Akamai research shows online scams have overtaken traditional phishing attacks, while phishing campaigns are becoming shorter-lived.
Its 2026 State of the Internet Fraud and Abuse Report found scam detections nearly doubled to 6.4 million from 3.2 million, the first time those schemes have surpassed conventional phishing activity in its data.
At the same time, the average lifespan of a phishing campaign fell by more than half, from 48.3 days in the fourth quarter of 2025 to 22 days in the second quarter of 2026. Attackers were rotating infrastructure more quickly, with replacement sites in some cases appearing within hours of a takedown.
The report also highlighted a shift in account abuse tactics. More than a quarter of observed login activity, 26.6%, was flagged as high or critical risk, suggesting attackers may be validating real accounts before launching credential stuffing campaigns.
Changing tactics
The figures point to a fraud landscape shifting away from longer-running phishing operations towards shorter campaigns and direct-to-consumer scam activity. In practice, that leaves less time for security teams, platforms and brand owners to detect and remove malicious infrastructure before new assets appear.
Credential abuse remains a central issue. The report's assessment of risky login traffic suggests attackers are not only attempting large-scale account compromise, but also taking a more selective approach to identify which credentials or accounts are most likely to succeed in later attacks.
Direct losses
The rise in online scams reflects a growing emphasis on methods designed to persuade consumers to transfer money or disclose sensitive information directly. That differs from traditional phishing, which has often focused on harvesting credentials for later misuse.
The decline in phishing campaign duration also points to operational changes among attackers. Shorter-lived campaigns can make blacklisting, hosting disruption and domain takedowns less effective if fraudulent sites are replaced soon after removal.
For companies monitoring customer-facing fraud, the shift means a broader range of abuse patterns may need attention, from spoofed websites and login attacks to social engineering schemes aimed at immediate payment or account access.
The data also underlines the challenge for organisations that rely on established detection timelines. A phishing site that remains active for weeks presents a different defensive problem from one cycled out after a few days and replaced on fresh infrastructure.
Risk signals
The finding that 26.6% of observed login activity was classed as high or critical risk suggests account security remains a significant pressure point. If attackers are testing whether accounts are genuine before wider credential stuffing activity, companies may face a period of lower-visibility probing before larger attack volumes become apparent.
That approach could complicate defensive efforts because early-stage verification activity may appear less disruptive than a full credential attack. It also places more weight on spotting patterns in login behaviour before an attacker shifts to a broader attempt to access accounts at scale.
Akamai said the combined trends showed cybercriminals were accelerating attacks, exploiting consumer trust and using methods that are harder to detect and disrupt.