More than half of successful messaging scams are completed within 30 minutes of first contact, and one in seven is over in less than five minutes, according to a new Kaspersky investigation into the global messaging scam economy. The average loss per victim is US$733.
The Great Messaging Heist report, published by Kaspersky in 2026, is billed as the first study to capture the end-to-end reality of messaging-based scams - what happens after a scam message lands, rather than how often scams occur. The survey was conducted by Censuswide in April 2026 among 2,806 messaging scam victims aged 16 to 61 across Europe, North America and Africa.
The report describes a highly organised, industrialised scam ecosystem embedded in everyday channels. WhatsApp is where 43 per cent of scams begin, followed by SMS and iMessage (40 per cent), Facebook (27 per cent), Telegram (22 per cent) and Instagram (19 per cent). Fake delivery notifications top the scam types at 38 per cent, followed by investment scams (37 per cent) and brand impersonation (31 per cent).
Speed is the method. The report found scam interactions are engineered to compress the decision-making window through urgency, familiar formats and plausible requests. For 51 per cent of victims the loss is money; for 43 per cent it is personal data, most commonly phone numbers, names and email addresses.
The losses are deliberately small. More than a third of victims lose under US$135, amounts often never reported and rarely investigated. But 11 per cent lose more than US$1,350, and 28 per cent of victims report being scammed three or more times. Kaspersky calculates that if 10 per cent of the world's three billion messaging app users were scammed at the average loss, total losses would exceed US$219 billion.
The damage to legitimate senders is severe. Ninety-nine per cent of scam victims say they no longer trust any incoming notifications on messaging channels. Nearly two-thirds of scams span multiple platforms, moving between SMS, WhatsApp and Telegram to avoid detection.
AI is the accelerant. Two-thirds of victims believe AI was used in the scam they experienced, with 42 per cent citing AI-written messages, 31 per cent synthetic voices and 25 per cent deepfake images or video. The report notes researchers now describe voice cloning as having crossed an "indistinguishable threshold", with a few seconds of scraped audio sufficient to produce a convincing clone.
Only 24 per cent of victims report scams to police and 23 per cent to their bank, meaning the true scale of damage is almost certainly larger than official statistics show. The report recommends organisations invest in brand monitoring and takedown capabilities, run ongoing customer awareness campaigns, and build scam detection and response into operations.