owns a home, has sought credit, responded to a previous solicitation, or possesses other relevant characteristics can help an operator select a fraud or scam tailored to that individual’s circumstances. A consumer profile is therefore valuable not simply because it identifies an individual, but because it can help predict how that individual may respond. Rather than targeting consumers indiscriminately, fraud operators can concentrate their efforts on individuals they believe are more likely to engage with a particular scheme.
Consumer profiles can also become more detailed and useful over time. Each interaction may create additional intelligence that improves future targeting. Information collected during one fraud campaign can be reused, combined with other datasets, sold to additional actors, or incorporated into entirely different fraud schemes. As consumer information becomes increasingly valuable to fraud operators, strong cybersecurity and authentication safeguards are critical to protecting that information from unauthorized access and misuse.
V. Artificial Intelligence Accelerates the Ecosystem
AI further accelerates these economic dynamics by making fraud and scams easier, cheaper, and more scalable. The FBI warned that “generative AI allows criminals to commit fraud on a larger scale and reduces the effort required to deceive potential victims.”[18] The potential economic consequences are significant. Deloitte’s Center for Financial Services estimates that generative AI-enabled fraud losses affecting U.S. banks and their customers could increase from $12.3 billion in 2023 to $40 billion by 2027—a compound annual growth rate of 32%.[19]
Historically, conducting sophisticated fraud campaigns required significant time, technical expertise, and human labor to identify targets, craft convincing messages, and repeatedly engage potential victims. Generative AI has changed that by enabling fraudsters to automate many of these functions. Fraudsters “increasingly can use generative AI to create a slew of fake investment sites, generate scam tokens and trading bots, produce deepfake videos, voice clones, and social media content.”[20] AI also enables criminals to profile potential victims, conduct reconnaissance for social engineering attacks, and personalize fraudulent communications with minimal effort. As researchers have observed, these capabilities not only make scams more convincing but also allow criminals to “quickly create vast amounts of content … that reinforce each other, which makes scams seem more legitimate and reach more viewers with lower effort.”[21]
AI is also making some forms of fraud easier to carry out without specialized skills. Tasks that may require linguistic, technical, or creative expertise can increasingly be performed with readily available AI tools. Translation tools can help fraudsters communicate convincingly in languages they do not speak, while voice-cloning and image-generation tools can help them impersonate real people. Illicit marketplaces can lower these barriers further by providing access to jailbroken AI models, prepackaged fraudulent content, and other tools designed or adapted for misuse.
AI also complicates fraud prevention. Previously, consumers could often identify frauds and scams by looking for warning signs such as poor grammar and spelling mistakes when deciding whether a message was legitimate. Security awareness training has typically taught consumers to rely on these indicators to recognize potential scams. AI eliminates those clues by producing grammatically correct, convincing messages. This makes frauds and scams harder for consumers to detect.
VI. Shared Infrastructure Across the Fraud Ecosystem
The third enabler of fraud is the infrastructure it relies on. Unlike traditional organized crime, which often requires dedicated criminal networks, physical infrastructure, or specialized tools, many fraud operators now assemble sophisticated operations using commercially available digital services. Europol observes that “to identify their victims and communicate with them, fraudsters make extensive use of legitimate websites, email service providers, dating apps, social media and instant messaging services, as well as traditional telephone and voice over IP (VoIP) services.”[22]
Rather than building and maintaining their own infrastructure—although some do—operators increasingly rely on services that are already trusted, globally accessible, and continuously maintained by legitimate providers.
The reliance on existing services has dramatically lowered the barriers to launching fraud operations. Recent Satori research illustrates this by comparing two realistic approaches to launching a scam operation. Under an “owned” model, operators purchase physical phone farms, host their own AI models, and maintain dedicated infrastructure, requiring approximately $5,000 in startup costs and roughly $450 in monthly operating expenses. Under a “managed” model, however, operators rent cloud phones, subscribe to orchestration platforms, purchase AI tokens, and outsource human “chatters,” reducing startup costs to essentially zero while incurring monthly operating costs of approximately $2,970.[23]
Rather than investing thousands of dollars to build communications infrastructure before launching a campaign, operators can pay for these capabilities as needed, making sophisticated fraud operations far easier to establish. In doing so, they inherit the scale, resilience, and reach of that infrastructure without bearing the costs of building or maintaining it themselves. As a result, fraud campaigns can be launched more quickly, adapted more easily, and reconstituted almost immediately when individual websites, accounts, or advertisements are disrupted.
