Five Phone Security Steps That Help Block Text, Voice and QR Scams
Texts, cloned voices and QR codes give scammers more ways to reach phone users. These five habits add practical checks without slowing everyday use.
Phone scams work because they reach people where they’re already paying attention. Texts, calls and social posts arrive on familiar devices, and a message that looks routine can push someone to act before they stop to check it. The practical response isn’t to distrust every alert. It’s to build a few habits that create time to verify who’s asking and where a link leads.
That matters as scam messages become harder to recognize. In a Malwarebytes survey, 85% of respondents said it was difficult to distinguish a scam from a genuine message, up from 66% a year earlier. Sixteen percent said they had received a call using a cloned voice to impersonate someone they knew. And 84% said convincing video no longer feels like reliable proof by itself.
Texts are a particularly useful channel for scammers because people tend to read them. The Federal Trade Commission cites estimates that text messages can have open rates as high as 98%, compared with 20% for email. Consumers reported losing $470 million to text scams in 2024, 26% more than in 2023 and over five times the amount reported in 2020. Those figures describe reported losses; they don’t capture every scam or show how many people ignored one.
AI adds another wrinkle. It can help make a voice imitation more convincing, while a message or video that seems personal may still be fabricated. The useful defense is to check the request through a separate route you already trust. These five steps make that process easier to apply.
1. Pause when a text or social post asks you to act
An unexpected message asking for money, account details or other personal information deserves a check, especially if it puts pressure on you to respond immediately. Urgency is a reason to slow down. Don’t use a phone number or link supplied in the message as your only way to verify it. Find the organization’s contact details independently and check through its website or app.
Images and video aren’t enough to establish that a request is genuine. If a post appears to come from someone you know, contact that person using a number already saved in your contacts. That extra step may feel inconvenient, but it breaks the connection between a persuasive message and the action it wants you to take.
2. Install phone operating system updates
Updates can close security weaknesses that malicious software may exploit. Malwarebytes reported that Android malware detections rose 151% in the first half of 2025. That figure reflects detections, rather than a count of every infected device, but it underscores why updates matter. On both iPhone and Android, enabling automatic updates helps ensure that security fixes aren’t left waiting for a manual install.
Updates don’t prevent every scam. They’re one layer of protection for the device itself, while the other steps here focus on the messages, accounts and links that reach it.
3. Reduce the damage from a stolen password
Give each account its own strong password. Reusing one password means that if it’s exposed in one place, other accounts may also be at risk. A password manager can generate and store different passwords, so you don’t have to remember them all.
Where a service supports passkeys, consider using one. A passkey lets you sign in through your device, often with a fingerprint, face scan or PIN, and is designed to resist phishing. Also turn on two-factor authentication (2FA) wherever it’s available. It adds a second check at sign-in, making a password alone less useful to someone trying to enter your account.
4. Verify unexpected calls through a second channel
A familiar voice isn’t proof of identity. Voice cloning can make a call sound like it came from a relative, even when the caller is a stranger. Families and close friends can agree on a private code word to help confirm an urgent request. If something feels wrong, end the call and ring the person back at a number you already have.
Use the same pause if a caller claims to represent your bank. Hang up, then find the bank’s number independently and call it yourself. The point is to avoid relying on contact details provided by the person whose identity you’re trying to verify.
5. Inspect links, including QR codes
Before opening a link from a text, email or social post, look closely at the web address. Misspellings or an unfamiliar domain can reveal that a page isn’t where the message claims it is. Malwarebytes offers a link-checking tool for assessing suspicious addresses.
A QR code can conceal its destination until your phone reads it. In public places, check for a sticker that appears to cover or replace another code. When your camera displays a web address, inspect it before opening the page. If you’re uncertain, use the organization’s app or type its address yourself instead.
QR-based lures continue to change, as illustrated by an alert about QR code activity. The practical lesson applies beyond any single case: scanning is just another way to open a link, so the same destination check still matters.
Make verification the default
Each step addresses a different point of attack: the operating system, account access, caller identity or a link’s destination. None guarantees that a scam will be caught, but together they make it harder for a convincing message to turn into a rushed payment or stolen login. When a request creates pressure, take a moment, leave that conversation and verify it through a channel you already trust.
