Technology
Fake Venmo accounts are stealing donations from real charities
NEWYou can now listen to Fox News articles!
Apps like Venmo, Zelle, Cash App, and PayPal have changed how we move money. They are fast and convenient, but with that ease comes exposure. If you send funds to the wrong person, they are likely gone for good. There is often no real path to recovery, especially when the recipient disappears behind a fake username and an unresponsive support system.
This vulnerability becomes even more dangerous in moments of crisis. During natural disasters, high-profile social movements, or health emergencies, people are moved to give. Scammers know this and exploit the impulse. One such scam involved a fake Venmo account pretending to collect donations for a Minnesota nonprofit after the death of George Floyd. The account looked legitimate, but the funds never reached the organization.
A similar scam is targeting Miles Perret Cancer Services, a nonprofit based in Louisiana. Scammers have created a fraudulent Venmo account that closely mimics the legitimate Venmo handle of the cancer nonprofit organization. They are using this fake account to trick well-meaning donors into sending money, believing they are supporting the real charity.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Zelle and Venmo apps (Kurt “CyberGuy” Knutsson)
Fake Venmo account mimics real charity: How 1 character can fool you
Miles Perret Cancer Services (MPCS) provides support to families facing cancer diagnoses. They recently discovered that a fraudulent Venmo account is impersonating their official one. Their real handle is @milesperretcs. The scammer’s account uses @milesperretcs_, a nearly indistinguishable copy.
To the average person, the difference is invisible. That is precisely what makes it dangerous.
“We reported this account through the app more than 24 hours ago,” Timothy Rinaldi, executive director of MPCS, told Cyberguy. “There has been no follow-up from Venmo. We tried the live chat option, but it was abruptly closed with no resolution.”
Instead of helping, Venmo routed Rinaldi through generic FAQs and legal disclaimers. Even after he was connected with a live support agent, the responses were standard scripts. He was told that the issue had been escalated, but no one could provide a timeline beyond a vague window of three to five business days.
Real and fake Venmo accounts (Kurt “CyberGuy” Knutsson)
FBI WARNS OF SCAM TARGETING VICTIMS WITH FAKE HOSPITALS AND POLICE
Charity scams on Venmo: How scammers trick donors using fake accounts
Fake Venmo accounts have been used in recent years to exploit donation drives for hurricane relief, animal shelters, medical funds, and other causes. The formula is simple. Take a known nonprofit, tweak the username slightly, and ride the momentum of goodwill. By the time anyone catches on, the money is gone and the damage is done.
The incident involving MPCS is not an isolated case. In December 2024, Final Victory Animal Rescue, a nonprofit based in South Carolina, discovered a Venmo account impersonating the organization and collecting donations intended for the real charity. The group’s general manager, Michael Sniezek, confirmed the account had been receiving funds from unsuspecting donors before the issue was flagged.
In another case, Alone No More Dog Rescue, a Phoenix-based nonprofit, posted on Facebook that fraudulent Venmo accounts had been targeting its past donors, sending them payment requests and soliciting additional funds under false pretenses.
MPCS has filed a report with the Federal Trade Commission, but there is no guarantee of quick resolution. The fraudulent account remains active as of press time. It is unclear how much has already been lost or whether Venmo will recover and return any of it.
A hacker at work (Kurt “CyberGuy” Knutsson)
THIS IS WHAT YOU ARE DOING WRONG WHEN SCAMMERS CALL
Venmo confirms fake accounts were removed and shares how to stay safe
Venmo confirmed that the imposter accounts were removed promptly after being reported. They recommend reporting suspicious activity directly within the Venmo app and contacting customer support for further assistance.
To help users avoid future scams, Venmo encourages everyone to review its official security tips on how to recognize impersonation attempts and learn how to spot and avoid charity-related scams.
They also shared the following tips to help users verify real Venmo profiles and stay safe when sending money:
- Double-check the Venmo username (handle): Look closely for misspellings, extra characters or attempts at impersonation.
- Use Venmo QR codes: Scan QR codes directly from the Venmo app to ensure you’re sending money to the right person.
- Donate only to verified Venmo charity accounts: These are vetted and marked with verification badges. You can find them here.
Heed Venmo’s automatic warnings: If Venmo flags a payment as suspicious, pause and verify before sending money. These alerts are designed to protect you from scams.
