Monday 12 October 2026 · 9-minute read
For years we have trained people to spot fear: the urgent invoice, the account suspension, the angry fake boss. This week's research suggests the centre of gravity has shifted. The attacks doing real damage right now dangle rewards instead: a dream job, a brand sponsorship, a seventy per cent discount, and they work because wanting something narrows our attention just as effectively as fearing something. All of this also contains a design lesson for defenders, and it closes the issue.
Job scams have tripled, and nine in ten scams now start on a phone
BioCatch has published its 2026 Global Scams report, drawing on behavioural telemetry from more than 370 financial institutions serving over 760 million customers across 21 countries. The headline that matters for our field: reported employment scam victims rose 258 per cent year on year, the sharpest increase of any scam type the company tracks. Overall attempted scams grew 35 per cent (down from 65 per cent growth the year before, so the curve is bending, not breaking), purchase scams remain the most common at roughly a third of cases, and investment scams remain the costliest at an average of $6,600 per case, nearly five times the average loss. Nine in ten reported scam sessions now begin on a mobile device.
The behavioural detail is the interesting part. Because these are authorised-push-payment style scams, the criminal never touches the account; the customer does everything. BioCatch's case work flags the tell-tale signals of a person being coached in real time: an active phone call during the banking session, remote-access software on the device, hesitation patterns around adding a new payee. BioCatch sells behavioural biometrics, so the framing serves the product, but the underlying telemetry is one of the larger windows we have into scam behaviour at scale.
What does this mean for me? The employment scam surge lands squarely on your population: job seekers, moonlighters and new joiners. If your awareness content still treats scams as something that arrives by email on a laptop, it is aimed at the wrong decade. Build the mobile moment into your scenarios, and borrow the coaching signals for your own guidance: being on a call with a stranger while moving money is now one of the most reliable red flags a person can learn.
Source: vendor research, BioCatch 2026 Global Scams report.
The sponsorship offer that steals the whole channel
ESET researchers have documented a patient, well-produced campaign targeting YouTube creators with fake brand sponsorships, impersonating names like Nike, Spotify and Hollyland. The sequence is a small masterclass in trust engineering. First, a personalised email references the creator's actual videos. Then a genuine back-and-forth negotiating rates. Only then is the target invited onto a polished "collaboration platform", complete with campaign metrics, an earnings calculator and contract tools, which pulls live public data from the victim's channel to feel bespoke. The Google sign-in request arrives last, framed innocently as verifying channel ownership. Password and one-time code entered, the attackers own Gmail, Drive and the channel; one victim described being locked out entirely after the attackers swapped her recovery details and generated fresh backup codes.
Note what is absent: no deadline, no threat, no pressure. The lure is opportunity and flattery, and the dangerous click is buried several believable steps deep.
What does this mean for me? Two things. Anyone in your organisation with a public profile, including your comms team, executives and developer advocates, is a target for this exact flattery-first pattern, so fold "unsolicited opportunity" into your VIP threat briefings alongside "unsolicited threat". And it is a reminder that the sign-in page is the moment of truth: teach people that any third-party site demanding their Google or Microsoft credentials mid-flow deserves a hard stop and a domain check, however professional everything before it looked.
Source: threat research by ESET, reported by Help Net Security.
Seventy per cent off, with a criminal watching every keystroke
Group-IB has detailed Milk Dragon, a phishing kit built around fake brand discounts seeded through ordinary Facebook and TikTok marketplace listings. Victims land on counterfeit shops impersonating 21 brands, LEGO and Calvin Klein among them, with victims recorded in 66 countries. The technical wrinkle deserves attention: a live connection streams everything typed into the payment form to the operator in real time, before the victim even presses submit. The operator can then serve a spoofed card-verification page, harvest the one-time passcode, approve a fraudulent transaction and finish with a fake order confirmation, which neatly delays the moment anyone thinks to cancel a card.
Group-IB's analysts make a point worth sitting with: where classic phishing manufactures fear (your account is suspended, you owe a fine), this operation manufactures fear of missing out. And because the lure sits in a marketplace feed the victim was already browsing, nobody feels targeted, so nobody's guard goes up.
What does this mean for me? The OTP relay is the teachable core. People have internalised that codes prove who they are; far fewer understand that typing a code into the wrong page hands an attacker a live transaction. That reframing ("a one-time code is a signature, only sign on pages you navigated to yourself") belongs in your next comms cycle, ideally now, before the November shopping season gives this kit its best month of the year.
Source: threat research by Group-IB, reported by Help Net Security.
Nine tactics, one question: "Must I believe this?"
Arizona State University has published an accessible feature on the psychology of scams, based on work by Xusheng Xiao's team, who analysed more than 100,000 reports submitted to the Better Business Bureau's Scam Tracker (a US consumer-complaints database) to map persuasion tactics in use. Nine recur: authority, phantom riches, fear, liking, urgency and scarcity, pretexting, reciprocity, consistency and social proof, usually layered in combination. Readers of Cialdini will recognise the family tree, and fittingly the piece also features Thomas Talhelm, who holds ASU's Cialdini chair in social influence. His contribution is the one to quote: positive emotion, the excitement of a prize, a relationship or a windfall, degrades attention to detail just as surely as panic does. Smart people get scammed because scams target feeling, not intelligence.
The practical gem is a mindset switch drawn from the psychology of motivated reasoning: move from "Can I believe this?", which hunts for reasons to accept, to "Must I believe this?", which hunts for reasons to doubt. This is a university news feature rather than a peer-reviewed paper, so treat the framing as expert synthesis, but the tactic taxonomy comes from a genuinely large dataset.
What does this mean for me? The nine tactics are a ready-made curriculum, and crucially they are channel-agnostic: they work for email, SMS, calls and deepfakes alike, which makes them more durable training content than any single lure-of-the-month. If this week has a single takeaway for your programme, it is to train recognition of excitement as a risk state. Everyone knows to distrust fear. Almost nobody has been taught to distrust delight.
Source: university news feature, Arizona State University.
Everyone knows about passkeys. Nearly half still type passwords.
The 2026 Global State of Authentication report from Yubico and Okta surveyed 1,890 technology and security professionals across nine countries, and the gap it exposes is pure behavioural science. Familiarity with passkeys sits at 87 per cent. Yet username and password remains the single most common way respondents sign in at work, at 43 per cent. Why? Look at day one: about half of respondents were issued a username and password when they started their current role. The default handed to people at onboarding quietly becomes the habit they keep, as any behavioural economist would predict. The report also finds comfortable optimism bias (most rate their employer as secure) while 44 per cent say their organisation suffered at least one successful AI-driven phishing attack in the past year, and only 36 per cent could pick a human-written email out of a pair when asked. Caveats apply: two authentication vendors published a survey about authentication, and it relies on self-reported perceptions rather than measured incidents. The onboarding insight stands on its own merits regardless.
What does this mean for me? Stop treating passkey adoption as an awareness problem; this data says awareness is essentially solved. It is a choice-architecture problem. The highest-leverage intervention you own is the joiner journey: if IT provisions a phishing-resistant authenticator on day one, you never have to campaign a password habit away later. Go have that conversation with whoever owns onboarding this week, if you can.
Source: vendor survey by Yubico and Okta, reported by Help Net Security.
Signing off
A week of carrots, then. The common thread is that desire is now doing the work fear used to do, in attacks and, if we are wise about defaults, in defence too. Make the secure path the one people are handed first, and habit starts working for you instead of against you. See you next Monday.