Akamai: online scams double and overtake phishing

Online scams doubled to 6.4 million and overtook phishing

Scammers chased faster payouts, and online scam detections passed phishing for the first time in the first quarter of 2026. Akamai, a US cybersecurity and cloud computing company, released the report on October 29 (US time) as the latest edition of its State of the Internet (SOTI) series. The series is now in its 12th year and draws on attacks Akamai sees across its own security infrastructure.

Akamai's Japanese arm published a Japanese-language release on November 2, translated from an announcement made in Singapore on October 30. That version explains the shift plainly: attackers put immediate financial fraud ahead of stealing credentials for later use.

Fake stores and job lures drove the jump

Akamai points to fake retail domains, social recruitment traps and spoofed event portals, and says higher financial returns pushed scams up. According to Akamai, detections went from about 3.2 million to about 6.4 million. UK trade outlet Infosecurity Magazine reported that the two periods being compared were July to September 2025 and April to June 2026, and that the scam and phishing figures came from Akamai partner Bolster AI. The scam category covers four main types:

• Fake online stores
• Investment scams
• Tech support scams, where a fake helpdesk charges victims to "fix" a computer problem
• Payment fraud

Phishing still grew 61% over the same period

Phishing did not shrink while scams took the lead, as phishing detections still rose 61%. Infosecurity Magazine reported that reusable phishing kits, attack infrastructure built for volume, and AI drove that increase. Scams simply grew faster, and Akamai says threat actors now use AI and automated infrastructure to get past security that only guards the edge of a company network and to abuse the trust people place in well-known brands.

Phishing sites now last 22 days instead of 48

Attackers now discard phishing sites faster, leaving defenders less than half the time they had to find and take them down. Akamai put the average phishing lifespan at 48 days in Q4 2025. By Q2 2026 it was 22 days, down more than 50%.

The Japanese release puts the earlier figure at 48.3 days. It says security teams now have far less time to detect and shut down a threat.

Kits and bulk domains help attackers outrun blocklists

Attackers rent ready-made phishing kits, register domains in bulk and swap sites before they land on fixed blocklists. Akamai names three tools: phishing-as-a-service (PhaaS) kits, bulk domain registration and fast-rotating infrastructure. A PhaaS kit lets criminals rent a complete phishing setup. A blocklist is a list of known bad URLs or domains that browsers and filters refuse to load.

If a site moves to a new domain before anyone adds it to the list, a defense that only blocks known addresses never catches it. Infosecurity Magazine quoted the report as saying attackers use AI to produce templates and lures in many languages at once.

Nearly 70% of phishing impersonated tech, finance and commerce brands

High-tech brands topped the list at 41.6%, ahead of financial services (18.9%) and commerce (8.4%). Together those three sectors account for nearly 70% of the phishing Akamai tracked. The same pattern showed up in malicious domains aimed at company networks during the reporting period, where most also posed as brands from those three sectors.

A quarter of logins were high risk, 36.4% in Asia-Pacific

Login abuse that comes before account takeover was widespread, and Asia-Pacific's 36.4% was second only to Latin America's 37.8%. Across all the login attempts Akamai recorded, 26.6% were rated high or critical risk. The regional breakdown comes from the Japanese release:

Share of login attempts rated high or critical risk, by region (Akamai)

Region	Share
Latin America	37.8%
Asia-Pacific	36.4%
EMEA (Europe, Middle East and Africa)	23.7%
North America	23.6%
All regions	26.6%

That means more than one in three login attempts in Asia-Pacific were flagged. North America and EMEA both came in below the overall average.

40% of risky logins checked whether an email had an account

Akamai reads these requests as attackers testing which email addresses are registered before they launch credential stuffing. Credential stuffing means taking username and password pairs stolen from one site and trying them on many others. Of the high- and critical-risk login traffic, 40% were account verification requests, which simply ask whether an account exists for a given email address.

The Japanese release adds a caveat that matters: the risk label marks activity that may be malicious, not attacks that succeeded. By industry, commerce saw the most login attempts at 41.1%, which Akamai says makes online stores a target for account takeover and loyalty-point abuse.

Banks and fintechs drew 12.5% of attacks in APAC

Banks accounted for 6.4% and fintech for 6.1%, and in July 2026 one large financial institution was hit with two tactics at once. The Japanese release says financial services were the most targeted industry in Asia-Pacific, at 12.5% of observed attack activity.

In the July attack, the institution received 42,000 automated requests built to test stolen credentials in bulk, over seven days. At the same time, someone tried to open accounts with just 164 carefully spaced requests, small enough to stay under detection thresholds.