While this reliance benefits fraud operators, it also makes fraud significantly more difficult to detect and disrupt. Because fraud is embedded within legitimate digital services, malicious activity often looks no different from ordinary online activity. Scam websites are hosted by the same cloud providers that support legitimate businesses, fraudulent advertisements appear alongside legitimate advertising, and malicious communications travel through the same email providers, messaging platforms, and telecommunications networks that consumers, governments, and businesses use every day. Rather than locating dedicated criminal infrastructure, investigators are faced with the challenge of distinguishing malicious activity from billions of legitimate interactions occurring across the same trusted services.
ReasonLabs data illustrates the scale of this challenge. More than one-third of the fraudulent web addresses reaching consumers point to widely shared platforms rather than infrastructure controlled by the operator. About one in five point to legitimate email service providers, including their click-tracking domains, while nearly one in ten point to mainstream cloud providers. The rest are hosted on e-commerce platforms, link-shortening services, and other widely used digital platforms. These figures likely underestimate the extent of the problem because they include only providers that were sufficiently prevalent in ReasonLabs’ data to be measured individually.
This makes fraud harder to stop. Trusted platforms can host thousands of customer accounts, websites, storage buckets, or email identities at once. Fraud operators take advantage of that scale to hide among legitimate users, making malicious activity more difficult to identify and remove.
The rapid turnover of these accounts also makes enforcement even more difficult. On cloud-storage platforms, the average malicious bucket in ReasonLabs’ data was observed barely more than once before being abandoned. The trusted platform remained unchanged, while the malicious account or storage bucket could be created, used, and discarded within a very short period of time. Blocking an entire platform or parent domain would disrupt substantial legitimate activity, while blocking an individual malicious account removes only an asset that can be replaced almost immediately. As a result, disrupting individual indicators, while necessary, is rarely sufficient to keep pace with fraud infrastructure that can be recreated almost instantly.
Even identifying that infrastructure is challenging because no single organization sees the entire fraud ecosystem. Each different provider sees only a small piece of a campaign, making it difficult to recognize the broader operation. As one industry report explains, “One carrier may see unusual voice traffic patterns. Another may identify suspicious messaging activity. A third may observe abuse associated with a particular customer, use case, or traffic source. Individually, these observations may appear isolated. The challenge is that the industry often lacks efficient mechanisms to connect those dots.”[24] As a result, fraud campaigns that span multiple platforms and service providers can evade detection even when each provider independently identifies suspicious activity.
Visibility is further limited by the way many digital services are designed. Privacy-by-design architectures often prevent technology companies from inspecting message contents or monitoring user activity, leaving providers unable to determine whether abuse is occurring on their networks.
Recent reporting illustrates this challenge. An analysis of more than 200,000 device connections originating from four scam compounds linked to sanctioned entities in Myanmar found that one in five signals was carried by a U.S.-registered company.[25] The findings reinforce a broader trend: fraud operators concentrate their activities on trusted, widely used digital infrastructure because it provides scale, reach, and access to potential victims. As a result, these services are also the most effective place to disrupt fraud but doing so requires targeted action against malicious accounts and services rather than the platforms themselves.
This does not mean that legitimate platforms are responsible for every instance of abuse occurring through their services. Rather, it reflects the reality that the repeated exploitation of shared infrastructure has become a systemic feature of fraud. Both government and industry should therefore focus on making infrastructure more resistant to repeated abuse while preserving the legitimate services on which consumers and businesses depend.
VII. Fraud Demographics
The same ecosystem that makes fraud more scalable also makes it easier to target specific people. Fraud operators do not send the same scams to everyone. Instead, they use available information to identify the people who are most likely to respond to a particular scam or suffer the greatest financial harm. Information such as a person’s age, financial situation, purchasing behavior, health needs, and commercially available information increasingly determines which scams they encounter and how those scams are tailored to them.
