Some threats are universal, they can reach almost anyone through almost any channel. Others are specific: built around a particular group, a particular platform, or a particular set of circumstances that make one kind of person a far more likely target than another. High-risk online threats cover exactly this second category.
High-risk online threats cover exactly this second category. Seniors are targeted differently than gamers. Crypto holders face a category of fraud with no recovery route. Journalists and activists face adversaries most people never encounter at all.
Understanding which category applies to you, or to someone you care about, is what makes protection genuinely useful rather than generic. This guide covers nine distinct areas, each with its own mechanism and its own specific protective steps.
This guide introduces vulnerable group targeting, gaming and dating platform exploitation, health and vehicle data exposure, smart home surveillance, workplace fraud, activist-level threats, and cryptocurrency exploitation. Each section links to a full guide with specific, practical steps.
Why Do These Nine Areas Belong in One Guide?
Each threat covered here shares a structural similarity even though the specific harm differs enormously: an attacker identifies a group or context with a specific vulnerability, then builds an approach precisely calibrated to exploit it, rather than using a generic, one-size-fits-all script.
This is why general scam awareness, while genuinely useful, is not sufficient on its own for these nine categories. A senior facing a high-trust authority scam needs different specific guidance than a crypto holder facing an irreversible wallet-draining scheme.
None of the targeting covered in this guide is random. Each pattern is documented, repeatable, and increasingly well understood, which means each one also has a specific, practical response.
Several of these categories are also newer than most general fraud advice accounts for. Connected vehicle data collection, smart home surveillance, and cryptocurrency fraud have all expanded dramatically in the past few years, faster than public awareness or regulation has kept pace with, which is exactly why they deserve dedicated coverage rather than a passing mention within broader scam guidance.
It is worth being honest about what this guide can and cannot do. It cannot eliminate targeting entirely, since attackers will keep adapting their scripts to whatever group or platform offers the highest return for the least effort. What it can do is give you the specific mechanism behind each category, which is consistently more useful than a general warning to “be careful,” since specific mechanisms are what actually let you recognise an approach before it develops fully.
A useful way to read the nine categories below is by recovery pathway rather than by industry. Workplace fraud and vulnerable-group targeting generally have at least some path back through a bank or an employer’s insurance. Cryptocurrency fraud, once funds move, typically does not. Knowing in advance which category you are dealing with changes whether the priority is fast reporting for possible recovery, or prevention, since prevention is the only real defence once recovery is off the table.
Who Faces Targeted Exploitation Because of Circumstance?
Seniors, children, immigrants, and people facing a mental health crisis or disability-related dependency are targeted through scripts specifically built around their circumstances, reduced scepticism, language barriers, isolation, rather than through generic fraud approaches.
The FBI’s IC3 2025 Annual Report found people over 60 lost $7.7 billion to fraud, a 60% increase over 2024, illustrating how systematically this specific group is being targeted at scale. Children, immigrants, and people managing a mental health crisis or disability-related dependency face equally specific, if differently structured, versions of the same underlying exploitation.
The common thread across every group in this category is isolation, not gullibility. A senior with fewer people to consult before acting, a child without adult supervision on a platform, an immigrant unfamiliar with local institutions, a person in crisis with reduced capacity to pause, share the same underlying vulnerability: fewer opportunities to verify a claim before acting on it. Protection that focuses on reducing that isolation, a person to call, a habit of checking before deciding, consistently outperforms advice focused purely on recognising warning signs.
This is also why blaming the person targeted is both unkind and inaccurate. The scripts used against these groups are refined specifically because they work reliably against careful, intelligent people placed in a particular circumstance, not because the person targeted was careless. Treating vulnerability as circumstantial rather than personal changes how family members and friends can actually help.
Family members are often the first to notice something is wrong, long before the person being targeted does. A relative suddenly guarded about a new “friend,” reluctant to discuss finances, or defensive when asked routine questions is a more reliable early signal than waiting for a specific, obviously suspicious transaction to appear.
Read the full guide: Why Scammers Target Seniors, Children and Immigrants — And How to Help
How Do Gaming Platforms and Dating Apps Create Specific Risk?
Gaming fraud rates are among the highest of any industry, at 18.59% of transactions, while dating platforms saw a 900% increase in romance scam losses in San Francisco alone in 2025, reflecting how both categories combine genuine social connection with significant financial and personal exposure.
Both environments share a common vulnerability: they are built for trust and connection first, which is precisely what account hijackers, in-game predators, catfishers, and romance scammers are built to exploit. Content creators and streamers face a related, additional risk within gaming specifically, since a visible online identity creates both a target and an amplification channel for harassment and impersonation.
What separates these platforms from a typical scam channel is the amount of time invested before the exploitation even begins. A gaming friendship or a dating match can develop over weeks before any request for money, an item trade, or personal information appears, which is precisely why the eventual ask feels like a natural continuation of an existing relationship rather than a cold approach from a stranger. Recognising that this slow build is itself the technique, not evidence of a genuine connection, is often the single most useful thing to know before engaging deeply with either kind of platform.
