Santa Clara – October 29, 2026 -- Online scam detections roughly doubled from 3.2 million to 6.4 million over the past year and surpassed traditional phishing in volume for the first time, according to Bolster AI threat intelligence featured in Akamai's 2026 State of the Internet: Fraud and Abuse Report.
Scams pass phishing in Q1 2026 as attackers pursue direct payment
Bolster AI drew on data collected between July 2025 and June 2026. Scams overtook phishing in Q1 2026, driven by counterfeit storefronts, investment scams and payment fraud. Attackers are moving from credential theft toward taking money directly from consumers.
Phishing is not shrinking. Phishing detections grew 61% by Q2 2026, so criminals are adding tactics rather than replacing old ones.
Phishing attack lifespan falls from 48.3 to 22 days
The average lifespan of a phishing attack dropped from 48.3 days in Q4 2025 to 22 days in Q2 2026, a decline of more than 50%. Security teams have less than half the previous window to identify and take down a malicious campaign.
Fraud crews run AI-generated content across websites, social media and ads
According to the research, attackers combine AI-generated content, localized social engineering and shared infrastructure. They operate across websites, social media, advertisements and other digital platforms. This makes coordinated operations harder to identify and disrupt.
Fraudulent ads, counterfeit sites and impersonation campaigns can exploit a legitimate brand without breaching its internal systems. The report therefore points to connecting threats across channels and disrupting the infrastructure behind campaigns, rather than handling individual malicious sites in isolation.
"Credential theft remains a major threat, but attackers are increasingly exploiting the trust consumers place in legitimate brands to steal money directly," said Rod Schultz, CEO of Bolster AI.
Bolster AI models trained on more than 10 billion data points
Bolster AI's detection capabilities analyze millions of websites daily using models trained on more than 10 billion data points. Akamai and Bolster AI are hosting a webcast to discuss the findings.