The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →A headline says a new report found that most banking scam attempts now happen on mobile devices. The report behind that claim is not identified in the available evidence, and the official sources reviewed do not establish that mobile devices account for most attempts. They do confirm that bank impersonation and social engineering are active fraud tactics—but their figures measure reported losses or activity within specific networks, not the share of scam attempts made on phones.
Does the evidence show that most banking scam attempts happen on mobile?
No. The claim remains unverified because its underlying report, definition of “attempts,” geography, sample and methodology are not identified. The official figures available describe different measures: consumer-reported losses in the United States, scam-related activity identified on Visa’s global payments network, and UK payment firms’ reporting on authorised push payment (APP) scams. None provides a denominator for banking scam attempts by device, so none can establish that most attempts happen on mobile.
As an Amazon Associate I earn from qualifying purchases.
That distinction matters: a phone may be the channel through which someone receives a scam text or call, while a loss may result from a payment the victim was persuaded to approve. A count of losses, reports or network activity is not automatically a count of attempted scams—and none is necessarily mobile-only.
What official sources do report
| Source and geography | Measure and period | What it does—and does not—show |
|---|---|---|
| Federal Trade Commission (FTC), United States | Consumers reported losing $3.5 billion to imposter scams in 2025; the FTC said that was nearly three times the reported amount in 2020. | Reported losses across imposter scams, not a count or share of mobile banking scam attempts. FTC, June 2026. |
| FTC, United States | Nearly $1 billion in reported losses to business impersonators in 2025; bank impersonators had the highest reported losses among business impersonators. | A reported-loss measure for business impersonation, not a mobile-attempt statistic. FTC, June 2026. |
| Visa, global payments network | Nearly $1 billion in scam-related activity identified from July to December 2025, which Visa described as the largest category of consumer payment fraud in that reporting period. | Visa network intelligence, not a national population estimate or mobile-only measure. Visa, May 20, 2026. |
| UK Payment Systems Regulator (PSR) | Reports data on APP scams from UK payment firms and banks; the page lists its latest report and reporting scope. | Firm-reported UK APP scam data, not a measure of mobile banking scam attempts. PSR performance data reports. |
These figures should not be added together or treated as corroboration of the mobile-majority claim: they cover different places, scam categories, populations and measures.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Why a phone can be part of a scam without being the whole story
The FTC describes scams that arrive through text, phone calls, email, social media, search results and other channels. In one pattern, a fake security alert appears to come from a bank and pressures someone to move money to “protect” it. The device carrying the message is only one part of the event; the reported loss can follow when the person is persuaded to make a payment.
Visa’s account likewise describes criminals impersonating trusted brands and institutions, creating urgency and deceiving people into completing payments that appear legitimate. Its finding that fraud involving device tokens declined 9.6% from July–December 2025 compared with the same period in 2024 is specific to that category and comparison period; it does not measure all mobile scams.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
India’s Ministry of Electronics and Information Technology, CERT-In, CSIRT-Fin and SISA described social engineering and credential theft as established methods in their 2025–26 BFSI threat report. The announcement says the report drew on digital forensics and incident response research, CERT-In and CSIRT-Fin observations, and adversarial AI research. It notes that attacks can appear as legitimate sessions or approved payments; that is evidence about methods, not proof that a consumer’s phone has been compromised or that most attempts occur on mobile. Press Information Bureau / MeitY, July 13, 2026.
The UK National Assessment Centre’s 2025 fraud assessment says fraud is increasingly technology-enabled and that social engineering and generative AI can help criminals scale attacks. This is UK threat context, not a mobile-device share. UK Home Office / National Assessment Centre, published March 9, 2026.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How to respond to an unexpected bank alert
Because the documented tactics rely on impersonation and pressure, focus on verifying the request rather than deciding whether the message looks polished or arrived on a phone.
- Pause before acting. Treat an unexpected alert or urgent request to move money as suspicious, especially if it says your funds are at risk or demands immediate action.
- Do not use the message’s route to verify it. Avoid replying, following its links or calling a number supplied in the alert.
- Contact the bank independently. Use a number from your bank card or its official app or website, then ask whether the alert and requested action are genuine.
- Do not move money to “protect” it. Verify any payment instruction directly with the bank before taking action.
A scammer’s message may look like a routine notification, and an approved payment can still be induced by deception. The sources reviewed describe those risks but do not establish that a particular phone accessory or security app prevents impersonation scams.
Rank #4
- HARDWARE 2FA AND MFA: FIDO Alliance Certified FIDO2 v2.1 with CTAP2 plus legacy U2F and CTAP1 for strong two-factor login and passwordless sign-in on services that support security keys
- BUILDING ACCESS ON ONE CARD: MIFARE DESFire EV2 4K applet with AES encryption adds office door and physical access control alongside digital authentication
- CERTIFIED SECURE ELEMENT: An NXP Common Criteria EAL6+ certified secure controller and Java Card platform protects your keys on a tamper-resistant chip
- DUAL INTERFACE SMART CARD: Contactless NFC ISO 14443 plus ISO 7816 contact reader support in an ISO 7810 ID-1 format that is passive and needs no battery
- SWISS ENGINEERED DESIGN: Built by Cryptnox as a single card for authentication and access control and backed by a 2 year warranty
What would be needed to verify the headline
To support “most banking scam attempts now take place on mobile devices,” a report would need to identify what counts as a banking scam attempt, how devices are classified, what region and period it covers, how attempts are counted, and whether its data represents a defined population. Without those details and an underlying denominator, the mobile-majority statement should be treated as an attributed claim—not a general fact.
Recommended Free Tools
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
