Welcome to the May 2026 issue of Incognito, your monthly dive into privacy and security with DeleteMe.
This month:
- The $20 Billion Cost of Scams: Consumers lost more money to scams this year than ever before by a wide margin. This month we talk about defense: how to stay vigilant, monitor your online vulnerability, and avoid getting got.
- Human Trafficking and Scam Compounds: The scam economy is built on a devastating system of human trafficking. Listen to part one, part two, and part three of our series “Asian Scam Compounds” on our podcast What the Hack!
- Deepfakes are Getting Real: We like to think we’re too sharp to fall for a deepfake. But then we did. Can you tell a deepfake from the real thing? Most can’t, as Neil DuPaul’s experiment revealed. Read the blog post.
- Essential Reading: Age verification goes super pop creepy, a major location tracking case is up before the Supreme Court, Maryland strikes back against surveillance pricing, and Alabama joins the privacy fight.
- Q&A: What can you do about scam trafficking?
- DeleteMe News: Sign up for our upcoming webinar: The FBI Spyhunter’s Guide to Defeating AI-Powered Deepfakes on Tuesday, May 12, 2026 | 1:30 PM ET. We hope to see you there!
- Join DeleteMe at Black Hat x DEFCON: We want to meet you at the event! Express your interest here.
The Scam Economy is Thriving
It’s losses across the board for U.S. consumers when it comes to scams and fraud in 2025, according to the recent IC3 report.
Cybercrime cost Americans $20 billion in 2025, compared to $16.6 billion in 2024.
Cybercriminals show zero signs of slowing down. And with $20 billion funneled into the scam economy to fuel even more attacks, why would they? Complaints to the IC3 topped one million. Most scams go unreported, but that is starting to change.
Reporting a scam feels pointless when you’re the one who just got burned. It isn’t. Every complaint filed with the IC3 becomes data, and data is one of the few things that actually works against the scam economy.
Banks use it to flag and block fraudulent transactions before they clear. Federal agencies stack related complaints into prosecutable cases. NGOs use trend information to build resources for victims. And when enough reports point to the same source, enforcement agencies can sometimes trace the whole operation back to its origin and shut it down.
The scam economy runs better when you keep quiet. It thrives on anonymity. Reporting is how you take that away. If it happened to you, report it.
Another takeaway from the report worth noting is that older adults reported a significantly higher number of scams compared to younger demographics. The IC3 report breaks up scam complaints by age: the 60+ bracket reported over two hundred thousand scams, while the next most-targeted group reported 167,066. The AARP Fraud Watch Network is a fantastic resource for older adults looking to avoid scams or recover after being targeted.
No surprise in this report when it comes to phishing. It remains the most common threat, occurring more than twice as often as any other exploit. Most phishing incidents are not reported to the IC3, which means the actual number is much higher. Data brokers facilitate phishing by making personal information available to anyone, so these numbers aren’t likely to go down any time soon.
While phishing scams are prevalent, investment scams cost more than $8 billion during the studied period. Crypto scams led the way–-often called pig butchering. These long cons provide targets with fake apps that show increasing investment wins till they go all in, sometimes costing people their life savings and more. These scams often begin with a “wrong-number” text that turns into a romantic conversation.
Delete wrong-number texts and stop giving your phone number out on every form and website that asks for it. You might also want to try DeleteMe’s masked phone number functionality.
The Scam Economy and Human Trafficking
The “wrong number” text may be the first step in a crypto scam, but it’s also an indicator of a long-hidden human cost that underpins the scam economy.
Many of the people sending those messages are not willing criminals but victims of a human trafficking pipeline. Promised legitimate data entry jobs, thousands of people are lured to Southeast Asia, only to be kidnapped, stripped of their passports, and forced to work 14 or 20-hour shifts in fortified compounds under the threat of torture.
In a recent three-part series, What the Hack took listeners inside the compounds. Part One covers how they operate. Part Two follows the money trail. Part three is the one place you’ll hear the story of the people inside those compounds targeting people.
Small Q is a Ugandan musician who accepted a job offer that was supposed to give his family a better life. Instead he was imprisoned in a dark room, no food, no light; the reason: he refused to scam people. He was able to escape after he managed to steal one of the phones that the compound used to scam people and contacted his family.
A $10,000 ransom was paid, and Small Q was reunited with his family.
Every successful scam puts more money into that system. Listen to the series and share it.
Listen to part one, part two, and part three of our series “Asian Scam Compounds” on our podcast What the Hack! and read the blog post.
Deepfakes are Getting Real
Financial grooming isn’t the only noteworthy trend in the IC3 report. For the first time, the report included AI-related complaints, which are becoming increasingly common.