How to avoid Venmo scams: 11 expert tips to protect your money
Scammers aren’t just targeting charities. They’re after anyone and everyone. Here are a few ways to protect yourself and keep your hard-earned money safe.
1) Always access the payment app from the official app or website, and not from any third-party platforms or services.
2) Look at the security settings that the payment app offers and make sure they’re all set to the highest and most protective settings.
3) Consider using a personal data removal service to protect your privacy and reduce your risk of scams. Scammers who target payment apps like Venmo, Zelle, Cash App, and PayPal often rely on information found on data broker and people-search sites to craft convincing impersonations or phishing attempts. These sites can list your name, address, phone number, and even connections to organizations you support, making it easier for fraudsters to trick you or others into sending money to fake accounts.
Personal data removal services work by automatically removing your information from hundreds of data broker sites, making it much harder for scammers to find and misuse your details. By scrubbing your data from these sources, you lower your risk of being targeted in payment app scams and reduce the likelihood that someone could impersonate you or a nonprofit you care about. Check out my top picks for data removal services here.
Get a free scan to find out if your personal information is already out on the web
4) Create a strong, unique and complex password for each of your mobile payment apps and change it often. Consider using a password manager to generate and store complex passwords. Get more details about my best expert-reviewed password managers of 2025 here.
5) Enable two-factor authentication, which means that you need to enter a code or use your fingerprint or face to unlock your account to prevent unauthorized access. This way, even if someone knows your password, they can’t log in without your device or confirmation.
6) Lock your device and log out of your apps. You should always lock your phone with a password, PIN, pattern, fingerprint, or face. Never share your password, PIN, or security code with anyone. You should also log out of your mobile payment apps after each use and turn off the auto-login feature. This way, even if someone takes or borrows your device, they can’t access your mobile payment apps without your approval.
7) Verify the identity and legitimacy of the sender or receiver. You should always check the name, photo, username, and contact information of the person or organization you are sending money to or receiving money from before accepting or sending any payment requests. You should also confirm the reason and amount of the transaction before you agree to it. If you are not sure or have any doubts, you should contact the person or organization directly through another way, such as a phone call, text message, or email, but only if you know for sure that those forms of communication are legitimate. You should never send money or give your account details to anyone you don’t know or trust, or anyone who asks you to do so out of the blue.
8) Link your Venmo to a credit card as opposed to a debit card, so you can dispute a charge from scammers more easily. However, keep in mind, linking a credit card to your payment app can provide additional protection in the event of fraud, but this can come with extra costs in terms of transaction fees.
9) Try not to keep a balance in your money-transferring apps. You have a much better chance of being helped by your bank or credit card company when it comes to fraud than you do from a money-transferring app.
10) Use strong antivirus software and never click on links from unknown sources, especially when an email or text appears to have come from the payment App. Protect yourself from accidentally clicking on malicious links by running antivirus software on your device.
The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices.
11) Monitor your account activity and report any suspicious or unauthorized transactions. You should set up notifications from your payment app and your bank via text or email, and check your account activity regularly. Look for any signs of fraud, such as payments you didn’t make or receive, or changes to your account settings or information.
Kurt’s key takeaway
Unlike traditional banks, which are bound by federal consumer protection laws and fraud resolution timelines, peer-to-peer payment apps operate in a much looser regulatory environment. Services like Venmo often state in their user agreements that they are not responsible for mistaken or unauthorized payments unless there is clear evidence of account compromise or technical malfunction. Venmo’s only suggestion here was to respond to a support ticket and wait. There was no emergency fraud hotline, no dedicated contact for nonprofits, and no indication that urgent action would be taken. Payment apps that allow donations to flow as quickly as a text message must also bear the responsibility of keeping those transactions safe. When a nonprofit has to beg for support just to protect its own identity, something is broken.
Should payment platforms be held responsible for losses caused by impersonation scams? Let us know by writing to us at Cyberguy.com/Contact.
For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.
Ask Kurt a question or let us know what stories you’d like us to cover.
Follow Kurt on his social channels:
Answers to the most-asked CyberGuy questions:
New from Kurt:
Copyright 2025 CyberGuy.com. All rights reserved.
