Data leaks are no longer isolated events and have become part of the digital routine of businesses and ordinary users.

In recent years, WhatsApp scams, account takeovers, AI voice cloning, and phishing campaigns have become more frequent and sophisticated. In many cases, criminals do not need to hack into complex systems; they simply exploit reused passwords, fake links, or human error.

The landscape has also changed from a technical standpoint. According to the FortiGuard Labs 2026 Global Threat Report, cybercrime has become an industrialized and highly automated operation. There was a 79% increase in registered identity theft and shared credentials on the darknet, totaling 4.62 billion leaked records in 2025.

In practice, this means that personal data constantly circulates among leaks, illegal marketplaces, and automated fraud campaigns.

Understanding how these scams work and which habits actually help reduce risks has become a matter of digital survival.

The human factor is still the main risk

Despite the evolution of technical threats, a large portion of incidents still start the same way: someone clicking on a fake link, reusing passwords, or sharing information without realizing the risk.

Phishing attacks remain among the most widely used methods because they exploit human behavior, not just technical flaws.

Today, these scams have evolved. With generative AI, criminals are able to produce:

• More convincing emails.

• Fake websites identical to the originals.

• Personalized messages.

• Cloned voices via deepfake.

• Conversations simulating family members, banks, or companies.

The main change is in the scale and sophistication of these frauds. What used to be standardized and easily identifiable messages can now look like legitimate communication, or even include deliberate errors. In some cases, even "report" or "mark as spam" buttons can hide malicious links.

According to data from Google, nearly 60% of people worldwide have fallen victim to some type of online scam in the past year.

The problem of reused passwords

A large portion of current takeovers do not depend on "hackers breaking systems," but on the use of credentials that have already been leaked previously.

When a service suffers a leak, users who reuse passwords across different platforms end up exposing multiple accounts at the same time.

This explains why attacks on bank accounts, emails, and social networks frequently happen in sequence.

Some practices greatly reduce this risk:

• Do not reuse passwords.

• Use password managers.

• Create long, randomized combinations.

• Enable two-factor authentication.

Today, a strong password alone is no longer enough. The ideal approach is to combine multi-factor authentication with more modern methods, such as passkeys.

Passkeys and hardware keys

Passkeys have begun to gain ground precisely because they reduce dependence on traditional passwords.

Instead of memorizing combinations, logging in relies on authentication from the device itself, such as biometrics or a local PIN. This drastically reduces phishing attacks, as there is no password to be typed into a fake website.

Another important layer is physical security keys, such as YubiKeys.

These devices function as a physical confirmation of identity. Even if someone discovers your password, access depends on the presence of the key connected to the device.

This type of protection has been adopted mainly by:

• Professionals who handle sensitive data.

• Companies.

• Developers.

• Journalists.

• Executives.

• Users exposed to targeted attacks.

Leaks do not only affect companies

Many people still associate leaks with large corporations, but the impacts directly target ordinary users.

With a registry number (CPF), phone number, email, and banking details, criminals can:

• Open fraudulent accounts.

• Apply for loans.

• Carry out financial scams.

• Perform social engineering.

• Build detailed profiles of victims.

Therefore, monitoring personal information has become part of the digital security routine.

An important tool in this process is Registrato, from the Central Bank, which allows consumers to query:

• Accounts opened in your name.

• PIX keys linked to your CPF.

• Loans.

• Banking relationships.

• Registered financial information.

The recommendation is to perform periodic queries to identify unrecognized transactions.

AI also increases the risk of scams

Generative AI tools have accelerated not only productivity, but also the ability to create more sophisticated frauds.

LEARN MORE: Deepfake: AI as a threat to digital security

Today there are already scams using:

• Cloned voices.

• Manipulated videos.

• Fake automated customer service.

• Mass personalized emails.

• Fake AI apps.

This last item has become especially relevant with the rising popularity of AI apps in official stores.

Many apps copy the visual identity of well-known tools to steal data, subscriptions, or device permissions.

In addition, there is a growing risk of users sharing sensitive information directly on AI platforms without realizing how that data will be stored or used.

The recommendation is to never enter financial information, documents, corporate data, or credentials into online tools without having clear clarity on the storage and privacy policy.

The importance of digital education

Tech companies have also started investing in hands-on training against digital scams.

Google recently launched the game “Be Scam Ready” (Evite Golpes), designed to teach users to recognize common patterns of manipulation used in online scams.

The game simulates real situations involving:

• Fake authorities.

• A sense of urgency.

• Social proof.

• Deceptive offers.

• Social engineering.

The proposal stems from the idea that users need to recognize psychological patterns in practice.

Digital security also involves the household routine

The growth of internet use by children and adolescents has scaled another concern: control over exposure time, access to content, and online behavior.

In this context, parental monitoring and family management tools have gained ground.

CodeWall operates in this area by allowing families to track internet usage time, create digital routines, and manage access through an app integrated with the home's Wi-Fi router.

Among the available features are:

• Connection time control.

• Activity monitoring.

• Access management by user.

• Digital routine creation.

• Control of connected devices.

This type of solution helps build healthier habits and increase visibility over digital use at home.

The trend is for digital scams to become increasingly personalized, automated, and difficult to identify. At the same time, the volume of data circulating among services, apps, and platforms continues to grow.

In this scenario, the objective today is to reduce exposure, create layers of protection, and develop habits capable of making the work harder for those who exploit flaws, leaks, and social engineering.