This Week in Scams: Tolls, Tickets, AI Romance Cons & Fake Recovery

The big picture: imposter scams remain #1, and losses keep climbing

Federal regulators confirm what AVASC's own case reports are showing: impersonation is the dominant scam pattern of the year. The FTC reported that imposter scams were the #1 scam for the ninth year in a row, with the FTC getting millions of fraud reports from consumers. In dollar terms, in 2025 the FTC got more than 1 million reports about imposter scams, with reported losses increasing by nearly 20% to $3.5 billion. Total fraud losses reported to the FTC hit a record as well: in 2025, people reported losing about $16 billion to scams, compared to $12.8 billion the previous year.

A big driver of that increase is the toll-text wave: reports of government imposter scams were up 40%, thanks in part to messages about overdue tolls, which might spoof real toll collection programs (like EZ-Pass, SunPass, FasTrak, and TxTag) and threaten to charge late fees or suspend a vehicle's registration if you don't pay right away. AVASC's own data this week shows the same pattern at scale, with our unpaid-toll cluster logging 520 reports — our single largest category — and government/agency impersonation close behind at 410 reports.

Unpaid-toll text scams: still moving state to state

The FBI's Internet Crime Complaint Center (IC3) has been tracking this smishing wave since 2024. According to IC3's advisory, the texts claim the recipient owes money for unpaid tolls and contain almost identical language, with the 'outstanding toll amount' similar among the complaints reported to the IC3. What varies is the disguise: the link provided within the text is created to impersonate the state's toll service name, and phone numbers appear to change between states. Authorities are blunt about the tell: legitimate toll agencies do not send payment requests via text. AVASC is seeing this cluster remain our highest-volume threat this period, with look-alike payment pages on unofficial top-level domains and text-blast delivery via SMS, iMessage, and RCS.

AI-supercharged pig-butchering: romance and crypto fraud at industrial scale

AVASC's data shows pig-butchering crypto-romance scams carrying the highest threat score of any cluster this week (95/100, 340 reports), and outside reporting confirms this is a global, industrializing threat. New York's Attorney General warned that fraudsters befriend victims under false pretenses and convince them to make fraudulent investments, 'fattening up' victims by gaining their trust before finally taking their money. The pattern plays out the same way every time: after victims deposit substantial sums, ranging from tens of thousands to over a million dollars, they are unable to withdraw funds or are asked to prepay fake withdrawal fees or taxes, and eventually the scammers cut off contact and keep the money.

What's new in 2026 is the use of AI to run these cons at scale. Reporting describes how where scammers once manually managed dozens of conversations at once, criminal syndicates now use agentic AI to automate the grooming process, maintaining thousands of deep, personalized relationships simultaneously. Law enforcement has responded aggressively: a broad international operation led by Dubai Police, working with the FBI and China's Ministry of Public Security, resulted in at least 276 arrests, the shutdown of nine scam centers, and the freezing of more than $701 million in crypto. The FBI's own victim-notification effort has also had real impact — Operation Level Up had, as of March 2026, notified 8,935 victims of cryptocurrency investment fraud, 77% of whom were unaware they were being scammed, saving an estimated $562 million.

Fake 'fund recovery' services: victims targeted a second time

One of the most painful patterns AVASC tracks is re-victimization — and it's a documented, growing problem. The FBI has warned that criminal scammers are impersonating FBI Internet Crime Complaint Center (IC3) employees, and between December 2023 and February 2025, the FBI received more than 100 reports of IC3 impersonation scams. The mechanics are cruel by design: almost all complainants indicated the scammers claimed to have recovered the victim's lost funds or offered to assist in recovering funds, but the claim is a ruse to revictimize those who have already lost money to scams. One documented persona even posed as a fellow victim inside support groups before recommending that actual victims reach out to a male persona, the alleged 'Chief Director' of IC3, via Telegram, who then claims to have recovered the lost funds but uses this as a ruse to gain access to their financial information. The scale is significant: a 2026 analysis found the IC3 gathered more than 10,500 complaints about recovery scams in 2025, with estimated losses totaling $1.4 billion, and Americans aged 60 and older filed 2,529 recovery scam complaints in 2025 and reported more than $540 million in losses, leading all age groups by a wide margin. The single most important fact for any prior victim to know: the IC3 does not work with any non-law enforcement entity, such as law firms or crypto services, to recuperate lost funds or investigate cases, and will never directly contact you for information or money.

World Cup ticket scams targeting soccer fans

With the FIFA World Cup drawing massive attention through its July 19 final, the FBI issued a formal warning about ticket fraud. The bureau said cyber threat actors are conducting spoofing attacks against the FIFA website, using branding and product listings to further illegal activity like personal information theft and facilitating monetary scams, and that the FBI has identified actors engaging in this activity to collect personal information, sell fake World Cup tickets and hospitality products, and to possibly facilitate other malicious activity. The tactic is typosquatting: spoofed websites may mimic the legitimate URL by using a minor misspelling, or alternative top-level domains, such as .org rather than .com. Fans searching resale markets have already reported losses — the Better Business Bureau's Scam Tracker listed at least 15 alleged schemes involving 2026 FIFA World Cup ticket sales — and the FBI's core advice is simple: type fifa.com directly into your browser's address bar rather than relying on a search engine, and skip the sponsored results, since paid ads can be purchased by scammers to divert traffic. This lines up with AVASC's own event-ticket cluster, where fake resale listings and peer-to-peer payment demands remain the leading indicators.

What we're also seeing: task-job scams targeting people who need income

AVASC's database logged 210 reports this period on a lighter but fast-moving cousin of pig-butchering: fake 'task' or product-rating jobs recruited over WhatsApp, Telegram, or SMS that pay small amounts before engineering a negative balance and demanding victims deposit their own money to 'unlock' earnings that never materialize. This cluster tends to target people actively looking for income, and it shares the same core red flag as crypto investment scams — being asked to pay money in order to access money you already 'earned.'