Read the full guides: Gaming Scams: Account Theft, In-Game Fraud and Online Predators and Dating App Safety: What the Platforms Don’t Tell You
What Do Your Health Data, Car and Smart Home Actually Expose?
A modern connected vehicle generates approximately 25GB of data per hour, while over 18 billion IoT devices now sit inside homes worldwide, each one a potential surveillance endpoint, and health apps collect some of the most sensitive, hardest-to-protect data a person generates.
None of these categories require you to do anything wrong to be exposed. The exposure comes from ordinary use of devices most people assume are simply convenient, without a clear understanding of what they collect or who else can access it. In documented cases, this data has been used for insurance discrimination, resold through data brokers, and in the case of compromised smart home accounts, used by abusers to monitor and control a partner without their knowledge.
What makes this category genuinely different from a scam is that there is usually no attacker to catch and no single moment of compromise to point to. The data collection is the business model, disclosed somewhere in a privacy policy almost nobody reads in full, which means the appropriate response is not vigilance against a threat but a deliberate decision about which conveniences are worth the specific data trade involved.
Read the full guides: Your Fitness Tracker Knows More Than Your Doctor, Your Car Is Collecting Data on You, and Smart Speakers, Security Cameras and the Home That’s Always Listening
How Are Workplaces and High-Risk Individuals Specifically Targeted?
Business email compromise cost businesses $2.8 billion in 2024 alone, requiring no technical hacking, just a convincing email and a bypassed process, while journalists and activists face a genuinely different threat model, including state-sponsored spyware documented across at least 14 EU member states.
These two categories sit at opposite ends of the same spectrum: one exploits ordinary workplace trust at scale, the other applies significant, well-resourced targeting against specific individuals because of their public role. Gig workers and content creators sit somewhere between the two, facing account takeover and impersonation risks that are financially motivated but rely on the same platform trust that workplace fraud exploits.
Scattered Spider’s 2025 attacks on M&S, Co-op, and Harrods illustrate exactly how little technical sophistication workplace fraud actually needs: a convincing phone call to an IT help desk, requesting a routine-sounding credential reset, was enough to cause M&S an estimated £300 million in lost online sales. No malware, no exploit, just a confident voice and a plausible reason to bypass a process that existed specifically to prevent this.
Read the full guides: CEO Fraud and Invoice Scams: How Criminals Target Workplaces and Journalists, Activists and High-Risk Users: How to Protect Yourself Online
Why Is Cryptocurrency Fraud in a Category of Its Own?
Crypto scams drove $8.6 billion in US losses in 2025, and a landmark $15 billion pig butchering bust the same year revealed forced labour ties to trafficking-run scam compounds in Southeast Asia. What makes crypto fraud distinct from every other category here is irreversibility: once sent, funds cannot be recovered through a bank or chargeback.
This irreversibility is why verification before sending, not recovery after the fact, has to be the entire strategy for anyone holding or investing in cryptocurrency. Every other category in this guide has at least some recovery pathway. This one largely does not.
Rug pulls and fake wallet apps compound the irreversibility problem further, since both are specifically engineered to look legitimate right up until the moment funds move, at which point there is no dispute process, no bank to call, and often no identifiable person to hold accountable.
A useful, near-universal test for anyone new to holding cryptocurrency: if a platform, contact, or opportunity cannot be independently verified through a source you found yourself, rather than one it provided, treat the entire opportunity as unverified regardless of how professional the presentation looks. This single habit closes off the overwhelming majority of crypto fraud before it ever reaches the point of an actual transfer.
The forced labour dimension uncovered in the 2025 pig butchering bust adds a layer most people never consider: the person building a relationship with you over weeks before introducing a “trading opportunity” may themselves be a trafficking victim, coerced into running these operations under threat of violence. This does not change the practical advice, verify independently before sending anything irreversible, but it is worth understanding that the human cost of crypto fraud extends well beyond the person who eventually loses money.
Read the full guide: Crypto Scams, Rug Pulls and Fake Wallets: How to Avoid Web3 Fraud
For further reading across this section, AARP’s Fraud Watch Network, EFF’s Surveillance Self-Defense guide, INTERPOL’s cybercrime resources each offer additional depth.
Frequently Asked Questions
Do I need to worry about all nine of these categories?
Almost certainly not all at once. Identify which apply to your actual life, do you game, date online, drive a connected vehicle, hold crypto, work in a role with payment authority, and focus your attention on those specifically rather than trying to defend against everything equally.
What is the one thing all nine categories have in common?
Each attacker identified a specific vulnerability tied to a group, platform, or context, then built an approach precisely calibrated to it. Recognising which specific vulnerability applies to you is more useful than any single piece of general advice.
None of these nine threats are random. Each is documented, repeatable, and specifically calibrated to a particular group or context, which means each one also has a specific, practical response.
Start with whichever category in this guide applies most directly to your own life, and go read that full guide next.
If more than one category applies to you at once, which is common, address the one with the least reversible outcome first. A cryptocurrency exposure or an active workplace threat generally deserves attention before a lower-stakes platform risk, simply because the cost of waiting differs so dramatically between categories.
If this was useful, share it with someone who needs to know.
7 comments
Comments are closed.