Technology
SpaceX cuts a deal to maybe buy Cursor for $60 billion
SpaceX and Cursor are now working closely together to create the world’s best coding and knowledge work AI.
The combination of Cursor’s leading product and distribution to expert software engineers with SpaceX’s million H100 equivalent Colossus training supercomputer will allow us to build the world’s most useful models.
Cursor has also given SpaceX the right to acquire Cursor later this year for $60 billion or pay $10 billion for our work together.
Technology
Fake Windows update installs hidden malware
NEWYou can now listen to Fox News articles!
If you’ve ever clicked “Check for updates” and trusted what you saw, you’re not alone. That’s exactly what this latest scam is counting on.
The page mimics official branding, includes a believable knowledge base number and presents a big blue download button that feels familiar.
The catch? The download installs malware designed to steal passwords, payment details and account access.
According to researchers at Malwarebytes Labs, a cybersecurity research and threat intelligence team inside Malwarebytes, the site uses a typosquatted domain that looks close enough to a real Microsoft URL to fool a quick glance. That small trick is often all it takes.
APPLE APP PASSWORD SCAM EMAIL WARNING
Cybersecurity researchers warn a fake Microsoft update site uses a look-alike URL and a familiar download button to deliver data-stealing malware. (Michael Nagle/Bloomberg via Getty Images)
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Why this fake Windows update malware slips past detection
At first glance, nothing seems off. The file looks like a standard Windows installer. It even lists “Microsoft” in its properties. That’s where this attack gets clever. Instead of using obvious malicious code, the attackers built the installer with legitimate tools and layered the attack in stages. Each piece looks harmless on its own.
Here’s what’s happening behind the scenes:
- The installer launches what appears to be a normal app
- That app quietly runs hidden scripts
- A disguised process loads a full Python environment
- Data theft tools activate in the background
Because each step looks routine, many security tools fail to flag it right away. Researchers also noted that antivirus engines initially showed zero detections for key parts of the attack. That does not mean the file is safe. It means the malicious behavior is well hidden.
What this fake Windows update malware is stealing
Once installed, the malware gets to work fast. It collects details about the infected device, including location and IP address. Then it reaches out to remote servers to receive instructions and upload stolen data.
The targets include:
- Saved browser passwords
- Login sessions and cookies
- Payment details
- Discord account tokens
It even tries to shut down other processes on your system to avoid interference while it works. In some cases, it modifies apps like Discord to intercept account activity in real time.
How the fake Windows update malware stays on your system
This malware is designed to stick around. It creates entries that look like normal system processes, so they blend in. One registry entry mimics Windows Security Health, which most users would ignore. It also drops a shortcut in your startup folder with a familiar name like Spotify. That makes it easy to overlook. Two different persistence tricks mean it can survive a reboot and keep running.
FAKE WINDOWS UPDATE PUSHES MALWARE IN NEW CLICKFIX ATTACK
A fake Windows update page is tricking users into downloading malware that steals passwords, payment details and account access. (Beata Zawrzel/NurPhoto)
Why this fake Windows update scam feels so real
There’s a bigger trend behind this. Researchers say campaigns like this often target regions where large data breaches have already exposed personal information. When attackers already know your name, provider or habits, they can build scams that feel tailored to you. That makes a fake Windows update page far more believable than a generic phishing email.
It also highlights something important. Today’s malware often hides inside legitimate tools and trusted frameworks. That makes it harder to detect and easier to trust. This campaign shows how far scammers have come. They are no longer relying on sloppy emails or obvious fake links. Instead, they are building layered attacks that look and behave like trusted software.
Even experienced users can get caught off guard when everything appears normal. The biggest takeaway is simple. A clean scan result or a familiar interface does not guarantee safety.
Microsoft says it’s aware of the threat
Microsoft confirmed it is tracking this type of activity and urges users to be cautious when downloading updates from unfamiliar sources.
“We are aware of reports of fraudulent websites impersonating Microsoft, and we actively work to detect and disrupt malicious activity across the internet,” A Microsoft spokesperson told CyberGuy. “We encourage customers to be cautious of unexpected prompts or downloads and to verify that they are interacting with legitimate Microsoft domains. As a best practice, we recommend users verify the legitimacy of a link by going directly to our website from your own saved favorite, from a web search, or by typing the domain name yourself.”