One group that is particularly affected is older Americans.
ReasonLabs observed fraud campaigns deliberately designed for older adults. Because many older Americans have accumulated retirement savings and home equity, and regularly interact with Medicare, Social Security, and government benefit programs, fraud operators tailor scams to exploit those trusted relationships. They also take advantage of life circumstances common among older adults, such as retirement, the loss of a spouse, or living alone.
The timing of these scams is often carefully calibrated. Rather than presenting random opportunities, many messages often coincide with legitimate government or financial events to make the fraud seem more credible. ReasonLabs data shows that Medicare fraud is a clear example: roughly 60-70% of annual Medicare-related scam activity occurs during the October-December enrollment window. Fraud operators align their campaigns with the enrollment calendar because older adults are genuinely expecting communications about their coverage, making fraudulent messages appear more authentic.
When fraud succeeds against older adults, the financial consequences can be significant and difficult to recover from. Government reporting highlights the scale of this harm. According to the FTC, the median reported fraud loss increases with age, reaching approximately $1,650 among adults eighty and older. “Among older-adult loss reports, the relatively small share involving losses greater than $100,000 accounts for roughly two-thirds of all reported losses among that population.
Reported fraud losses among Americans 60 and older have also increased dramatically, rising from approximately $600 million in 2020 to $2.4 billion in 2024.”[26] The FTC attributes much of this increase to reports involving losses greater than $100,000, often resulting from investment scams, romance scams, and impersonation schemes. FBI complaint data similarly places reported losses among Americans aged 60 and older substantially higher, at approximately $7.7 billion in 2025.[27]
These figures are alarming, but they likely understate the problem’s true scope. Many older adults never report fraud because of embarrassment, fear of losing their financial independence, cognitive decline, or because they never realize they were victimized in the first place. For many victims, the harm extends beyond financial loss.
One recent victim—a San Francisco retiree—believed he had found companionship after meeting a woman online. She promised they would build a new life together in Hawaii, sent him photos, spoke about caring for him, and gradually persuaded him to invest in cryptocurrency. Despite repeated warnings from his son, friends, his bank, and law enforcement, he remained convinced the relationship was genuine. The retiree pushed back, reminding his family that he volunteered at the Institute on Aging in San Francisco, where he played piano for seniors and staffed a hotline helping older adults combat loneliness and recognize scams. He believed he would recognize a scam if he saw one.
By the time he realized he had been deceived, he had wired away more than $500,000. Looking back, he admitted he became so consumed by the relationship that he was “ready to do anything.”[28] The scam not only emptied his life savings but also strained his relationship with his son.
This case is just one of many. It highlights that fraud can leave lasting financial, emotional, and social consequences that often cannot be reversed. As fraud operators use consumer data and technology to identify and target specific populations, effective consumer protection should be informed not only by the number of reported fraud incidents, but also by who is targeted and how. Prevention strategies should prioritize reducing consumers’ exposure to fraudulent communications before they engage. A prevention-first framework should therefore incorporate demographic and behavioral trends into risk assessments, consumer protections, and performance metrics.
VIII. Recommendations
These recommendations urge a shift to a prevention-first approach to fraud. This requires multiple layers of protection, each designed to create friction in the fraud lifecycle and reduce the likelihood that fraudulent schemes reach consumers.
- Strengthen Cybersecurity and Authentication
Government and industry should strengthen cybersecurity and authentication practices that make it harder for fraudsters to access sensitive information, compromise accounts, impersonate trusted entities, and misuse services to facilitate fraud.
Companies should build appropriate security and authentication safeguards into systems that hold sensitive consumer information or provide access to consumers. Those safeguards should include, at a minimum, multi-factor authentication, stronger account-verification procedures, and mechanisms for authenticating communications that claim to come from trusted organizations.
