Fraud in Focus: Top 3 Themes of 2025

Throughout 2025, we tracked everything from phishing kits and deepfake scams to insider abuse and autonomous hacking tools. Individually, each story mattered. Together, they pointed to something bigger: Fraud is changing how it operates, scales, and hides.

Before we turn the page to 2026, I want to share the three shifts that I think best explain where things are headed.

Let’s get into it.

NATE'S TAKE - DECEMBER 23, 2025

Top Themes This Year

1. Agentic AI will change the pace of both commerce and fraud
2. Running fraud at scale is easier than it’s ever been
3. Identity verification signals are no longer trustworthy

1. Agentic AI will change the pace of both commerce and fraud

This year was also a turning point for AI in fraud, especially as we moved toward agentic systems.

We’ve covered deepfake impersonation, AI-powered phishing, autonomous hacking agents, and scams that adapt in real time. But the bigger shift is what happens as agentic AI becomes embedded into commerce itself.

When systems start acting on behalf of people, not just assisting them, everything speeds up. Agents will browse, transact, negotiate, and move money with very little friction.

That’s an enormous efficiency gain. It’s also an enormous opportunity for abuse.

Fraud doesn’t need to scale headcount anymore. It can scale agents.

That means fraud will move faster than human review cycles, manual investigations, and controls designed around user-driven interactions. The same is true on the defense side.

Teams that rely solely on human-paced decisions will struggle to keep up. Teams that build automated, adaptive, behavior-aware defenses will have a chance to match the pace.

By 2026, I don’t think the question will be whether AI is involved. It will be whose agents are acting faster, and with better context.

RELATED: B2B Agentic Commerce Will Dominate 2026

2. Running fraud at scale is easier than it’s ever been

Over the course of this year, one pattern became impossible to ignore: fraud has moved well beyond isolated attacks.

Story after story pointed to the same reality. Fraud today looks less like opportunistic behavior and more like an organized industry. We saw phishing kits sold as subscriptions, scam operations run like call centers, illicit marketplaces offering laundering and deepfake services, and networks that adapt faster than enforcement or platforms can realistically respond.

That shift matters, because it changes how fraud has to be approached.

When fraud operates at this level, taking down individual attacks doesn’t really slow anything down. It just forces activity to reroute. Teams that focus only on point controls end up reacting to symptoms instead of understanding the system behind them.

Looking toward 2026, I think the advantage shifts to teams that can see how activity connects across identities, sessions, and behavior over time. The goal isn’t just stopping fraud in the moment. It’s understanding how it moves.

3. Identity verification signals are no longer trustworthy

The third theme that kept surfacing this year was the quiet collapse of traditional trust signals.

Almost every major story we covered involved fraudsters exploiting something people already trust. Legitimate platforms. Real brands. Familiar tools. Normal workflows. In some cases, even real employees.

We watched fraud hide behind SaaS platforms, abuse services like GitHub and DocuSign, bypass authentication through session hijacking, and walk straight through the front door by posing as workers. None of that looks like a classic “attack.” It looks like business as usual until it isn’t.

The issue isn’t that controls are broken. It’s that many of the signals we still rely on were designed for a much simpler internet.

Login success. MFA completion. Known devices. Clean IPs. These no longer mean what they used to. For attackers, they’ve become the cost of entry.

As we head into 2026, trust can’t be something that’s granted once and forgotten. It has to be continuously evaluated based on behavior, context, and intent.

===

That’s all for this week (and year!). For more insights, follow us on LinkedIn or X, and if you want to learn more about what we do, visit www.specprotected.com.

‍