Your inbox might look harmless, but cybersecurity experts say some of the most dangerous scams are hiding in plain sight. Despite awareness campaigns and sophisticated security tools, scammers are staying one step ahead, and they're using urgency, deception, and artificial intelligence to make their attacks nearly impossible to detect.
According to the FBI's Internet Crime Complaint Center's Internet Crime Report, 193,407 Americans reported falling victim to phishing and spoofing in 2024. That's a lot of victims, and experts say certain email scams are more effective than others.
Payment Due
Invoice emails make up roughly 30 percent of all phishing attempts, while payment request emails account for a similar share. Follow-up emails round out the top three categories. These aren't random attacks. Scammers may follow up with text messages or phone calls, sometimes using AI-cloned voices to impersonate trusted figures.
It's a Wonderful Time for Fake Delivery Notifications
Scammers exploit trusted brands and urgent scenarios at any time; particularly by using package delivery notifications claiming failed deliveries that need address verification. Time to hit delete on those. Don't even bother to read them. If you can report them as spam and block them, do that too. Subject lines include phrases like "action required," "reply now," or "are you available?"
You're Invited
Fake calendar invites are a newer trend linked to remote work. These scams automatically appear on your calendar and often include links disguised as Zoom meetings or software updates. Before clicking on those, be sure to verify their authenticity by calling, texting, or emailing the requestor.
How to Avoid Feeling Like a Fool
Never click links in urgent emails requesting payment or personal information. Take a minute to independently find contact information and make an inquiry that way.
Watch for emails mimicking Microsoft, Google, or DocuSign (among others) claiming your account is locked. Again, do your own independent verification. One quick way is to log into that account from a link you've bookmarked or by typing it into the address bar and find out.
Enable multi-factor authentication on all accounts. Although using a one-time code generator app, a key fob with changing codes, or a hardware key are among preferred options, SMS or email codes work better than nothing.
When in doubt, contact the company directly using official contact information - not numbers or links in the email. Most likely, you'll just be directed to the scammers.
SUBSCRIBE TO WEEKLY NEWSLETTER
