Bolster AI says online scam detections roughly doubled from 3.2 million to 6.4 million and passed phishing in volume for the first time, in research featured in Akamai’s 2026 State of the Internet fraud and abuse report.
The figures come from a Bolster AI release issued on October 29 and cover July 2025 to June 2026. Bolster AI reports that scam detections overtook traditional phishing in the first quarter of 2026. Its scam category covers counterfeit storefronts, investment scams and payment fraud. Phishing has not gone away: Bolster AI says phishing detections grew 61% by the second quarter of 2026.
The second finding concerns speed. According to Bolster AI, the average lifespan of a phishing attack fell from 48.3 days in the fourth quarter of 2025 to 22 days in the second quarter of 2026, a drop of more than half.
Bolster AI says attackers run these campaigns across websites, social media, advertisements and digital marketplaces, using AI-generated content, localized social engineering and shared infrastructure. It describes fraudulent ads, counterfeit sites and impersonation that use a legitimate brand without compromising the brand owner’s systems.
“Credential theft remains a major threat, but attackers are increasingly exploiting the trust consumers place in legitimate brands to steal money directly,” said Rod Schultz, CEO of Bolster AI.
The data is the vendor’s own detection counts. In our reading, the practical change for security teams is ownership. A fake storefront that uses a company’s name sits outside its network, so the work of finding and removing it falls to brand protection, fraud and legal teams as much as the SOC. Related coverage: our brief on Keeper’s phishing protection, and our brief on Mailprotector Shield Blueprints.
