The money trail points to a few repeat offenders. Business impersonators drained nearly $1 billion from consumers last year, with bank impersonators the costliest single subset, while government impersonators took roughly $920 million. Both totals climbed from 2024's $866 million and $789 million respectively (FTC, four months ago).

The mechanics behind the costliest version are almost formulaic at this point. A message warns of suspicious account activity, then pressures the recipient to "protect" their money by moving it, often draining the account up to whatever balance is available (FTC, four months ago). It's a fake bank security alert scam dressed up to look like exactly the kind of message a real bank would send when something is actually wrong.

Federal law enforcement has been tracking a related pattern at a higher level. Since at least 2023, the FBI has documented a campaign in which scammers send text messages and AI-generated voice memos impersonating senior U.S. officials, aiming to build false rapport before the real ask comes. The bureau labels these tactics smishing for the text-based version and vishing for the voice-based one (FBI, ten months ago). That's one documented campaign, not proof that AI voice cloning has become standard scam infrastructure, but it shows the toolkit is already in use against high-value targets.

Zoom out and the pattern holds nationally. Phishing and spoofing were the single most-reported cybercrime category in the FBI's 2024 Internet Crime Report, released last year, ahead of extortion and personal data breaches, across 859,532 total complaints and more than $16 billion in reported losses that year (FBI's 2024 Internet Crime Report). That figure measures a different universe of crime than the FTC's 2025 fraud total, cybercrime broadly versus consumer fraud specifically, but the overlap in scale says something: impersonation and phishing aren't a fringe tactic. They're the dominant one.

What ties these numbers together is simple. Impersonation works because it borrows the urgency and authority of institutions people are trained to respond to quickly. A warning that looks like it came from your bank gets the same fast, low-scrutiny reaction as one that actually did. That overlap is the whole business model.

The FTC offers a blunt baseline test: the agency will never demand immediate payment, threaten a consumer, instruct them to transfer funds, or promise a prize (FTC, four months ago). Any message claiming to be from a government agency and doing one of those four things has already failed the test.

The fake bank security alert is worth studying as a case in point, because it's built to mimic real fraud-alert language down to the formatting. It borrows the exact tone legitimate banks use when something is genuinely wrong, which is precisely what makes it convincing. The scam isn't fooling people with sloppy grammar anymore; it's fooling them by looking like something they've seen work correctly before.

Texts specifically carry their own track record. The FTC has flagged text-based scams as a persistent channel, with losses to texting scams reaching $330 million in 2022 (FTC, six months ago). Phishing text messages and emails both rely on the same trigger: a short window to act before the recipient has time to think.

The AI layer complicates this without yet rewriting the rules. The FBI has confirmed scammers used AI-generated voice messages in the senior-official impersonation campaign running since 2023, adding a new credibility signal to an old social-engineering script (FBI, ten months ago). What the available evidence doesn't do is quantify how widespread AI use has become across the broader scam economy. Treat it as one more tool in a toolkit scammers already had, not evidence that every suspicious text is now AI-generated.

The single most effective habit against all of this is boring but reliable: contact the institution independently, using a phone number or website found on your own, not one supplied in the message, before clicking anything or replying. It bypasses the manufactured urgency entirely, because it removes the scammer's control over what happens next. Spotting these scams is hard precisely because the red flags, urgency, official branding, a call to action, are the same features legitimate security notices use. The difference isn't in the warning signs. It's in who controls the next step.

A study published in MIS Quarterly offers a mechanism that explains why some of this slips through even when people think they're paying attention. Researchers describe "generalization of habituation," the finding that becoming desensitized to routine, non-security notifications can bleed into reduced attention toward genuinely novel security warnings (MIS Quarterly, ten months ago). Ignoring enough app notifications trains the brain to ignore things that look like app notifications, including the one time it actually matters.

The behavioral data backs this up with numbers. In controlled experiments, participants exposed to repeated notifications were 1.62 times more likely to disregard a subsequent security warning, and they reacted roughly 22% faster, 3.6 seconds versus 4.6 seconds, than participants seeing a warning for the first time (MIS Quarterly, ten months ago). Faster reaction paired with higher disregard isn't careful evaluation. It's reflex.