Government policy should reinforce those protections. They should mandate strong cybersecurity controls to the greatest extent possible. However, it is important to note that while expanding access to data can create benefits, it can also create additional points of vulnerability. With more entities holding sensitive data, it becomes easier for attackers to breach systems and weaponize data at scale. If obtained, foreign adversaries can use access to bulk sensitive data to track and build profiles on specific individuals, including for illicit purposes such as blackmail or espionage.[29]
Where sensitive consumer data is shared, appropriate authentication, security, access controls, and accountability should accompany it. The objective is not to restrict legitimate data sharing but to ensure that policies expanding access to consumer information do not inadvertently make that information easier for fraudsters to obtain and exploit.
- Establish Best Practices for Preventing Fraudulent Use of Digital Infrastructure
Policymakers should work with technology companies, cybersecurity providers, communications providers, and other relevant stakeholders to establish industry best practices for preventing digital infrastructure from being used to facilitate consumer fraud.
These practices should address known fraudulent infrastructure, patterns of repeat abuse, high-confidence fraud indicators, and the rapid replacement of domains, websites, accounts, and other infrastructure after disruption. Cybersecurity providers should have mechanisms in place to act on reliable fraud indicators before consumers are exposed. This may include using continuously updated threat intelligence systems and protective Domain Name System (DNS) services that restrict or warn against access to known malicious or fraudulent domains.
Providers should also prioritize prevention efforts during known periods of increased fraud activity, such as benefit-enrollment periods and tax season.
Not all fraud infrastructure, however, is created or controlled by fraud operators. In many cases, operators instead exploit compromised websites, hijacked email accounts, and other legitimate services taken over without the owner’s knowledge. In these situations, the infrastructure itself is not malicious—the legitimate owner is also a victim. As a result, the appropriate response should depend on how the infrastructure is being misused rather than applying the same remedy in every case.
For that reason, the framework should establish a common expectation that providers take reasonable action within their area of responsibility while allowing flexibility based on their role, capabilities, and visibility into fraudulent activity. For example, a domain registrar may suspend domains associated with repeated fraudulent activity, while a cloud hosting provider may remove phishing websites or terminate accounts used to repeatedly host fraudulent content. It should also include safeguards to minimize false positives and provide mechanisms for the rapid review and correction of mistakes. For example, if a legitimate website, domain, or account is mistakenly identified as fraudulent, providers should have a clear process for reviewing the decision and restoring access without unnecessary delay.
- Create a Cross-Sector Information Sharing Hub
Policymakers should establish a cross-sector hub for sharing information across the fraud ecosystem. This should allow organizations to share indicators associated with fraudulent activity, including malicious domains, sender addresses, phone-number pools, and patterns or attributes linked to fraudulent campaigns, so that information identified by one organization can help others recognize and disrupt related activity. The mechanism should also include consumer-side observations that can identify fraud as it reaches consumers and spot activity that stakeholders in the ecosystem may not see.
Policymakers should provide appropriate liability protections for organizations that share fraud information in good faith, while putting safeguards in place to protect consumer information.
- Technology Needs to Be Part of the Solution
With increased fraud sophistication, it is no longer possible for consumers to identify on their own. Technology can fill that gap and provide an additional layer of protection.
Consumer platform Mozo, for example, uses technology to identify and proactively block scams before the first user click, stopping fraud before it reaches the consumer.
Mozo can detect malicious campaigns across email, text messaging, social media, online advertising, and the web, identifying fraud as it emerges rather than after consumers have already suffered losses. The platform tracks hundreds of active scam campaigns and maintains millions of fraud indicators, including malicious domains, email addresses, phone numbers, and advertiser profiles used by fraud operators. It helps protect consumers by blocking access to fraud and scams where the channel allows and alerting the user where it does not.
Policymakers should establish a baseline expectation that widely used consumer technologies incorporate capabilities to detect suspicious messages and links, identify likely impersonation attempts, and warn users before they interact with known fraudulent content. They should also support policies that enable organizations to educate consumers about fraud and scam risks.
- Make Prevention a Consumer-Protection Performance Metric
Government agencies should measure the effectiveness of prevention. Currently most reporting mechanisms focus on complaints, losses, recoveries, and enforcement mechanisms. This data is important for understanding the scope and consequences of consumer fraud. But they primarily capture activity after a campaign has reached consumers and don’t measure whether and how prevention efforts are functioning.
