Remember all those cybersecurity scares from last year? Well, bad news: the threat level is still sky-high in 2026. In fact, there is an 18 percent increase in cyber-attacks year over year and cybercriminals are getting even smarter. They’re continuing to use cutting-edge tech like AI to create more believable and effective scams, targeting individuals and businesses across various sectors. Understanding these trends is no longer optional.
October is Cybersecurity Awareness Month and it is more essential than ever to become aware and stay ahead of financial crime. Each year, the National Cybersecurity Alliance releases research to better understand the public’s security behavior and to act as a call to action for better secure habits online. You can read the report’s key findings here >
Key Findings
AI is still a concern
-
65% of respondents believe AI will make it easier for criminals to pose as someone else.
-
Despite the surge in AI usage, 58% of users report receiving no training on security or privacy risks.
Cybercrime is hitting wallets harder than ever
-
44% of respondents reported experiencing cybercrime that led to data or monetary loss, a 9% increase from 2024.
-
Younger generations were hit hardest: 59% of Gen Z and 56% of Millennials reported losses from scams.
Security habits show ongoing weaknesses
-
62% of respondents report regularly creating unique passwords, a decline from 2024, while 41% never use a password manager.
-
While multi-factor authentication is widely recognized (77%), only 41% use it regularly.
-
56% of participants update their software frequently, though only 47% consistently back up important data.
Key 2026 Fraud Trends
It’s a scary world out there, but as an official 2026 Champion of #CybersecurityAwarenessMonth, Heritage Valley is here to help break down the biggest cybersecurity trends of 2026 and give you the tools to protect yourself. We’ll cover the latest scams, how to spot them, and how to keep your personal and financial info safe.
AI-Generated Fraud
AI-generated fraud in 2026 is defined by hyper-realistic deepfakes, autonomous fraud agents, and synthetic identity scaling. Criminals use artificial intelligence to bypass traditional security filters and manipulate victims across borders with ease. AI scams surged 1,210% in 2025, far outpacing the 195% growth in traditional fraud, and projected losses could reach $40 billion by 2027.
- Deepfake Impersonation: Scammers use real-time video and voice cloning to mimic corporate executives or family members during live calls to authorize large financial transfers.
- Synthetic Identity Creation: Fraudsters mix stolen credentials with AI-generated headshots and fake histories to seamlessly pass digital bank onboarding checks.
- Autonomous Fraud Agents: Automated machine networks execute personalized, multi-language phishing campaigns and scale scraping attacks without manual effort.
- All-Green Fraud: Attacks succeed inside fully authenticated user sessions, making malicious activity nearly invisible to standard point-in-time security checks.
Because AI can access and analyze immense amounts of data and information online, cybercriminals are using it to develop fraudulent emails, fake websites (domain spoofing), and bogus text messages that look realistic and convincing. To help combat AI-generated fraud, the following proactive measures can mitigate its risks:
• Use complex, unique passwords
• Enable multi-factor authentication on all accounts
• Keep passwords and login information private
• Never access sensitive accounts on a public Wi-Fi network
• Regularly update operating system and security software
• Clear cache and browsing history
• Stay away from untrustworthy or suspicious websites
Deep-Fake Voice Scams
2026 could be the year you get fooled by a deep-fake, researchers are reporting as voice cloning has crossed the “indistinguishable threshold.” Cybercriminals are using AI to create voice recordings of celebrities, athletes, political figures, company employees, and even individuals’ friends and family members. The fraudsters make robocalls to people at home or work and play the AI-generated voice recordings to ask for personal information or money or solicit donations to a bogus charity of community initiative.
Some of the other deep-fake voice scams used by fraudsters include asking for money to receive a “free” trial of a non-existent product or service, paying shipping fees for a “free” prize that doesn’t exist, and paying for a bogus service warranty/extended warranty for a product you purchased. In all of these cases, the fraudsters take the money from their victims and run.
