The latest scams of 2025

The threat from fraud and cybercrime keeps evolving. In 2025 several new, in some cases technologically highly advanced, types of fraud are emerging that endanger private individuals and organisations alike. Criminals increasingly use artificial intelligence, automation and new digital payment methods to deceive their victims and cause financial damage running into billions. The following article provides a comprehensive overview of the most important scams of 2025.

QR code phishing (quishing): the new trick with parcel deliveries

One of the most notable new forms of fraud in 2025 is so-called quishing, phishing via QR codes. Fraudsters send physical parcels containing a QR code to unsuspecting recipients. When scanned, the QR code leads to a deceptively genuine-looking phishing website that harvests personal data, credentials or payment information.

The insidious part of this method: the parcels look legitimate and often contain a small gift or product sample to build trust. The enclosed QR code is disguised as a registration link, warranty activation or product information. Because QR codes obscure the actual target URL, it is almost impossible for the recipient to verify the legitimacy of the link before scanning it.

In 2025 the FBI issued an official warning about this scam and recommends never scanning QR codes from unknown sources. Particular caution is required when QR codes in public places, for instance at parking meters, charging stations or in restaurants, are covered with fake stickers. This variant, also known as a QR code overlay attack, redirects the victim to fraudulent payment pages.

AI-powered fraud: deepfakes and automated scams

Artificial intelligence has fundamentally changed the fraud landscape in 2025. Deepfake technology enables criminals to create deceptively real video and audio forgeries that even trained eyes and ears can hardly distinguish from reality.

Current studies show alarming figures: around five percent of all failed identity verifications in the financial sector are now attributable to deepfake attacks. Fraudsters use AI-generated faces and voices to outwit identity verification processes, impersonate superiors in video conferences or create fake extortion videos.

Particularly worrying is the use of AI chatbots for automated fraud campaigns. These bots conduct convincing conversations by email, chat or even phone and can address thousands of potential victims simultaneously. They adapt their communication individually to each victim, use publicly available information from social media and respond to questions in real time, a quality of deception that was previously only possible with human fraudsters.

Another worrying trend is AI-generated voice clones. With just a few seconds of audio material, for example from a public talk or a voicemail, fraudsters can create an almost perfect copy of a voice. This is then used for so-called voice phishing attacks (vishing), in which the callers pose as family members, superiors or bank advisers.

Cryptocurrency fraud

The cryptocurrency market remains a favourite hunting ground for fraudsters in 2025. The decentralised nature of cryptocurrencies, the irreversibility of transactions and the limited technical understanding of many investors create ideal conditions for a wide variety of scams.

Among the most common schemes are fake tokens and coins that are placed on decentralised exchanges and promoted through coordinated social media campaigns. After a brief price rise, the fraudsters withdraw their liquidity (a so-called rug pull) and leave behind worthless tokens.

Fraudulent wallet apps imitate well-known crypto wallets and even appear in official app stores. As soon as the user enters their recovery phrase or transfers cryptocurrency to the app address, the funds are stolen. Despite tighter controls by app store operators, fraudsters repeatedly manage to circumvent these safeguards.

Fake initial coin offerings (ICOs) and token sales lure investors with promises of revolutionary technologies and guaranteed returns. Professionally designed websites, fake whitepapers and paid influencer endorsements lend these projects a deceptive legitimacy. Once enough investor money has been collected, the operators disappear.

SIM swap fraud

SIM swap fraud reached dramatic proportions in 2025. In the United Kingdom the authorities recorded an increase of more than 1,000 percent compared with previous years, a trend that is also emerging in Germany and other European countries.

In a SIM swap attack, the fraudster takes control of the victim’s mobile phone number. This typically happens through social engineering at the mobile provider: the fraudster poses as the account holder and requests that the number be transferred to a new SIM card. Alternatively, corrupt employees of mobile providers are bribed or compromised online accounts of the victim with the provider are used.

Once the number is under the fraudster’s control, all security codes sent by SMS, in particular two-factor authentication (2FA) codes, can be intercepted. This enables access to email accounts, online banking, cryptocurrency wallets and other protected services. Victims often only notice the attack when their mobile phone loses reception, and by then the damage has already been done.

To protect against SIM swap attacks, security experts recommend switching from SMS-based 2FA to app-based authentication (e.g. Google Authenticator or Authy) or hardware security keys (e.g. YubiKey). You should also set up an additional PIN or password for account changes with your mobile provider.