A focused set of standardized prevention metrics could include:
Median time from detection to disruption of malicious infrastructure Lifespan of confirmed fraudulent domains and websites Percentage of significant campaigns detected before the first consumer complaint Recurrence of infrastructure associated with previously disrupted campaigns or operators How defensive interventions can prevent consumer exposure, when it can be reliably measured Exposure among high-risk populations and campaign volume during known targeting windows
Each would be an important metric that could be used to make prevention measures even better. Ultimately, success should be measured not only by how the government and industry respond after fraud occurs, but also by whether fraudulent campaigns are being disrupted earlier and reaching fewer consumers.
IX. Conclusion
Consumer fraud has evolved into a sophisticated, interconnected digital ecosystem. It is fueled by consumer data, accelerated by AI, and sustained by digital infrastructure. These factors have fundamentally changed the economics of fraud, making campaigns cheaper to launch, easier to personalize, and more difficult to disrupt. Yet public policy still largely measures success by what happens after fraud occurs — how quickly schemes are investigated, bad actors are pursued, and losses are addressed. As fraud continues to evolve, consumer protection must evolve with it.
While investigation, enforcement, and victim recovery remain essential, they occur after consumers have been exposed to fraud. A more effective strategy is to intervene earlier, look beyond individual scams, and focus on the systems that enable fraud to flourish.
No single policy or technology will eliminate fraud. But policymakers, technology companies, financial institutions, cybersecurity providers, and consumer protection organizations all have a role to play in making fraud more difficult to conduct. Ultimately, success should be measured not only by how effectively we respond to fraud, but by how effectively we prevent it.
Endnotes
Federal Bureau of Investigation (FBI), Cryptocurrency and AI Scams Bilk Americans of Billions, https://www.fbi.gov/news/press-releases/cryptocurrency-and-ai-scams-bilk-americans-of-billions. Federal Trade Commission (FTC), FTC Data Show People Reported Losing $3.5 Billion to Imposter Scams, https://www.ftc.gov/news-events/news/press-releases/2026/06/ftc-data-show-people-reported-losing-3-point-5-billion-imposter-scams-2025. Consumer Federation of America, The Scam Economy: The True Cost of Online Scams and Crimes in America, Mar. 11, 2026, https://consumerfed.org/news/reports/the-scam-economy/. Supra note 1. Supra note 2. Supra note 3. Joe Barrett, The Jury Duty Scam That Cost This Family $25,000, Wall Street Journal (Aug. 9, 2026), https://www.wsj.com/us-news/the-jury-duty-scam-that-cost-this-family-25-000-5629f703. See, e.g., FBI Internet Crime Complaint Center (IC3), (“Investment Fraud lures someone with promises of low- or no-risk investments that turn out to be non-existent. Typically, bad actors will entice potential investors by describing returns in amounts that are clearly too good to be true. There is no such thing as a guaranteed return on investment. Fraudulent investments include, but are not limited to, real estate, penny stocks, Ponzi and pyramid schemes, digital assets, and cryptocurrency.”) See, e.g. FTC, (“Scammers advertise jobs the same way honest employers do — online (in ads, on job sites, and social media), in newspapers, and sometimes on TV and radio. They promise you a job, but what they want is your money and your personal information.”) See, e.g., FBI, (“In romance scams, a criminal uses a fake online identity to gain a victim’s affection and trust. The scammer then uses the illusion of a romantic or close relationship to manipulate and/or steal from the victim.) See, e.g. FTC, (“Scammers pretend to be from government agencies like the FTC, Social