Phone scams: why texts, AI voice calls, and QR codes are risky

Malwarebytes reports scammers are shifting tactics to exploit the phone in several ways, including text messages, synthetic voice calls, and QR codes. Their report says consumers reported $470 million in losses to text scams in 2024 and that AI-made audio and video are making fraud harder to recognise.

Those trends matter because phones are where many people now expect to get quick, trusted messages. Malwarebytes notes several drivers behind the rise: texting is more common than voice or email, text message open rates can be much higher than email, and AI tools make impersonation easier. The report also cites industry findings that vishing, or voice phishing, has risen sharply, and that many people say it is increasingly difficult to tell scams from genuine requests.

Why phone scams are working

Malwarebytes lays out a few reasons scammers are getting more returns on phone-based attacks. First, text messages reach people where they are: the report points to estimates that text open rates can be far higher than email, which makes texts attractive for criminals trying to get quick responses. Second, AI is making impersonation more convincing. Malwarebytes reports that voice cloning has been used against adults, and that vishing doubled in the first half of 2026 according to CrowdStrike as cited in the report.

Third, people report growing difficulty telling fake content from real: a large share of respondents in Malwarebytes' survey said convincing video evidence and other media no longer feel like rock-solid proof. That erosion of trust cuts both ways: it can make legitimate outreach harder to validate, and it makes social pressure and urgency more effective for scammers.

Phone scams to watch

Malwarebytes highlights forms of phone fraud to watch for:

• Text scams that ask for payment or personal information in an unsolicited message, often with urgent language.
• AI-synthesized voice calls that imitate a family member, colleague, or company representative.
• QR code scams where a fake or tampered QR overlay sends a phone to a malicious site.
• Links in texts and social posts that use misspellings or unfamiliar domains to trick users into handing over credentials or installing malware.

Each of these relies on speed and pressure. The common thread is social engineering: get the target to act quickly without checking a second channel.

Five ways to protect your phone

Malwarebytes recommends five practical actions you can use right away:

• Treat unexpected texts and social posts with suspicion. If a message asks for payment or personal details, go to the organisation's official website or app instead of replying or tapping links. If it involves someone you know, contact that person using a number you already have.
• Keep your phone operating system up to date. Malwarebytes' threat research notes a rise in Android malware detections and says automatic updates on both major platforms reduce exposure to threats.
• Protect your accounts with strong, unique passwords and a password manager. Where possible, use passkeys or device-based sign-ins and enable two-factor authentication for every app that supports it.
• Be skeptical of voice calls, even from people you know. Malwarebytes suggests agreeing on a private code word with family or friends for emergencies. If you doubt a caller's identity, hang up and call back on a trusted number you already have.
• Check links and QR codes before you tap. Look for misspellings or unfamiliar domains, and watch public QR codes for signs of tampering. Malwarebytes points to government and FBI alerts about attackers using QR codes in targeted campaigns.

What small businesses and nonprofits should do now

These phone-based tactics are relevant to organizations of every size because scams often start with routine communication. For small teams, the immediate steps are straightforward and low-cost: make sure staff phones and company devices install updates automatically; require two-factor authentication where available; promote a simple verification habit for any request for money, credentials, or sensitive data; and use password managers or passkeys to reduce password reuse.

Train staff on the specific scams Malwarebytes calls out: suspicious texts, AI-synthesized voice calls, and QR code tampering. Use a short, repeatable rule for verification, for example "hang up and call back on a known number" or "ask for the private code word." Reinforce the rule with a short written checklist everyone can carry on a device.

If your organization sends texts to customers or clients, review those workflows. Don't ask for payment or sensitive data through unsolicited text messages. Direct recipients to authenticated channels such as your official website or app when you need information or payment.

If you want to understand how exposed your organization's web presence might make scams easier, see what an attacker can already learn about your site on our security page: /security.html.

Final take

Malwarebytes' recent report shows phone scams are evolving quickly because the channel is effective and AI tools let attackers impersonate people more convincingly. The good news is the practical defenses are simple: slow down, verify, update, and make account access harder for attackers. Those steps cut risk for staff, customers, and the organizations you serve.