For more guidance on how to protect against online phishing scams, you can refer to Microsoft’s official support page at support.microsoft.com.
MICROSOFT CROSSES PRIVACY LINE FEW EXPECTED
A convincing Windows update scam is spreading malware that can grab saved passwords, cookies, payment data and Discord tokens. (Todor Tsvetkov/Getty Images)
Ways to stay safe from fake Windows update malware
You don’t need to be a security expert to avoid this. A few habits make a big difference.
1) Only update Windows from your settings
Go to Settings > Windows Update and check for updates there. Avoid downloading updates from websites.
2) Double-check the URL
Real Microsoft pages use microsoft.com. Anything else, even if it looks close, should raise a red flag.
3) Be cautious with urgent update prompts
If a site or message pressures you to install an update, stop and verify it manually.
4) Use strong antivirus software with behavior detection
Traditional antivirus software, which often comes built into your device or as basic security software, mainly looks for known threats using signature matching, which means it can miss new or well-hidden attacks like this one. Strong antivirus software uses behavior detection to monitor what programs are doing in real time, helping flag suspicious activity even if the malware hasn’t been seen before. Get my picks for the best 2026 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com.
5) Use a data removal service to limit your exposure
If your personal information is already circulating online from past breaches, it can make scams like this more convincing. A data removal service helps reduce how much of your information is publicly available, making it harder for attackers to target you with tailored phishing attempts. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com
6) Turn on two-factor authentication
Two-factor authentication (2FA) adds a second layer of protection if your passwords are stolen.
7) Avoid downloading installer files from unknown sites
Legitimate updates rarely require manual downloads.
Kurt’s key takeaways
Fake updates are one of the most effective tricks because they tap into something we all trust. Keeping your system secure should not put you at risk, yet that’s exactly what attackers are exploiting here. The safest move is to slow down, verify where updates come from and stick to built-in tools whenever possible.
Are tech companies doing enough to keep fake updates from putting your data at risk? Let us know your thoughts in the comments below. Let us know by writing to us at Cyberguy.com.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com – trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Copyright 2026 CyberGuy.com. All rights reserved.
Technology
The Vergecast Vergecast, 2026 edition
We get a lot of questions about how The Verge works. And how The Vergecast works. And how we make money. And whether some of that money helps Nilay buy more jackets, several yachts, or something else entirely. So, every once in a while, we spend an episode of the podcast answering as many questions as we can.
On this episode of The Vergecast, Nilay and David are joined by The Verge’s publisher, Helen Havlak, to talk about ads, subscriptions, our website, our audience, and more. Then, Nilay and David answer some more questions about how we think about journalism, our relationship with Verge alumni, video podcasts, and (of course) Brendan Carr.
Thanks to everyone who sent us questions for this episode, and please keep them coming! You can always call the Vergecast Hotline (866-VERGE11) or send us an email (vergecast@theverge.com) with your questions, thoughts, feelings, and misgivings about everything we’re up to. We truly love hearing from you. And if you want to be part of everything we’re up to, and help make The Verge even bigger and better, the best thing you can do is subscribe! You even get all our podcasts ad-free.
Oh, and also, in case you missed it yesterday, be sure and check out our emergency pod on the news that Tim Cook is stepping down as Apple CEO. We’ll be talking more about the future of Apple on Friday’s show, too, so send questions if you have ’em!
-
New York1 hour agoTrump’s Immigration Crackdown Pervades Long Island Suburbs
-
Detroit, MI2 hours agoChris Simms projects Detroit Lions first-round NFL draft pick
-
San Francisco, CA2 hours agoSan Francisco sets $3.4B price tag for public takeover of PG&E
-
Dallas, TX2 hours agoGame Day Guide: Stars at Wild | Dallas Stars
-
Miami, FL2 hours agoMay a steadying presence as Cards hold off Marlins in Miami
-
Boston, MA2 hours agoTyrese Maxey, VJ Edgecombe flex in Boston: Takeaways from Celtics-76ers Game 2
-
Denver, CO2 hours agoMotorcyclist seriously injured in Denver hit-and-run crash – AOL
-
Seattle, WA2 hours agoBrock: 2 drafts fits at edge rusher for Seattle Seahawks