Security Administration, and IRS — or say they’re calling about your Medicare benefits. They contact you and say that, if you don’t pay or give them your personal information, something bad will happen. Or maybe you’ll miss out on some government benefit.”) For purposes of this paper, the fraud ecosystem consists of the interconnected technologies, commercial intermediaries, data markets, communications channels, financial infrastructure, and criminal actors that collectively enable fraud to operate at scale. Mark Button, Michael Levi, Cassandra Cross, Cassandra Hock & Michael Lazarus, The Global Scamming Ecosystem, Int’l J. L. Crime & Just. (2026), https://doi.org/10.1016/j.ijlcj.2026.100837. U.N. Off. on Drugs & Crime, Organized Fraud: Issue Paper (2024), at 42, https://www.unodc.org/documents/organized-crime/Publications/IssuePaperFraud-eBook.pdf. See, e.g., FTC v. Sequoia One, LLC (documenting the sale of sensitive consumer lead data directly to scam operations), https://www.ftc.gov/news-events/news/press-releases/2016/11/ftc-puts-end-data-broker-operation-helped-scam-more-7-million-consumersaccounts. U.S. Dep’t of Justice, Office of Pub. Affs., Marketing Company Agrees to Pay $150 Million for Facilitating Elder Fraud Schemes (Jan. 27, 2021), https://www.justice.gov/archives/opa/pr/marketing-company-agrees-pay-150-million-facilitating-elder-fraud-schemes. U.S. Cong. Joint Econ. Comm. Minority, Opt-Out Obstacles: Concerning Practices by Registered Data Brokers and the Multi-Billion-Dollar Cost of Breaches (Feb. 27, 2026), https://www.jec.senate.gov/public/_cache/files/7f821956-d826-4241-8196-be987cc1f06c/2026-02-27-jec-data-brokersreport-final.pdf. Criminals Use Generative Artificial Intelligence to Facilitate Financial Fraud, FBI Internet Crime Complaint Ctr. (Dec. 3, 2024), https://www.ic3.gov/PSA/2024/PSA241203. Generative AI is expected to magnify the risk of deepfakes and other fraud in banking, https://www.deloitte.com/us/en/insights/industry/financial-services/deepfake-banking-fraud-risk-on-the-rise.html. Lana Swartz, Alice E. Marwick & Kate Larson, ScamGPT: GenAI and the Automation of Fraud: A Primer 6 (2025), https://iawd-assets.sfo3.digitaloceanspaces.com/01JWGYYXBZBRENZG7QV8JFA267.pdf. Id. Europol, Online Fraud Schemes: A Web of Deceit (2023), at 5, https://www.europol.europa.eu/cms/sites/default/files/documents/SpotlightReport_Online-fraud-schemes.pdf. HUMAN Security, When Fraud Becomes a Subscription: How AI Is Commoditizing the Scam Economy (May 15, 2025), https://www.humansecurity.com/learn/blog/when-fraud-becomes-a-subscription-how-ai-is-commoditizing-the-scam-economy/. Katia Gonzalez, Fighting Fraud Requires More Than Better Detection, i3Forum (July 20, 2026), https://i3forum.org/blog/2026/07/20/fighting-fraud-requires-more-than-better-detection/. Erika Kinetz, Takeaways from AP/FRONTLINE Investigation into How U.S. Tech Is Abused for Global Scams, Associated Press (June 30, 2026), https://apnews.com/article/46553cd53a3daee8ab30e7cac7e12985. FTC, Protecting Older Consumers 2024–2025: A Report of the Federal Trade Commission 13–15 (2025), https://www.ftc.gov/system/files/ftc_gov/pdf/P144400-OlderAdultsReportDec2025.pdf. FBI, Internet Crime Complaint Center, 2025 Internet Crime Report (2026), at 4, https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf. Stephanie Sierra & Renee Koury, SF Retiree Loses $500K Life Savings to Pig Butcher Scam Despite Warnings from Family, Friends, ABC7 News (Feb. 19, 2026), https://abc7news.com/amp/post/7-side-bay-area-retiree-ignores-warnings-wires-500k-life-savings-fake-woman-pig-butcher-scam/18613588/. See Preventing Access to U.S. Sensitive Personal Data and Government-Related Data by Countries of Concern or Covered Persons, 90 Fed. Reg. 1636, 1637–38 (Jan. 8, 2025); see also Department of Justice, Data Security Program: Implementation and Enforcement Policy Through July 8, 2025 (Apr. 11, 2025), https://www.justice.gov/opa/media/1396346/dl?inline.
