For years, phishing has been one of the most persistent threats in cybersecurity. But the economics of cybercrime are changing, and new research suggests we’ve reached a turning point. In Akamai’s newly released 2026 State of the Internet: Fraud and Abuse Report, featuring threat intelligence from Bolster AI, researchers identified a significant shift: For the first time, online scams have surpassed traditional phishing in detected volume.
This isn’t just another cybersecurity statistic. It’s a signal that attackers are changing how they monetize trust and that our approach to protecting businesses and their customers needs to evolve alongside them.
The tipping point: Scams overtake phishing
According to Bolster AI research featured in the report, online scam detections approximately doubled during the reporting period, climbing from 3.2 million to 6.4 million. By the first quarter of 2026, scam activity had surpassed traditional phishing.
And phishing hasn’t disappeared. In fact, traditional phishing detections also grew by 61% by the second quarter of 2026. What’s changing is the objective.
Traditional phishing primarily focuses on stealing credentials or sensitive information. Online scams often skip that step entirely, targeting victims directly through fraudulent purchases, fake investments, impersonation schemes, and payment fraud.
Why steal credentials and work your way into an account when you can convince someone to send you money directly? As multifactor authentication and other account security measures become more widespread, attackers are finding new ways to generate returns. They’re exploiting something that technology alone cannot fully secure: the trust people place in familiar brands.
Your brand has become an attack surface
One of the most important messages in Akamai’s report is that the enterprise attack surface no longer ends at the network perimeter. Think about how customers interact with a business today. They might discover a product through a sponsored search result, engage with a brand on social media, download an app, visit an online marketplace, or respond to a customer support message.
Every one of those interactions creates an opportunity for attackers to impersonate a legitimate organization. A fraudulent advertisement can direct someone to a counterfeit storefront. A fake social media profile can initiate a conversation that leads to payment fraud. A cloned recruitment portal can exploit the credibility of a well-known employer to steal personal information.
The victim may never interact with the legitimate company’s infrastructure. But when the scam succeeds, the real brand can still suffer the consequences: lost customer confidence, reputational damage, and increased costs associated with fraud response and customer support. This is why brand impersonation can no longer be treated as simply a trademark issue or a collection of suspicious domains to take down.
Brand trust is now a security asset. And protecting it is a business imperative.
Attackers are moving faster. Defenders need to think differently
The report also highlights how quickly the operational dynamics of phishing are changing. Bolster AI research found that the average phishing attack lifespan dropped by more than 50%, from approximately 48 days in the fourth quarter of 2025 to just 22 days in the second quarter of 2026.
That’s a significant compression of the time defenders have to identify and disrupt malicious infrastructure. Meanwhile, attackers are increasingly using automation and AI to generate convincing content, localize campaigns, rotate infrastructure, and evade detection.
These aren’t always isolated attacks. What appears to be a series of unrelated phishing pages or scam sites may actually be part of a larger operation sharing common infrastructure, templates, or back-end services. That distinction matters.
If defenders focus exclusively on individual malicious URLs, they risk spending their time reacting to symptoms rather than disrupting the underlying operation. The opportunity is to connect the signals across domains, social media, paid advertisements, applications, and other digital surfaces to identify coordinated campaigns earlier. We need to move from chasing individual threats to understanding the infrastructure and relationships that enable them.Â
Cybersecurity and fraud prevention are converging
Historically, organizations have treated cybersecurity, fraud prevention, and brand protection as separate disciplines. Security teams protect systems and identities. Fraud teams investigate suspicious transactions. Brand and legal teams pursue impersonation and intellectual property abuse.
But attackers don’t respect those organizational boundaries. A single campaign might begin with a fraudulent advertisement, lead to a counterfeit website, capture payment information, and ultimately enable account takeover or additional fraud.
The entire operation is connected, even if different internal teams are responsible for responding to each stage. The Akamai report reinforces the importance of breaking down these silos and developing a more integrated view of digital risk.
For security leaders, that means expanding visibility beyond owned infrastructure and recognizing that protecting customers increasingly requires understanding threats that originate outside the enterprise.
It also means measuring success differently. The goal shouldn’t simply be how many fraudulent domains were discovered or removed. It should be how effectively organizations identify coordinated threats, disrupt campaigns, and reduce opportunities for attackers to exploit customer trust.
What comes next
As we look toward 2027, I believe three changes will define the next generation of digital threat protection.
First, external threat visibility will become foundational to cybersecurity. Organizations need to understand how their brands, executives, and digital identities are being exploited across the broader internet—not just what happens inside their environments.
Second, intelligence will matter as much as detection. Finding a malicious website is useful. Understanding the infrastructure behind it, the other attacks connected to it, and how to disrupt the broader campaign is far more valuable.
Third, speed will become a competitive advantage for defenders. As AI lowers the cost of launching attacks and infrastructure becomes increasingly disposable, security teams will need to automate more of the detection, investigation, and response process.
At Bolster AI, these are challenges we’ve been working to address, and we’re proud that our research contributed to Akamai’s latest State of the Internet report. But the larger takeaway extends well beyond any one company or technology. Cybercriminals have recognized that a trusted brand can be one of the most effective tools for committing fraud. It’s time we treated that trust as something worth defending with the same urgency as our networks, applications, and data.
The future of cybersecurity isn’t just about protecting the systems a business owns. It’s about protecting the trust a business has earned.
Explore the findings in Akamai’s 2026 State of the Internet: Fraud and Abuse Report.
