New Study by Consumer Reports reveals 9 in 10 Americans targeted by a cyberattack or digital scam attempt

Washington, DC – Consumer Reports (CR), along with Aspen Digital and the Global Cyber Alliance, released the fifth annual Consumer Cyber Readiness Report today, marking the beginning of Cybersecurity Awareness Month. This year’s report examines how American consumers view and manage their digital security while providing new insights into the rise of digital scams and fraud. 

The report draws heavily on a nationally representative CR survey of 4,682 US adults conducted in March and April of 2026. This survey found, among other things, that  9 in 10 American consumers have encountered at least one digital scam or cyberattack attempt and that 17% of Americans have lost money to a scam (10% permanently, 7% temporarily–in some cases, the money was recovered). 

Another nationally representative CR survey, this one of 2,082 US adults in May 2026, also revealed a significant crash in consumer confidence regarding personal data privacy: only 32% felt at least somewhat confident that their personal data (such as Social Security number, health history, and financial information) remained private, down from 48% when the same question was asked in a nationally representative survey of 2,333 US adults in May 2025. The proportion of Americans reporting they were “not confident at all” nearly doubled, from 16% to 29%.

“Nine in ten Americans have been targeted by a scam or cyberattack. That’s not a statistic, that’s almost everyone we serve,” said Phil Radford, President and CEO of Consumer Reports. “AI is making fraud faster, cheaper, and more personal, and no one can out-smart that alone. Companies need to be held accountable. Governments need real guardrails. That’s the bar we’re setting – for ourselves and for them.”

Key Findings

• Ubiquity of cyberattacks and scams: About 9 in 10 (91%) Americans have encountered at least one cyberattack attempt or digital scam, and 17% have fallen victim to one, according to CR’s nationally representative survey in March and April of 2026.
• Sharp decline in privacy confidence: Consumer confidence in personal data privacy crashed in 2026. In CR’s May 2026 nationally representative survey, only 32% felt confident their sensitive data (Social Security number, health history, financial information) remained private, down from 48% in 2025. The proportion saying they were “not confident at all” nearly doubled to 29%.
• Personalization poses risks: In an era of data breaches and AI tools, one in five consumers who had encountered any scam attempts (20%) reported that the most recent scam attempt they encountered was customized using their personal details, according to the March/April survey. This was most common with scams that began via phone calls; a third of people who said the most recent scam attempt they encountered began on the phone (32%) said it was somehow personalized to them. 
• Ability to recover financial losses: As noted, 17% of Americans in CR’s March/April 2026 survey said they had lost money to a digital scam or cyberattack. However, a little less than half of them (7% of Americans) recovered that money thanks to the payment method they used. Six in then of those who paid the scammer with a credit card (61%) said they got their money back, as did 45% of those who paid with debit cards.  Only 15% of those who paid with peer-to-peer payment services (e.g., Zelle, Venmo) said they got their money back from the peer-to-peer service, and only 5% of those who said they paid with cryptocurrency said they recovered it.
• Who should be held accountable: 29% of Americans believe platform owners (social media, messaging, and sales platforms) carry the primary responsibility for stopping digital scams, according to CR’s nationally representative March/April 2026 survey, followed by the federal government at 18%; individual consumers at 16%; and financial companies at 14%. 
• How consumers are staying safe: CR’s nationally representative March/April 2026 survey shows that consumers are attempting to protect themselves through actions like inspecting links in texts and emails before clicking (69%), using multi-factor authentication (60%), and turning on automatic software updates (48%), among other things.  

“When nearly every American is being targeted online, the status quo on frauds and scams prevention is clearly broken,” Konstanze Frischen, acting Executive Director of Aspen Digital. “This year’s report shows that consumers are fighting back, but they shouldn’t have to fight alone. We need solutions that span across industry, civil society, philanthropy, and government to stop these attacks from continuing to hurt communities across the country.”

“It’s moderately encouraging that many people are using some type of multifactor authentication (60%) and strong passwords (44%). We need those numbers to keep increasing. But the report’s statistics point to something bigger: personal precautions alone can’t stop the abuse coming from upstream via insecure routing and maliciously registered domain names. Closing those gaps takes industry, government, and philanthropy working together, and that collaboration is as essential to a safer Internet as any password or security patch,” said Brian Cute, President and CEO of the Global Cyber Alliance.

This study demonstrates that improving the nation’s cyber civil defense through collective behavior change is an ongoing challenge and one that is being addressed. Through a commitment by Craig Newmark Philanthropies, initiatives like Take9 are doubling down their efforts to equip everyday Americans with the skillset to be safe online. By pausing, taking 9 seconds before you click, download and share, we can all take steps to protect ourselves. While consumers should use resources such as Take9 to improve their education and digital hygiene, governments and industry must do their part to improve the cybersecurity ecosystem. 

Businesses should enable tools such as multi-factor authentication and encourage its use along with good password hygiene and social media platforms should do more to hold scammers accountable on their platforms, while also making it easier for consumers to report scams and reach human beings when they think a scam has occurred. 

Governments have a key role to play. Enacting proposed laws such as the bipartisan SCAM Act or New York’s False Social Media Advertising Prevention Act would hold social media platforms accountable for turning their sites into a playground for scammers and make it easier for consumers to report fraudulent and scammy activity. Additionally, the Federal Trade Commission and state Attorneys General can investigate and bring enforcement actions against social media platforms under the FTC Act and state laws that already prohibit unfair and deceptive practices.

###

About Consumer Reports

Founded in 1936, CR has a mission to create a fair and just marketplace for all. Widely known for our rigorous research and testing of products and services, we also survey millions of consumers each year, report extensively on marketplace issues, and advocate for consumer rights and protections around safety as well as digital rights, financial fairness, and sustainability. CR is independent and nonprofit. 

CR has also developed technical solutions to empower people to take control of their data. 

About Aspen Digital

Aspen Digital, a program of the Aspen Institute, convenes thinkers and doers to anticipate how our world is changing in the age of AI. We find signal in the noise, elevate thoughtful ideas, and inspire collaboration across industry, government, and civil society to shape solutions that work for all. To learn more, visit aspendigital.org or email aspendigital@aspeninstitute.org.

About the Global Cyber Alliance

The Global Cyber Alliance (GCA) is a global nonprofit that makes the Internet safer by reducing widespread cyber risk. We bring together partners across sectors to strengthen the Internet’s core infrastructure and put practical cyber protections in the hands of the organizations and communities most at risk. As the threat landscape evolves at a pace unmatched in speed and scale, GCA is at the forefront, studying the problem, convening the right people and organizations, and delivering solutions that work.

Media contact: Cyrus Rassool, cyrus.rassool@consumer.org