Lewati ke konten utama
Life Security

Cari di situs

Temukan halaman dan bagian.

Common threats

Terakhir diperbarui:

Most people face the same short list of digital threats: passwords stolen in someone else’s breach, scams, companies collecting and reselling data, and records about you leaking from databases you don’t control. A few others are rarer but more severe, such as a partner spying on your phone or an attacker who has chosen you specifically.

This page describes each one, says who it affects, how common it is and what it costs when it goes wrong. Use it alongside threat modeling. The model asks which of these apply to you, and this page supplies the evidence to answer.

The figures come from the places that publish them, which lean toward the United States and toward companies that sell security products. Where we use them we say so, and where we couldn’t find global numbers we say that too.

At a glance

Threat Who it affects How common Worst case
Automated account attacks (stolen passwords, bulk phishing) Almost anyone online Very common Lost accounts, stolen money
Scams and impersonation Almost anyone Very common Large financial loss
Phone number takeover (SIM swap) People whose number guards their accounts Uncommon Account takeover, drained bank accounts
Spying by someone close to you People in controlling or abusive relationships Hard to measure Loss of safety
Targeted attacks Journalists, activists, executives, people in serious conflict Rare Exposed sources, safety risks
Company tracking and data brokers Almost everyone Near universal Profiling, exposure of sensitive places
Leaked or sold records Almost everyone Common Identity fraud, tailored scams
Mass surveillance Depends on your country Varies Loss of private communications

The “how common” column is our reading of the evidence below. It isn’t a measured probability for you.

Automated attacks on your accounts

Most account takeovers aren’t personal. In a year-long study with New York University and the University of California, San Diego, Google found that most attempts to hijack accounts came from automated bots using passwords exposed in breaches of other sites. Phishing and targeted attacks were present but less common. The bots try the same stolen email and password pairs everywhere, a technique called credential stuffing. It works because people reuse passwords. In NordPass’s 2025 survey, 62% of Americans said they often or always reuse a password. NordPass sells password managers, so treat that figure as indicative.

The same pattern shows up in company breaches. Verizon’s 2025 Data Breach Investigations Report found stolen credentials were the most common way in, at 22% of breaches, ahead of phishing at 16%. A human action such as clicking, a mistake or misuse of credentials played a part in about 60%. Those are organisations’ breaches, not personal accounts, but they show the same weak point.

Phishing is the other everyday route. A message or website imitates one you trust to get you to hand over a password or code. It was the most reported crime type to the FBI’s Internet Crime Complaint Center (IC3) in 2025, with 191,561 complaints.

The Google data also shows how much a basic second step helps against mass attacks. An SMS code sent to a recovery phone blocked all the automated bots and 96% of bulk phishing. On-device prompts blocked 100% and 99%. A unique password for each site stops credential stuffing, because a leaked password then opens nothing else. That’s our reasoning, not the study’s.

Scams

Fraud, not hacking, accounts for most of the money lost online. IC3 logged 1,008,597 complaints in 2025, with reported losses of about $20.9 billion, up 26% on 2024. It attributes about $17.7 billion of that to cyber-enabled fraud, roughly 85% by our arithmetic. Phishing drew the most complaints, but investment fraud caused the largest losses at about $8.6 billion, followed by business email compromise at about $3 billion.

The US Federal Trade Commission (FTC) sees a similar picture. It reported $15.9 billion in fraud losses for 2025, with imposter scams the most reported type and investment scams the costliest. The two agencies count differently, so don’t add their figures together. Both are US figures built from reports people chose to file. An FTC official told Congress that reported losses are only a fraction of the real total.

We couldn’t find a comparable global total. Regional numbers exist. Bangladesh Bank counted 81,423 fraud cases across mobile financial services, cheques and cards in 2025, with losses of Tk 926.01 million, most of it in mobile financial services.

Scams connect to privacy in one direct way. A caller who knows your name, your bank or your recent purchases sounds credible. A Daily Observer report on one-time password (OTP) fraud in Bangladesh notes that fraudsters often start by collecting some personal information about their target. The money is usually taken by persuading someone, not by breaking a system. No device setting stops that on its own.