In Southeast Asia, researchers also analyzed 2,157 URLs tied to campaigns that used travel searches to send people to gambling sites. Reuben Koh, who covers security strategy for Akamai in Asia-Pacific and Japan, said a login, a new account or a small payment can look normal on its own and still be part of a larger attack.

Akamai recommends checking intent and behavior at every stage of the account lifecycle, from sign-up and login through to payment. Better tools for spotting automated (bot) traffic, it says, can catch small attacks designed to slip past detection.

What online store operators and shoppers can do

Login abuse is the operator's problem to fix, while fake stores and phishing emails go after shoppers, so each side has a different set of steps. Commerce had the most login attempts in Akamai's data, and commerce brands were among the most copied in phishing.

Japan's regulators publish guidance for both sides. The trade ministry and the National Police Agency cover what businesses should do, and the police and two consumer bodies cover what shoppers should do. Three steps for each follow.

Store operators: protect sign-up, login and checkout

Japan's trade ministry expects online merchants to verify customers at login and to use EMV 3-D Secure, and the police recommend sender-domain authentication. On March 5, 2025, the Ministry of Economy, Trade and Industry (METI) announced a revision of Japan's Credit Card Security Guidelines, which set out the security measures that businesses handling card payments are expected to take.

The guidelines serve as the practical standard for the security duties set by Japan's Installment Sales Act. For an online store that takes cards, three steps stand out.

Add a second identity check at login

The revised guidelines ask online merchants to put login-time identity checks in place to stop unauthorized logins. If a store lets anyone in as long as the username and password match, it cannot tell a customer apart from someone using that customer's stolen credentials.

Add a step that confirms the person at login, such as a one-time code sent by email or text message. With that in place, a stolen username and password alone are no longer enough to finish signing in.

Use EMV 3-D Secure for card payments

The same revision asks online merchants to check the cardholder at payment as well as at login. EMV 3-D Secure is a card-payment service that asks the cardholder to confirm their identity during checkout.

Akamai says online stores attract account takeover and loyalty-point abuse because they get so many logins. Even if an attacker gets into an account, a card payment will not go through without passing that checkout step.

Publish DMARC to stop spoofed email from your domain

Japan's police say that DMARC, a sender-domain authentication standard, lets a company tell receiving mail servers to reject messages that fake its domain. Some phishing campaigns send their lures from addresses that look exactly like a real company's. The police list three main standards:

• SPF: checks that the sending server's IP address is allowed to send for the domain
• DKIM: verifies a digital signature added to each message
• DMARC: combines SPF and DKIM and lets the sender say what receivers should do with mail that fails

Nearly 70% of the phishing Akamai tracked posed as tech, finance or commerce brands. Set up SPF and DKIM for your domain, then publish a DMARC policy.

Shoppers: spot fake stores and phishing emails

Japanese police and consumer regulators tell shoppers not to open stores from email links and to check a site before placing an order. Because fake sites now come and go within weeks, a list of known bad addresses will not catch them all. Three habits help.

Open stores from bookmarks or official apps, not links

Because a link cannot be judged by how it looks, the police advise opening official sites from bookmarks or official apps. Links in email can be disguised, and many phishing sites use domain names that look almost identical to the real one.

Bookmark the stores you use, or open them through their official apps. If an email asks you to re-enter an order or update a payment method, ignore the link and sign in through your bookmark or the app instead.

Check the URL, contact details and payment options before ordering

Japan's Consumer Affairs Agency warns about fake sites that copy real online stores. It asks shoppers to check five things before buying:

• Is it the store's official URL?
• Does the site list contact details such as a phone number or email address?
• Is the price unusually low?
• Are payment options limited?
• Does the text read naturally?

The National Consumer Affairs Center of Japan published its own checklist on June 17, 2026, after complaints about orders that never arrived. Its warning signs include:

• The bank account for payment is in an individual's name, not the business's
• There are no cancellation, return or refund rules anywhere on the site
• The business name, address and phone number are not clearly shown

The center advises not ordering if anything feels off. Even with a store you use often, hold off if the URL looks different from usual.

Use a unique password and one-time codes

Passwords stolen from one site get tried on others, so the police advise a different password for each site plus one-time passwords. In Akamai's data, 40% of risky logins were checks on whether an email address had an account. Reuse one password, and a leak at one site can open your accounts at other stores and your bank.

If you cannot remember them all, the police suggest a password manager. For a sense of how long and complex a password should be, see Password strength: 12 letters beat 8 with symbols.