Welcome to the August 2026 issue of Incognito, your monthly privacy and security deep dive with DeleteMe.
This month:
- Back to School: It’s time for unpaid tuition and scholarship scams, college housing skulduggery, and more. We tell you what you need to know.
- Children in the Crosshairs: On our podcast “What the Hack,” a stalking situation gets out of hand. Blogger Cathy Holman not only finds justice for her daughter, but also helps get a new law passed in Wyoming to protect others like her. Listen here.
- DeleteMe and Permission Slip: Permission Slip is now DeleteMe, Consumer Report’s award-winning privacy tool. Here’s what that means for you.
- Recommended Reads: The first “rogue AI” hack hits Hugging Face; AI tools infer a lot from very little data; school AI adoption explodes as policies lag; New Jersey follows California to create a data broker registry.
- Q&A: How can you protect your child against online threats?
- Join DeleteMe at Black Hat. We want to see you! Connect with us.
Back to School: Now with New Risks!
As the school year nears, scammers ramp up. You’ve probably seen some version of these attacks before, but now around 12% of them come with AI deepfakes, according to a new report from Gallup and the Stop Scams Alliance. It’s harder to tell true from false, and it’s much harder to stay safe online. Watch out for these old scams with an AI twist.
1. Unpaid tuition
Maybe your child is in private school. Maybe you’re in college.
Either could generate a call from someone claiming to be a school administrator about unpaid tuition. The caller will either direct you to a web portal that looks just like your school website, or they’ll ask for your payment info right on the call.
Don’t fall for it. The scammer, who may even have the voice of an actual school administrator thanks to voice deepfake technology, will take the money and run, never to be seen again. Always end the call and, if you’re concerned, reach out to check your status.
2. Fake scholarships
You might see ads on Meta, Tiktok, or Google that offer major scholarships or grants. You could get a call or a fraudulent email that leads you to a fake website, often AI vibe-coded, but convincing enough to trick you into providing personal data and logins.
If you see one of these ads, don’t assume it’s safe because it’s coming from a recognized platform. Think before you click. Is the offer too good to be true? Is it worth the risk? Over 70% of scam ads still find their way to consumers after someone reports them.
Hover over links in emails to check the web address and watch for minor changes like an extra letter or a number. Better yet, head directly to the school website in your browser and don’t click links in emails at all. Ignore unknown callers and never share financial information over the phone, even if there’s a familiar voice on the other end.
3. Fraudulent housing
College students are particularly vulnerable to this scam. Who wouldn’t want a low-priced rental that sounds too good to be true?
If you’re under pressure to “act fast” before someone else gets the space, or if someone asks you to pay before you see the rental, back out. AI images have gotten convincing enough to show you a fake space for rent that fulfills your every need. Vibe-coded websites can offer apartments for rent and steal your money. Some of these scams are highly personalized, including your name, the school you attend, etc.
Customized scams often start with data broker-related exposure. See who is leaking your information with the help of our free scan.
4. Nonexistent products
Back to school deals show up in emails, social media ads, and texts. The only problem is the products don’t exist. AI images show textbooks, bags, and other back-to-school items, and AI websites provide a convenient way to pay. All to steal your personal info.
5. Student tax
When you get a call that claims to be from the IRS and suggests you failed to pay a “student tax” of some kind, you can know it’s a scam.
These calls often come with heavy pressure designed to keep you from thinking fast and hanging up. The caller might threaten you with arrest or other law enforcement action.
Your best bet is to hang up immediately. The IRS won’t call you. If you get a text or an email, don’t click on any links. Go directly to the IRS website instead.
If you encounter any of these five scams, you can report them to the cyber division of the FBI.
Student Safety: Online Edition
Whether you’re a concerned parent or a teacher, one thing holds true: your students are in danger.
- Data brokers sell children’s data.
- Sextortion affects 5% of middle and high school students.
- One recent study revealed that 1 in 10 teens know someone who has been the victim of AI deepfake abuse.
- Privacy laws like COPPA only protect children under 13.
- Nearly one in five teens will personally experience stalking in a given school year.
It’s a mess out there, and the latest episode of “What the Hack” zeroes in on a hyper-local story that speaks to our national crisis.
Host Beau Friedlander talked to “Prairie Wife in Heels” blogger Cathy Holman about a stalking and grooming campaign that targeted her daughter for more than a year, a case that changed two Wyoming state laws.
It started small. After a school trip, screenshots of disparaging text messages, apparently sent from Jillian’s phone, began circulating. More anonymous accounts followed, impersonating classmates, coaches, and even a teacher, spreading rumors designed to isolate Jillian from her friends and the boy she was dating.
Eventually, an email gave police what they needed to get more information from Google and a phone carrier. The person behind it all turned out to have not only stalked Jillian, but also sent texts attempting to groom Preston, Jillian’s boyfriend.
The criminal justice system had a gap that let the perpetrator down easy. In Wyoming, stalking a minor carried the same misdemeanor penalty as littering, and grooming a child wasn’t against the law at all.
