Tap, Swipe, Scam”: Mobile Fraud Explodes, Gen Z Hit Hardest by Social Engineering & Extortion

Modern smartphones have transcended their original role as mere communication tools — they have become gateways for deception and exploitation. According to the “Tap, Swipe, Scam” report by Malwarebytes, mobile fraud in 2025 has woven itself into the fabric of everyday life, with particularly devastating effects on younger generations. Surveying 1,300 users across the U.S., U.K., and DACH countries (Germany, Austria, Switzerland), the study reveals a disquieting trend: mobile threats are not only omnipresent but profoundly personal.

Nearly half of respondents report encountering fraudulent attempts daily. These threats most often masquerade as everyday communications: phishing links, spoofed websites, QR codes, deceptive search ads, and even calls from fictitious delivery services. The U.S. and U.K. see the highest levels of daily incidents — 51% and 49%, respectively — while the DACH region experiences a relatively calmer 38%, which experts attribute to stricter regulatory frameworks.

Sixty-six percent of participants admit they struggle to distinguish a scam from a legitimate request, and only 15% feel confident in their ability to identify fraud. Alarmingly, nearly one in two has already fallen victim, most often through social engineering tactics such as smishing and impersonated banking calls.

Younger generations are particularly vulnerable. Gen Z reports the highest incidence of extortion attempts — 28% of respondents from this cohort have experienced blackmail, virtual abductions, or deepfake attacks. This is twice the rate among Generation X and triple that of baby boomers.

Threats now lurk behind every click and swipe. Everyday habits — scanning QR codes, shopping on unfamiliar websites, or downloading apps in exchange for discounts — have fostered an ecosystem where a single tap may result in data loss or financial theft. A staggering 88% of users, particularly in the U.S., readily grant apps access to personal data such as camera feeds, geolocation, and contacts.

The emotional toll is equally profound. Seventy-five percent of victims report severe psychological consequences: anxiety, depression, and a loss of trust. Twenty-five percent have faced blackmail or threats, and 19% have suffered breaches of personal information. Gen Z again stands out, with one-third reporting that their intimate data had been compromised.

But the damage doesn’t stop there. Half of the victims suffered financial losses, with 15% losing money irretrievably. More than a quarter lost access to vital accounts or files, and one in five missed important messages after mistaking them for another scam attempt.

All of this unfolds in a landscape largely devoid of effective protection. Fewer than 20% of users have installed mobile antivirus software or VPNs, and only 17% report fraud to the authorities. Despite their digital fluency, Gen Z users are markedly less likely to back up their data or install updates, relying instead on built-in security features that fall short in the face of evolving threats.

The survey also highlights stark regional disparities. In DACH countries, anxiety levels are lower, yet residents more frequently implement protective measures and report fraud — a result of greater digital literacy, awareness campaigns, and regulatory oversight. In contrast, users in the U.S. and U.K. exhibit high levels of anxiety but take minimal steps to protect themselves.

Surprisingly, despite the scale of the threat, 25% of users have resigned themselves to fraud as an unavoidable consequence of digital life. While nearly two-thirds acknowledge the need for clear, accessible guidance, 44% feel overwhelmed and unsure where to begin.

The report’s authors emphasize that smartphones, now central to modern existence, have become critical points of vulnerability. The very nature of mobile interaction — haste, trust in interface design, and impulsive decision-making — has created fertile ground for malicious actors. Yet, a few simple changes — limiting data access, double-checking links, installing security apps, and keeping systems updated — could dramatically reduce exposure to these threats.