New Study by Consumer Reports, Aspen Digitla, and Global Cyber Alliance reveals 9 in 10 Americans targeted by a cyberattack or digital scam attempt

* 9 in 10 American consumers have encountered at least one digital scam or cyberattack attempt.
* 17% of Americans have lost money to a scam.
* Consumer confidence in personal data privacy was 32% in May 2026, compared to 48% in May 2025.
* The proportion of Americans reporting they were “not confident at all” about their data privacy nearly doubled, rising from 16% to 29%.
* One in five consumers who encountered a scam attempt reported the most recent attempt was customized using personal details.
* 32% of people who experienced a personalized scam attempt said it began via phone call.
* Seven percent of Americans recovered money lost to a digital scam or cyberattack due to payment method use.
* 61% of those who paid with a credit card recovered their money; 45% of those who paid with debit cards did; only 15% of those using peer-to-peer services and 5% of those using cryptocurrency recovered funds.
* 29% of Americans believe platform owners carry the primary responsibility for stopping digital scams.
* The federal government is estimated to have a responsibility at 18%, followed by financial companies (14%), individual consumers (16%), and social media platforms (29%).
* Consumers are attempting protection through actions like inspecting links before clicking (69%), using multi-factor authentication (60%), and turning on automatic software updates (48%).

The data reveals a critical divergence between the collective effort of individual caution and the systemic failures within the digital ecosystem. The most striking pattern is the gap between reported risk (91% exposure to attacks) and perceived control (32% confidence in privacy). This indicates that while consumers are actively engaged in defensive behaviors, these localized actions cannot compensate for vulnerabilities originating from upstream systems—insecure routing and malicious domain registration, as noted by cybersecurity experts. The personalization aspect of the scams highlights a deeper structural issue: data aggregation creates an exploitable asset that moves beyond simple technical breaches into psychological manipulation. The distribution of accountability among entities suggests a distributed failure; no single actor is singularly responsible for the entire risk landscape. The call for collaboration between industry, government, and civil society reflects an understanding that security is not a purely technical fix but requires systemic governance alongside individual hygiene. The focus on solutions—enforcing platform accountability alongside promoting authentication practices—suggests that regaining cognitive sovereignty depends on shifting from reactive personal defense to proactive structural enforcement across the entire digital infrastructure.
Bridge Questions: If the responsibility for data protection were fully centralized, what specific mechanisms would need to be established to ensure equal accountability across platforms and governments? How can educational initiatives effectively translate the statistical awareness of risk into enforceable behavioral changes that withstand constant technological novelty? What are the long-term systemic consequences if consumer confidence remains tethered to episodic security events rather than continuous infrastructural security?