TL;DR — Key Takeaways
- Online scams have doubled: Akamai reports a surge from 3.2 million to 6.4 million attacks, pushing scams ahead of traditional phishing.
- AI is industrializing cybercrime: Automated phishing campaigns, synthetic identities and rapidly rotating infrastructure make fraud cheaper, faster and harder to detect.
- Traditional defenses aren’t enough: As attackers shift toward direct financial fraud and business logic abuse, organizations need coordinated cybersecurity and fraud prevention.
Online scams doubled in volume and, for the first time, passed traditional phishing in the first quarter of 2026, according to security and content delivery network (CDN) Akamai‘s new study, AI-Driven Digital Deception: The Fraud and Abuse Report 2026.
Drawing on data from Bolster AI, an anti-phishing firm. Akamai asserts that scams have risen from about 3.2 million to about 6.4 million attacks. Ouch! These scams are fraud meant for “financial or consumer deception rather than credential harvesting.” Examples of these next-generation attacks on your checkbook include fake stores, investment scams, and tech-support scams.
It isn’t just you and me that are being hit by these. Akamai gives the example of the welcome bonus fraud, aka promo abuse, in which attackers automate account
registration to repeatedly collect incentives intended for new or first-time customers, including cash promos or discounts. “The success of this scheme relies on the creation of a large pool of fabricated fake identities, enabling fraudsters to operate at a scale that manual registration won’t be able to support.”
Why the shift to scams from phishing? Well, one reason is that AI makes these frauds much easier to build. Another, Akamai says, is that criminals are shifting because defenses have improved. “Since MFA [Multi-Factor Authentication] has become a baseline security measure, attackers are pivoting toward higher-return scams for faster payouts.” That said, traditional phishing still grew 61% by the second quarter.
How phishing attacks are being implemented is changing, though. By Bolster’s numbers, the average phishing attack ran for 48.3 days in the fourth quarter of 2025 but only 22.0 days in the second quarter of 2026. What’s changed? Akamai blames phishing-as-a-service toolkits, bulk domain registration, and fast-rotating infrastructure. That means replacement sites can “go live within hours” once one is taken down. Happy, happy, joy, joy!
What’s driving this is–surprise~!–AI. Akamai explained, “Adversaries leverage AI to generate dynamic templates, produce multilingual lures at scale, and deploy condition-aware evasion, drastically lowering costs while bypassing legacy defenses.” Sure, Akamai agrees, it certainly helps that defenders use AI too, cutting investigations “from days to less than an hour,” but the attackers have the first-mover advantage,
Patrick Sullivan, Akamai’s CTO for security strategy, added, “The fight against fraud is no longer just an isolated financial function; it is a critical, cross-functional cybersecurity imperative.” He continued: “As autonomous AI agents and synthetic identities redefine how customers interact with brands, threat actors are exploiting these same vectors to conduct business logic abuse and zero-click data exfiltration.”
On top of that, Akamai’s DNS data show phishing rose from 8% of threat traffic in the first quarter to 15% in the second. Thus, phishing moved from seventh to second place behind malware. Nearly 70% of phishing threats impersonated three sectors: high technology (41.6%), financial services (18.9%), and commerce (8.4%).
Hackers, or more accurately the AIs they use, generated about 26.6% of high- or critical-risk login attempts in a 30-day sample from Akamai’s Account Protector product. Account-verification requests made up 40% of that risky traffic. Akamai says this suggests attackers check whether email addresses map to real accounts before launching credential-stuffing attacks.
Akamai isn’t the only one seeing these trends. An IBM study found AI cuts the cost of targeted phishing. In a study of 101 participants, fully automated AI spear-phishing emails drew a 54% click rate, the same as human experts. Meanwhile, a control group of arbitrary phishing emails drew 12%.
The IBM authors, who included top security analyst Bruce Schneier, estimated that AI can raise profitability “by up to 50 times for larger audiences.” In an IBM test, a generative AI model produced a phishing email in five minutes. IBM’s team usually needs about 16 hours. It doesn’t take a criminal mastermind to see that, thanks to AI, it’s cheaper and more efficient than ever for the bad guys to create convincing phishing messages.
The FBI’s 2025 Internet Crime Report logged $20.877 billion in losses across 1,008,597 complaints. It tagged 22,364 complaints as “AI-related,” with $893,346,472 in losses. That is about 2.2% of complaints and 4.3% of losses. But those AI-empowered attackers are growing at a rapid rate.
In short, you need to be more careful than ever when an e-mail or IM comes across your virtual transom. AI-crafted phishing and fraud will appear more often than ever, and they’ll be harder than ever to tell from real messages. Just what we all needed, but here we are.
Recent Articles By Author
Frequently Asked Questions
Why are online scams overtaking phishing?
AI makes financial scams easier to create and scale, while stronger authentication defenses are pushing cybercriminals toward more profitable forms of deception.
How is AI making phishing more dangerous?
AI generates convincing messages, multilingual lures and fraudulent websites in minutes, allowing attackers to launch more campaigns with less effort.
What can businesses do to fight AI-powered fraud?
Combine real-time threat detection, behavioral analytics, bot management and stronger identity verification with closer collaboration between security and fraud teams