Leadership1 publisher3 min readPublished
Consumer Reports puts digital scam exposure at nine in 10 American adults
Consumer Reports polled nearly 5,000 US adults and found 90% had been targeted by a scam or cyberattack and 17% had lost money. At those rates scam exposure is a routine risk for any workforce or customer base, and one scam in five already arrives personalized.
The Board Room · Leadership desk
What happened
- Consumer Reports ran the poll in March and April for a report produced with Aspen Digital and the Global Cyber Alliance.
- Stacey Higginbotham of Consumer Reports said AI lets scammers make better use of the personal data they hold and lowers the cost of reaching more people with personalized messages.
- CBS News reported expert advice that some forms of multifactor authentication, once seen as redundant, are now essential.
- An initiative called Take9 asks people to count to nine before responding to suspicious texts or emails.
Compiled by The Board RoomSomething wrong?How this is made
Why it matters
- decision Fraud controls scoped to a few at-risk groups fit the old stereotype; at a loss rate near one adult in six, anything built this quarter has to cover every employee and customer.
- exposure A company's own breach supplies the personal details that make the next customized scam convincing, so its data security now bears on how much its customers lose to fraud.
- precedent Consumer Reports has set company accountability as its public bar, so firms whose data or brands feed scams should expect pressure to share losses that now land on consumers.
The two headline figures have to be read together. If the 17% who reported losing money [2] all sit inside the 90% who were targeted [1], about 19 of every 100 targeted people lost money, or roughly one in five [1]. The other four in five were reached and did not report a loss [1].
A skeptic would say that asking people whether they "encountered" a scam or cyberattack counts every junk text, so the 90% measures inbox noise [1]. In my view the loss figure answers that. A rate of about one adult in six [2] is high enough to show up in any workforce or customer list of a few hundred people. "People have stereotypes about who gets scammed, but it is truly everyone now, and AI is just going to accelerate that," Stacey Higginbotham, a Consumer Reports cybersecurity fellow, told CBS News [5].
The AI part of the case rests on what experts told CBS News [6]. The report as CBS describes it does not put a dollar figure on the losses or say how many came from AI-assisted messages [2]. The experts describe a fall in the cost of tailoring a message. "Prior to AI, the level of effort required to personalize something was too great. You couldn't personalize 50 phishing messages; it was too much work," Colin Ferris, a cybersecurity expert at Silverfort, told CBS News [8].
The risk splits by timing. If one scam in five carries some customization [7], four in five do not [3]. Those generic messages are what phishing awareness was built for, and it still applies to most of this quarter's volume [3]. The customized share is the part expected to grow quickly [7]. CBS describes how someone wary of misspelled emails and suspicious links can still fall for an AI-enabled scam that uses deepfake technology [9].
Higginbotham ties that growth to the supply of stolen data. "More data breaches mean there's more personal information out there, and AI makes it easy to craft personalized messages," she said [11]. With a physical address taken in a breach, a scammer could pose as a financial institution and offer a tempting mortgage rate, according to the CBS account [10].
The trade-off is between controls placed at the person, such as authentication and a pause before clicking [12][13], and controls placed upstream. Brian Cute, president and CEO of the Global Cyber Alliance, said personal precautions "alone can't stop the abuse coming from upstream via insecure routing and maliciously registered domain names" [14]. Phil Radford, president and CEO of Consumer Reports, put the rest on institutions. "AI is making fraud faster, cheaper and more personal, and no one can outsmart that alone. Companies need to be held accountable. Governments need real guardrails," he said in a statement [15].
What to watch
- Whether Consumer Reports or its partners publish dollar losses or a breakdown by scam type, which would show how much of the 17% traces to personalized, AI-assisted messages.
- Whether later surveys show the customized share of scams moving well above Higginbotham's current one in five.
- Whether Radford's call for company accountability turns into specific proposals on liability for breaches whose data feeds scams.