Phone number takeover

A SIM swap happens when a scammer convinces your mobile provider to move your number to a SIM card they control. They then receive your calls and text codes, which lets them reset passwords and approve logins that rely on your number. The FTC lists it as a way to bypass text-message verification and take over bank, email and social accounts.

It’s rarer than phishing, but each case can be costly. The FBI’s IC3 received 1,611 SIM swap complaints in 2021, with losses above $68 million. In 2023 the US Federal Communications Commission adopted rules requiring carriers to authenticate customers before moving a number to a new device or provider. We couldn’t find a global overview of how carriers elsewhere verify these requests. The practical point is that a phone number guarding your accounts is only as safe as your carrier’s identity checks.

Someone close to you

Not every threat is a stranger. Stalkerware is software that lets someone secretly monitor another person’s phone. The Coalition Against Stalkerware was founded in 2019 by security companies, domestic violence organisations and the Electronic Frontier Foundation (EFF). It defines stalkerware as software that lets a remote user monitor a device without the owner’s consent and without clear, persistent notice, in a way that can facilitate partner surveillance, harassment, abuse or stalking.

Researchers describe it as part of domestic abuse, not just another kind of malware, which means the usual malware advice doesn’t automatically apply. For that reason the first step in this situation is safety, not software. If you think someone is monitoring your device and you could be in danger, the Coalition recommends contacting a local victim service organisation or law enforcement for safety measures. This is general information, not professional advice.

The EFF also points out a quieter version of the same threat: trusted people can expose you accidentally by being careless with their own security.

We couldn’t find a reliable figure for how many people are affected, so the table says “hard to measure” rather than guessing.

Targeted attacks

A targeted attack is aimed at you instead of at everyone. The attacker researches you and writes a convincing message, and may use details gathered from leaks. Google’s study called targeted attacks more pernicious than bots or bulk phishing, and its numbers show why. An SMS code stopped 76% of targeted attacks against 96% to 100% of the mass ones. On-device prompts stopped 90%. No user who relied only on security keys fell victim to targeted phishing during the study. That data covers Google accounts in 2019, so treat it as a pattern, not a guarantee.

Most people never face one. People who attract attention are likelier to, such as journalists, activists and executives, and so are people in serious conflict with someone determined. If that describes you, a standard checklist is a starting point, not a finish.

Companies, data brokers and leaked records

Companies collect data about you as a default, and some resell it. The FTC has alleged that three data brokers sold location data gathered through phone apps that revealed visits to places such as health clinics and places of worship. It said the practice exposed people to stigma, discrimination and violence. In a separate case against another broker, Kochava, the FTC said people are often unaware their location data is bought and sold, and have no control over it.

A message or email you store with a provider sits on that provider’s servers. The provider, or anyone who breaks into them, can read it unless it’s end-to-end encrypted. Even then, the provider can usually see metadata, such as who you contact and when.

Records held by others also leak or get sold. IC3 received 67,456 personal data breach complaints in 2025, the fourth most common type by volume. In September 2026 the Bangladeshi investigators at Dismislab reported buying national ID copies, call records and phone location from sellers advertising on Facebook and Telegram, and the data checked out. An ID copy cost Tk 500 in one test and arrived within 17 minutes. Sumon Ahmed Sabir, a technology executive quoted in the report, said such data can be used to impersonate people and open accounts in their name.

You have little control over databases other people hold. That’s why privacy rules matter, which Why privacy matters covers.

Governments and mass surveillance

Some governments, and companies working with them, monitor communications and movements at scale. Article 12 of the Universal Declaration of Human Rights says nobody should face arbitrary interference with their privacy or correspondence, but law and practice differ widely by country. The best-known documented case is the US National Security Agency’s phone records programme, revealed by Edward Snowden in 2013. The ACLU says officials later admitted the NSA had for years collected records of virtually every American’s phone calls.

Whether this threat matters to you depends heavily on where you live and what you do. We don’t go deeper here, because the right response depends on your country.

What this page leaves out

This page doesn’t cover censorship, attacks on software supply chains, ransomware against organisations, theft or loss of a device, or threats to children online. Each affects some readers heavily and needs its own page.

Sources

Pertanyaan yang sering diajukan