Because the AI-generated recordings sound realistic, it can be hard for people to realize they are being scammed. Individuals and business owners can follow these tips to avoid falling for a deep-fake voice scam:
• Don’t answer calls from unknown telephone numbers
• Never give out personal or business information over the phone
• Hang up if you hear unnatural speech patterns or long pauses
• Ask the caller to verify their identity, company name, etc., and check it online
• Report the suspected scammer’s phone number to the Federal Trade Commission (FTC)
• Add your phone number to the National Do Not Call Registry at https://www.donotcall.gov
Quantum AI Investments Scams
Quantum AI Investment is a notorious scam that uses fake news stories, deepfake celebrity endorsements, bogus testimonials from non-existent individuals, and misleading promises of high returns to trick people into investing. The scammers promote their investment scams on fake websites and social media. Unsuspecting investors are lured in with the promise of unrealistic profits, only to find themselves losing money.
There are measures you can take to avoid becoming a victim of a quantum investment scam. For starters, if you see an investment opportunity online that sounds too good to be true, it probably is, so avoid it. Next, be wary of news articles, videos, and social media posts that contain links to unknown websites. Cyberthieves create realistic-looking websites with slightly different domain names to trick users into visiting them and, once there, to provide personal and/or financial information.
Finally, be cautious when you see email signup lists that advertise investment opportunities promising unrealistic returns. Cybercriminals promoting quantum AI investment schemes may inundate you with deceptive emails.
Spear Phishing
Spear phishing is no longer a niche threat; it represents the dominant attack vector for initial access in 2026. Traditional phishing scams are designed to steal money from as many unsuspecting victims (individuals and businesses) as possible via a bulk of spammy emails, text messages, or phone calls. The victims are tricked into sharing bank account information or credit card numbers or making a wire transfer to a fake vendor.
Spear phishing is a type of phishing attack that targets a specific individual, group or organization. These personalized scams trick victims into divulging sensitive data, downloading malware or sending money to an attacker. The fraudsters spend time researching their targets to craft email messages that appear credible (e.g., from a family member, business associate, vendor, or frequently visited website). They gather information from business websites, online forums, and social media to build a profile of their spear phishing targets.
This tailored approach to a social engineering attack increases the likelihood of success for the fraudster. It makes it more difficult for the recipient to recognize it as a spear phishing scam, ultimately posing a greater threat to individuals and businesses. However, there are ways to spot spear phishing scams. These include emails from unusual sending addresses, text messages from unknown senders, emails with poor grammar/spelling errors, and spammy phone calls. These are all red flags, especially if you are told to act quickly and provide personal and financial information.
Formjacking
Whether filling out a personal information form on a website or purchasing at an online store, sensitive information is transferred digitally. And if hackers have compromised a website form, they may be able to steal the information. This type of fraud is known as formjacking, when cybercriminals inject malicious code into a website’s online forms, often without the company’s information technology (IT) team knowing.
The malicious code works behind the scenes, collecting the information that website users provide on forms (name, address, credit card numbers, etc.), and the fraudsters access this information illegally. This type of identity theft can result in financial losses from unauthorized transactions and negative impacts on credit scores.
There isn’t a universal solution to avoid falling victim to formjacking as a website user, but there are some proactive steps to take. Start by confirming the legitimacy of any website or app you use. Next, steer clear of websites that lack HTTPS data encryption, as any information provided will be at risk.
What To Do If You Are A Victim
Contact your credit union or bank right away and report fraud to the payment app or service and ask to reverse the transfer. You can also report fraud to the Federal Trade Commission at reportfraud.ftc.gov.
Awareness Tools Can Be Your Best Protection Against Fraud
You can keep up with the latest cyber security news through our weekly Fraud News & Alerts updates. Each week you will receive an email containing the latest cyber security news, tips and breach notifications.
SUBSCRIBE NOW TO HERITAGE VALLEY FRAUD NEWS & ALERTS >
View this Cybersecurity Awareness Month Tip Sheet from StaySafeOnline.org >
The opinions voiced in this material are for general information only and are not intended to provide specific advice or recommendations for any individual. Heritage Valley does not endorse nor is affiliated with the companies listed in this article.