Visual similarity sharpened the effect further. Warnings that looked like routine performance notifications were disregarded at roughly 2.6 times the rate after repeated exposure, compared to 1.95 times on first exposure (MIS Quarterly, ten months ago). That gap suggests fatigue alone isn't the whole story. It's pattern-matching: the brain files a new warning under "things I already ignore" based on how it looks, not what it says.

There's a genuine counterpoint buried in the same research, and it matters. Warnings designed to look and behave differently, a distinct visual style, or a different interaction method such as dragging a slider instead of clicking a button, significantly reduced the disregard effect. The problem is addressable through design, not purely through telling people to try harder.

The limits of the study are worth flagging. Researchers recruited 609 participants through an online labor platform, average age 36, using a standardized browser setup rather than real phones receiving real scam texts. That's a controlled lab finding, not a nationally representative measurement of how all Americans respond to a text message at 11 p.m. The mechanism is credible. It shouldn't be read as a precise forecast of population-wide behavior.

Still, the implication reframes what scam fatigue actually is. It's not a personal failing or a sign of carelessness. It's a predictable response to an environment that trains people to tune out repetition, which happens to include the one message that was never routine at all.

There's an enforcement backstop worth knowing about, because it changes the calculus beyond personal vigilance. The FTC finalized its Impersonation Rule in 2024, giving the agency authority to pursue federal court action, consumer redress, and civil penalties against government and business impersonators. Since then, it has brought a dozen enforcement actions and returned more than $70 million to consumers (FTC, four months ago).

Those actions aren't abstract. Cases targeted American Tax Service for impersonating the IRS, MediaAlpha for a government-imposter scheme used to sell health insurance, Click Profit and Blackstone Legal for business-impersonation and phantom-debt schemes, and Accelerated Debt Settlement for a government and business impersonation scheme that specifically targeted older adults seeking debt relief. In April 2026, the FTC also filed a complaint against Innovative Partners, alleging the operation impersonated government agencies and large insurance carriers to sell health plans that didn't deliver the coverage consumers thought they were buying (FTC, four months ago).

Reporting matters beyond whatever happens to an individual case. FBI Director Kash Patel has called reporting "one of the first and most important steps in fighting crime," since law enforcement relies on that data to combat fraud patterns at scale (FBI's 2024 Internet Crime Report). The bureau's Internet Crime Complaint Center has logged nine million complaints since it was established in 2000, a dataset that only works if people actually use it.

For anyone wondering how to protect yourself from scam texts in practical terms, the checklist is short: don't click links in unsolicited texts or emails, verify through contact information found independently rather than anything supplied in the message, and report suspicious messages to ReportFraud.ftc.gov or IC3.gov. Treat any message demanding urgent financial action as a reason to slow down, not speed up. That one reversal, urgency as a red flag instead of a call to action, undoes most of what these scams are built to exploit.

None of this works as a single layer. Consumer skepticism catches some scams. Enforcement catches others after the fact. Better-designed warnings catch what both of those miss. Treating it as one system, rather than placing the entire burden on individuals to outsmart professional fraud operations, is a more honest description of what actually stops losses.

Americans now encounter imposter attempts constantly enough that the format barely registers as unusual, which is exactly the condition the habituation research describes: repeated exposure to routine notifications measurably dulls attention to novel warnings, even when those warnings matter (MIS Quarterly, ten months ago). That mechanism doesn't explain every dollar lost, but it explains why a message built to look mundane can slip past people who would catch an obviously fake one.

Regulators are adapting. A dozen enforcement actions and $70 million in consumer redress under the Impersonation Rule is a real response, though it's modest set against the scale of reported losses (FTC, four months ago). Enforcement alone won't close a gap this size, and nobody running these programs claims it will.

The more useful shift is probably in how warnings are built, not how often people are told to be careful. The FBI has already documented a campaign using AI-generated voice messages to impersonate officials, a sign of what scammers are willing to try, even if it doesn't prove every scam is suddenly more convincing. Design that makes a real warning impossible to confuse with background noise, distinct in look, distinct in interaction, isn't a cure. It's a start that doesn't rely on exhausted attention doing the work alone.