For years, phishing was the online threat everyone knew by name. In the first quarter of 2026, something changed: scams – fake retail domains, recruitment traps, spoofed event portals – overtook traditional phishing for the first time. According to the report Akamai published on 29 October, attackers have also become faster: the average lifespan of a phishing campaign has halved. Taken together, those two numbers mean the usual SMB defences – a blocklist, an annual training session, “IT will let us know” – no longer keep pace.
What the Akamai report found
AI-Driven Digital Deception: The Fraud and Abuse Report 2026 is the twelfth year of Akamai’s State of the Internet series. The findings are drawn from attacks observed across Akamai’s own infrastructure, which handles a significant share of global web traffic. The headline figures:
- Scams overtook phishing. Scam detections roughly doubled, from about 3.2 million to about 6.4 million.
- Average campaign lifespan fell from 48 days to 22 days (Q4 2025 to Q2 2026), a drop of more than 50%. The drivers: phishing-as-a-service toolkits, bulk domain registration and fast-rotating infrastructure built to evade static blocklists.
- Nearly 70% of impersonated brands came from three sectors: high technology (41.6%), financial services (18.9%) and commerce (8.4%).
- 26.6% of all login attempts were high- or critical-risk. Within that traffic, account verification requests made up 40% – attackers validate email addresses first, then launch credential stuffing at scale.
- Commerce is the biggest target: it accounted for 41.1% of all login attempts, driven by account takeover and loyalty-point abuse.
- Latin America and Asia-Pacific are the most exposed regions, with 37.8% and 36.4% of login attempts rated high- or critical-risk.
Patrick Sullivan, Akamai’s CTO for Security Strategy, puts it plainly: the fight against fraud “is no longer just an isolated financial function”. Autonomous AI agents and synthetic identities are now used for business logic abuse and data exfiltration.
Why this matters for SMBs
Three reasons. First, attackers do not need the enterprise’s systems – they borrow the enterprise’s brand. The fake courier notice, bank SMS or software invoice lands in your employee’s inbox. Second, a 22-day lifespan means that by the time a domain reaches the blocklists, the campaign is already over. Purely reactive defence arrives late. Third, if you run an online shop, a booking system or a customer portal, your login page is the target – and loyalty points, stored cards and coupons convert to cash just like a bank account.
For companies operating in Latin America, the 37.8% figure is a direct warning: more than a third of login traffic in the region is risky.
What to do this week
- Multi-factor authentication everywhere: email, banking, shop admin, CRM, social accounts. A validated email address should be worth nothing on its own.
- Watch your login patterns. A sudden spike in “forgot password” and account verification requests is not customer interest – it is preparation. Set rate limits and alerts.
- Protect your own brand. Register domain variants, configure SPF, DKIM and DMARC, and monitor for look-alike copies of your name.
- Quarterly, not annual, awareness training, using current examples: fake job offers, bogus event registrations, an AI-written “request from the boss”.
- Least privilege and segmentation. One compromised account should never reach invoicing, payroll and the customer database at once.
- A simple reporting path. Anyone should be able to flag a suspicious email in 30 seconds, without blame, even after clicking.
When defence has to be faster than the attacker
The report’s message is simple: attacks are mass-produced, automated and short-lived, so defence has to be continuous. BoostYourBiz’s B2B cybersecurity service delivers exactly that at SMB scale: we assess your login surfaces, email infrastructure and permissions, implement multi-factor authentication and monitoring, and train your team on the scams this report describes. See our cybersecurity page for details, or reach us via the contact page for a free initial assessment.
Source: Akamai Technologies (GlobeNewswire) – “Akamai Report: AI-Driven Digital Deception Is Escalating Enterprise Fraud and Shrinking Phishing Lifespans”, 29 October 2026. Original release