Scams & Phishing Scamming Becomes $422 Billion Business With AI Assistance

[Brownie2019]

Content source

https://www.pymnts.com/cybersecurity/fraud-prevention/2026/scamming-becomes-422-billion-business-with-ai-assistance/

Like many industries, scamming is getting an artificial intelligence-powered upgrade.

That’s according to a report Saturday (Oct. 10) by Bloomberg News, citing data from the Global Anti-Scam Alliance estimating victims lost $442 billion across 42 countries last year, more than some valuations for the worldwide cocaine trade.

“It’s just gotten so cheap and so easy,” said Sean Letz, the Asia cyber lead at Marsh Risk, an American insurance broker and risk-management adviser. “What a lot of companies start to recognize is that you only get to a certain point, and trying to play whack-a-mole with the scams — with the different tactics — is impossible.”

The report noted that scams have evolved significantly since the days of the “Nigerian prince” email. Now, stolen data is used to find targets on social media, employing AI-generated scripts, phishing pages and laundering networks.

Fraud is becoming faster as well, Bloomberg added. While pig-butchering schemes can still take weeks or months of grooming, nearly two-thirds of victims pay within 24 hours of their first contact with the scammers.
Phishing operations can be even faster, the report said, with the makings of fake websites to mimic companies, banks and payment gateways being sold as kits. And an analysis prepared for Bloomberg by cybersecurity company ZeroFox shows how scammers with limited technical ability are abusing legitimate developer platforms and AI app builders to create pages with just a few prompts.

Phishing pages uncovered on the free tiers of nine developer platforms and AI app builders increased more than fourfold to 10,600 in a two-year period, the report said.

PYMNTS spoke last month with Erin West, founder and president of the scam prevention group Operation Shamrock.

She told PYMNTS CEO Karen Webster that she rejects the notion scam cases are hopeless because the scammers are overseas. Scams, she argued, begin with a contact, whether that means an Instagram profile, a LinkedIn account, a WhatsApp number, all of them producing records. Those records can be traced to another person, a shell company or a cloud account filled with of photographs and identifying details.

“If you keep pulling those threads, you can identify people,” West said.

Meanwhile, research by PYMNTS Intelligence shows a growing number of frauds going unreported. The number of victims who didn’t report their scam at all rose 26% in the past year, to 11%. The most common reason, mentioned by 28% of non-reporters, was being unaware that reporting was an option.

 

[Bot]

Hi Brownie, two details are worth separating from the dramatic headline.

First, $422 billion appears to be a headline typo: the article’s text, Bloomberg and GASA’s report all use $442 billion. Second, that is an estimate for all scam losses across the 42 surveyed markets, not $442 billion proved to have been caused by AI. The GASA study surveyed 46,000 adults online and extrapolated their reported losses; it is not a total assembled from audited bank transactions. Its methodology also changed from earlier editions, so year-to-year comparisons need caution.

The AI aspect is nevertheless significant. It lowers the entry cost by producing plausible messages in multiple languages, personalised scripts, cloned voices and convincing phishing pages at scale. The reported fourfold increase to 10,600 phishing pages on the sampled free developer and app-building platforms is evidence of that scaling—not evidence that those legitimate platforms are inherently malicious. AI is the accelerator; stolen data, social engineering, payment systems and money-mule networks remain the engine.

The statistic that victims often pay within 24 hours is probably the most actionable point. Defences should introduce deliberate friction:

• Never approve an urgent payment or account change through the channel that initiated the request. Contact the person or company through a previously known number, official app or bookmarked site.
• Treat voice and video as supporting evidence, not proof of identity. Families can agree on a private verification phrase.
• Organisations should require independent confirmation and preferably two-person approval for new beneficiaries or changed banking details.
• Use passkeys or phishing-resistant MFA where available, plus a password manager that will not autofill credentials on the wrong domain.
• If money has been sent, contact the bank or payment provider immediately, preserve the messages and transaction details, and report the account and profile. Recovery is not guaranteed, but speed can determine whether funds are frozen before being moved again.

So yes, AI is making industrial-scale fraud cheaper and faster. It has not made verification obsolete; it has made trusting an unsolicited message rather expensive.

Sources

• Global State of Scams - 2025 | Global Anti Scam Alliance

 

[Halp2001]

Beyond the use of AI to carry out scams, social engineering remains a key element: creating a sense of urgency, building trust, or exploiting fear. The difference is that criminals can now do this on a massive scale and with more convincing messages. Ultimately, one of the best defenses remains the same: take a few minutes to pause, verify through another channel, and be wary of any request that pressures people to act immediately.