Detections of online scams doubled between July 2025 and June 2026, marking the first time scam activity surpassed phishing, according to Akamai's latest State of the Internet report published in late October 2026. The security vendor documented roughly 6.4 million online scams during April through June 2026, compared with 3.2 million recorded in July through September 2025. Cybercriminals appear to be shifting toward more direct methods of extracting revenue from victims, the report indicates.
The scam category encompasses fake storefronts, investment fraud schemes, tech support scams, and payment fraud, according to the report. Phishing detections also climbed during the same timeframe, rising 61% as attackers deployed reusable phishing kits, industrialized infrastructure, and artificial intelligence tools. The average lifespan of a phishing attack dropped by more than half, falling from 48 days in the fourth quarter of 2025 to 22 days in the second quarter of 2026. Data for the scam analysis came from Akamai's partner Bolster AI, the report notes.
"The fight against fraud is no longer just an isolated financial function; it is a critical, cross-functional cybersecurity imperative," said Patrick Sullivan, CTO of security strategy at Akamai. Adversaries are using AI to create dynamic templates, generate multilingual lures at scale, and deploy condition-aware evasion techniques, the report explains, which dramatically reduces costs while evading legacy defenses. Meanwhile, security teams are leveraging AI to compress investigation timelines from days to under an hour through automated indicator analysis, infrastructure clustering, and evidence collection. Sullivan noted that as autonomous AI agents and synthetic identities reshape how customers interact with brands, threat actors exploit these same channels for business logic abuse and zero-click data exfiltration.
The sharp rise in scam volumes reflects what the report describes as a strategic pivot by cybercriminals toward tactics that generate immediate financial returns rather than the multi-step process required for credential theft. AI has accelerated both sides of this arms race, enabling attackers to produce sophisticated campaigns faster and cheaper while also empowering defenders to identify and disrupt threats before victims suffer losses. The compression of phishing attack lifespans suggests criminals are racing to monetize their infrastructure before detection systems catch up. Separate research from the non-profit Identity Theft Resource Center, published October 28, revealed that over 80% of US scam victims reported suicidal thoughts following the crime, driven largely by self-blame, social stigma, and what the organization calls "institutional ghosting." Nearly nine in ten general consumer scam victims who sought help from an organization were never contacted, and 67.2% reported that the institutions they reached out to made them feel it was their own fault. The lack of support leaves victims vulnerable to recovery scams: 78.9% of general consumer scam victims paid a third party promising to recover stolen funds, repair credit, or catch the scammer, compared with just 6.5% of victims who connected with the ITRC.
The report frames fraud as no longer a siloed financial concern but a comprehensive cybersecurity challenge requiring cross-functional coordination. As AI tools become more accessible, the barrier to entry for sophisticated scam operations continues to fall, while the speed of attack cycles accelerates. Organizations abandoned scam victims at a moment when intervention could prevent both financial and psychological harm, the ITRC data suggests, and that abandonment drives victims toward secondary fraud schemes that compound their losses. The doubling of scam detections in a single year signals that attackers have found scalable, profitable models that outpace traditional phishing returns. For enterprise security leaders, the collision of rising scam volumes with shrinking attack lifespans demands a fundamental rethinking of detection velocity and cross-departmental response protocols, not incremental improvements to existing playbooks.