Can you tell a real person from an AI-generated deepfake of them? Most people think they can, but when put to the test the results are not great. In one study, less than one percent succeeded in identifying deepfakes.
Always on the prowl for ways to communicate the dangers we all face, DeleteMe’s own Neil DuPaul posted about his upcoming trip to the RSA conference on LinkedIn, challenging his network to find the one thing in the post that was AI-generated.
The result? Out of thousands of views, only one person—someone who happens to be a close colleague and a cyber expert—called out the headshot as a deepfake.
It’s not surprising. The days of seven-fingered hands and fused teeth have been long replaced with flawless AI-generated images. The uneasy news here is that you will not be able to tell when you’re looking at an AI-generated image any more.
What does that mean for trust online? It’s gone. With your image and your exposed personal data in circulation, anyone can impersonate you at any time.
AI companies are here with a solution: hand over your face and your ID to prove you’re real. Not everyone is thrilled about that trade. Biometric databases get breached. Your face can’t be reset like a password. There has to be a better way than surrendering your most unique identifier just to exist with less friction online.
Here’s the other approach: Anyone who wants to impersonate you needs more than just your face. They need personal information that is all too easy to find. So add some friction. Lock down your social profiles. Get your data off broker sites. Make yourself harder to clone.
Trust online won’t come back in a day, but you can at least keep your image and online profile exploitation-free.
Recommended Reads
Age verification isn’t a silver bullet for online safety
Age verification laws are gaining momentum, but privacy experts warn the cure may be worse than the problem. Collecting biometric data and government IDs creates attractive targets for hackers, erodes online anonymity and chills free speech, all for uncertain security gains.
The Supreme Court weighs police access to cellphone location data
The Supreme Court is set to hear arguments regarding the constitutionality of “geofence” warrants, which allow law enforcement to identify every active cellphone user within a specific geographic area at the time of a crime. Privacy advocates argue that sifting through millions of accounts to find a suspect is no different than an unconstitutional general warrant.
Surveillance pricing kills the cost of living. Maryland just banned it
Maryland became the first state to pass a bill banning surveillance pricing. The practice drives up prices based on data broker profiles, facial recognition, electronic shelf tags, and other technologies and privacy violations. “Marylanders deserve to know that the price they see on the shelf is the price they will pay at the register,” said Governor Wes Moore. Now, they will.
Alabama joins the privacy fight with a new law
Alabama has officially joined the growing number of states with a consumer data privacy law. Taking effect in 2027, the Alabama Personal Data Protection Act (ALDPA) grants residents the right to access, delete, and opt out of the sale of their personal information. It specifically targets larger data handlers and requires explicit consent for sensitive data, with enforcement handled exclusively by the state Attorney General.
You Asked, We Answered
Q: What can you do about scam trafficking?
A: More than you think.
Every successful scam funnels more money into the scam compound pipeline. If you want to stop these scams at the source, there are things you can do.
- Get educated. Spend a little time each day reading up on the latest scams. Share what you learn. The AARP Fraud Watch Network is the best resource.
- Talk to the older adults and at-risk people in your life about scams. Encourage them to use extensions like the Blockparty extension to secure social media or the SeraphSecure software that Kitboga created to stop remote access tool-based scams.
- Report suspected scams. Reporting to the IC3 and other organizations can lead to stronger enforcement across the board.
- Don’t torment the scammers. It might be fun to waste their time, but it could be a human trafficking victim on the other end of that call or text.
It’s a war of attrition, and every victory helps.
DeleteMe News: Webinar Incoming!
Want to get the scoop on AI deepfakes and the data economy that makes them real threats? Join us for our upcoming webinar.
Topic: The FBI Spyhunter’s Guide to Defeating AI-Powered Deepfakes
Date: Tuesday, May 12, 2026 | 1:30 PM ET
Details: Join us for a live AMA with former FBI operative Eric O’Neill to learn how attackers use your leaked personal data to fuel the next generation of social engineering.
Register here to save your spot!
Join DeleteMe at Black Hat x DEFCON
We want to bring the privacy community together this summer! We’re currently scouting locations for a social event at the intersection of privacy and security. If you’re planning to be in Las Vegas this August, please let us know so we can finalize the details.
Back to You
Get in touch with us. We love getting emails from our readers. You can also find us on X, BlueSky, Instagram, Facebook, LinkedIn, and YouTube.
And don’t forget to share! If you know someone who might enjoy learning more about data privacy, feel free to forward them this newsletter. If you’d like to subscribe to the newsletter, use this link.
That’s it for this issue of Incognito. Stay safe, and we’ll see you next month.
Don’t have the time?
DeleteMe is our premium privacy service that removes you from more than 750 data brokers like Whitepages, Spokeo, BeenVerified, plus many more.
Save 10% on DeleteMe when you use the code BLOG10.