Cathy decided that wasn’t going to stand. After months of advocacy, Wyoming passed two new laws: adult stalking of a minor is now a felony, and grooming is now a defined crime carrying up to ten years in prison.
There’s a lot more to the story that you can hear from the full episode of What the Hack. In the meantime, here are a few ways to help protect the students in your life:
- Talk early and often about what online safety really means. Students should know that screenshots can be faked, numbers can be spoofed, and they may not be talking to the person they think they are.
- Reduce your family’s digital footprint. Data brokers and people-search sites are often the source of the phone numbers, addresses, and family details.
- Keep the lines of communication open. Jillian was able to get through this because she trusted her parents enough to tell them what was happening.
- Report everything to law enforcement. If you’re dealing with harassment or impersonation of a student, file a police report right away.
DeleteMe Acquires Permission Slip from Consumer Reports to Expand Consumer Privacy and Data Rights Protection
Big news from the DeleteMe team! We’ve acquired Permission Slip, the award-winning consumer privacy app by Consumer Reports that helps people take even more control over their personal data.
Since its launch in 2022, Permission Slip has helped consumers submit close to 5 million removals to more than 400 companies. The platform makes it simple to ask businesses to delete accounts, stop selling personal data, and limit how information gets shared in the first place.
Data broker removal has always been at the center of what DeleteMe does, but it’s only one piece of the privacy puzzle. This deal expands DeleteMe beyond data removal into broader privacy rights management. CNet recently called us the Swiss Army Knife of data removal services, and we agree.
“Consumer privacy is at a pivotal moment,” said Rob Shavell, our CEO at DeleteMe. “As more personal information is collected, shared, and sold, consumers need simple, effective tools to protect their privacy and reclaim control of their data. Permission Slip has built an outstanding platform and community around that mission, and we’re excited to continue expanding its impact as part of DeleteMe.”
For current Permission Slip users, nothing changes right now. Accounts, subscriptions, and any pending requests carry over without interruption.
Soon, you’ll see some new features that will give people even more direct control over their personal data, whether that means keeping it out of data brokers’ hands or telling the companies that already have it to knock it off.
Want more details? Read the full announcement at joindeleteme.com/permission-slip.
Recommended Reads
“Rogue AI” Hack Hits Hugging Face
Hugging Face disclosed a breach in mid-July that was run end-to-end by an autonomous AI agent; the first attack of its kind. OpenAI later confirmed two of its most capable models were responsible for the cyberattack. The agent broke allegedly out of an isolated internal security test, stole credentials, and exploited an unknown vulnerability to access Hugging Face’s servers. Expect to see new AI regulations soon.
AI tools dream up new privacy violations by inference
Privacy experts warned AI can infer sensitive traits like sexual orientation, health status, or political beliefs from ordinary data such as app usage, search history, and location. State laws regulate what’s collected and sold but rarely cover what companies can infer, leaving marginalized groups especially exposed.
School AI adoption explodes but policies lag
AI use in schools has surged past 50% among students and teachers, but fewer than half of principals report having a district AI policy. Ohio now mandates such policies statewide, while California and Idaho are advancing bills to address gaps.
New Jersey cracks down on data brokers
New Jersey Governor Mikie Sherrill signed A5328, banning the sale of all sensitive data under the state’s new data privacy act. The law also requires data brokers and collectors who share data with brokers to register and pay annual fees up to $1.5 million. The move reflects a growing multistate trend toward tighter data broker oversight.
You Asked, We Answered
Q: How can I protect my family from sextortion and other online harms?
A: Keep the lines of communication open and reduce exposure.
Exposure = risk. Do everything you can to keep your children’s info private and out of the hands of cybercriminals and stalkers. Beware of unmonitored social media activity.
Let’s be honest: even if you remove your family’s data from broker sites and lock down your child’s social media privacy settings, there will still be some level of risk. That’s why you need to make sure your kids can come to you with anything they may encounter online.
Predators and groomers thrive on making kids scared to talk to their parents. Don’t just give your kids a lesson on how to avoid sextortion or stalking. Make certain that if it ever happens, you’re the person they come to.
For more on sextortion and online safety, visit our blog.
Join DeleteMe at Black Hat + DEF CON
We want to bring the privacy community together this summer! We’re planning a social event at the intersection of privacy and security. If you’re going to be in Las Vegas this upcoming week, please let us know so we can connect.
Back to You
Get in touch with us. We love getting emails from our readers. You can also find us on X, BlueSky, Instagram, Facebook, LinkedIn, and YouTube.
And don’t forget to share! If you know someone who might enjoy learning more about data privacy, feel free to forward them this newsletter. If you’d like to subscribe to the newsletter, use this link.
That’s it for this issue of Incognito. Stay safe, and we’ll see you next month.
Don’t have the time?
DeleteMe is our premium privacy service that removes you from more than 750 data brokers like Whitepages, Spokeo, BeenVerified, plus many more.
Save 10% on DeleteMe when you use the code BLOG10.