Romance scams

Romance scams, relationship fraud via dating platforms and social networks, are becoming ever more professional and harder to detect through the use of AI. Fraudsters use AI-generated profile pictures that cannot be traced to any real person and use deepfake technology for video calls to maintain their false identity convincingly.

The method has been refined over the years: the fraudsters build an emotional relationship over weeks or months before asking for money with fabricated emergencies such as illness, accidents or travel problems. The psychological manipulation is so effective that victims often transfer large sums despite warnings from those around them.

In 2025 a new trend is also emerging: so-called crypto romance scams, in which victims are not asked for money directly but are induced to invest in fake cryptocurrency platforms. The fraudster acts as a supposed investment adviser and initially demonstrates apparent profits to strengthen the victim’s trust before the platform disappears along with the invested capital.

Instant payment fraud

The growing spread of real-time payment systems has opened up new opportunities for fraudsters. Unlike conventional bank transfers, where transactions can sometimes still be cancelled, instant payments are completed in fractions of a second and are almost irreversible.

Fraudsters deliberately exploit this property: they push their victims into immediate transfers via real-time payment systems, for example with fake invoices with supposedly overdue payment deadlines, CEO fraud attacks with allegedly urgent transfer instructions or manipulated payment details in online purchases. The time window for detecting and preventing fraudulent transactions is minimal with instant payments, which poses new challenges for conventional fraud prevention systems.

Banks and payment service providers are working on AI-supported real-time fraud detection systems that can evaluate suspicious transactions in milliseconds. But fraudsters continuously adapt their methods to circumvent these systems, a constant race between attackers and defenders.

Brushing

Brushing is a form of e-commerce fraud that appears harmless at first glance but can have far-reaching consequences. Fraudulent merchants send unsolicited parcels to random addresses and then create fake reviews on online marketplaces in the recipient’s name. The aim is to artificially improve the ranking of their products through a large number of positive reviews.

For the recipients of the unsolicited parcels, brushing initially means that their personal data, name and address, is in the hands of third parties and is being misused. In some cases not only reviews are created under the compromised accounts, but also orders for which the victim is liable.

Particularly problematic is that brushing often serves as a precursor to further fraudulent activity: the collected data is used for identity theft, the creation of fake accounts or targeted phishing attacks. Anyone who receives unsolicited parcels should therefore check their online accounts, change passwords and report the incident to the online marketplace concerned.

Fake apps and mobile malware

Mobile devices have become a primary target for fraudsters. In 2025 the spread of fake apps and mobile malware reached new highs. Fraudulent apps disguise themselves as legitimate applications, from banking apps and VPN services to productivity tools, and appear in official app stores despite tighter controls.

These malicious apps work in various ways: some steal credentials through fake login screens (overlay attacks), others record keystrokes, access the contact list or secretly activate the camera and microphone. Particularly insidious are so-called fleeceware apps, which offer free trial periods and then charge exorbitant subscription fees that are difficult to cancel.

Another growing threat is malicious SDK libraries embedded in otherwise legitimate apps. Developers unknowingly integrate compromised software development kits that then collect data or display advertising in the background. This form of supply chain attack is particularly difficult to detect because the affected apps come from trustworthy developers.

Conclusion: vigilance and prevention as the best defence

The fraud landscape in 2025 is more diverse, more technologically sophisticated and harder to see through than ever before. The growing integration of artificial intelligence into fraudulent activity presents private individuals and organisations with new challenges. At the same time, new payment technologies and the growing digitalisation of all areas of life open up additional attack surfaces.

The following seven recommendations help to minimise personal risk:

• Treat QR codes with caution: do not scan QR codes from unknown sources. For QR codes in public spaces, check whether they may have been covered with a sticker, and use QR scanner apps that display the target URL before opening it.
• Stay critical of AI-generated content: be sceptical of video and audio calls, especially when unusual requests are made. Verify the identity of the person you are talking to via a separate communication channel.
• Strengthen two-factor authentication: use app-based or hardware-based 2FA instead of SMS-based authentication. Set up an additional PIN for account changes with your mobile provider.
• Verify financial transactions: always check payment instructions via a second communication channel, especially for unusually large amounts or under time pressure.
• Obtain software and apps only from trustworthy sources: install apps exclusively from official app stores and critically check reviews, developer information and requested permissions.
• Protect personal data: minimise the publicly available information about yourself on social media. Every piece of information can be used by fraudsters for targeted attacks.
• Keep learning: stay up to date on current scams and share this knowledge in your professional and private environment. Awareness is the first and often most effective line of defence.