Fraud trends in 2026: the biggest scams to watch for

The current picture of fraud arrived in three releases this year.

• 25 March 2026. The FTC told Congress that consumers reported $15.9 billion in fraud losses for 2025, up from over $12 billion (FTC testimony).
• April 2026. The FBI's Internet Crime Complaint Center (IC3) counted 1,008,597 complaints and $20.877 billion in 2025 losses, up 26 percent (2025 report).
• 3 September 2026. FinCEN tied 33,904 Bank Secrecy Act reports on digital asset investment scams to about $12.7 billion (FinCEN analysis).

Fraud is deception used to take money or property. This page follows the forms that grew, each with the fraud detection and prevention control that catches it.

What are the biggest fraud trends to watch for in 2026?

Ransomware payments are the one line in Table 1 that fell.

Table 1. Fraud trends 2026 at a glance (as of 30 October 2026)

The customer sends much of this money. The FTC put about half of 2025's reported losses on investment scams, and the largest sums overall left by bank payment, then crypto. That puts the control in the payment window. complead, formerly Sanction Scanner, scores each transaction there and returns approve, decline, review or step up with the reason attached.

Inside firms, the ACFE's 2026 study of 2,402 occupational fraud cases found corruption in almost half of them and a median loss of $104,000 a case.

Which 2026 releases changed the fraud picture?

This list of the latest releases is rewritten each quarter, after the FTC (March), IC3 (April), UK Finance (June), the FATF (mid year) and the ONS (every quarter) publish. The next rewrite follows the ONS bulletin due on 28 January 2027.

• 16 March. INTERPOL's fraud threat assessment found victims from nearly 80 countries trafficked into scam centers.
• 15 April. FinCEN's Rapid Response Program passed $1.8 billion in interdicted funds since it began.
• 15 June. UK Finance put 2025 losses at £1,279.8 million, up 4 percent, across 4,062,198 cases, up 11 percent.
• 16 July. The FATF's virtual asset update named AI an emerging risk across fraud, hacking and laundering.
• 24 August. Cifas members filed over 220,000 cases in the first half, the most for any first half on record (Fraudscape).
• 22 October. The ONS put fraud in England and Wales at 4.5 million incidents in the year to June 2026, up 11 percent, as bank and credit account fraud grew 13 percent.

How is AI changing fraud in 2026?

A cloned voice sounds like a relative in trouble and asks for money. IC3 calls it the distress scam. Victims reported over $5 million lost to it in 2025, and businesses over $30 million to email compromise scams that used AI.

IC3 tags a complaint as AI related when the report mentions artificial intelligence: 22,364 complaints in 2025, with $893.3 million lost. INTERPOL's March assessment puts AI enhanced fraud at 4.5 times as profitable as plain fraud. It describes agentic AI that runs a scheme end to end, from researching the victim to writing the ransom note. Dark web sellers offer voice and face clones. Seconds of audio or video are enough to build one.

The FATF's July update calls AI an emerging risk factor "across the lifecycle of fraud, hacking and money laundering". It wants authorities to weigh controls against deepfakes and synthetic identities.

A payment request that arrives by voice or video gets a call back on a number you already hold, never the one in the message. At onboarding, check liveness; a still photo proves little against a face clone. Where AI fraud detection puts an agent on the case, it should pull the call record, device history and payee's age into one file. The analyst still decides whether the money goes.

Why are crypto and investment scams still growing?

On 15 June 2026 the FBI described a crypto investment scam that ends with a cash courier. The victim, usually a senior citizen, watches fake returns grow on a crypto platform. Then a bank stops a transfer. The scammer sends a courier to collect cash instead, and the courier proves the link with a dollar bill serial number or a password.

Digital asset scam reports to FinCEN grew 10.9 percent a month on average from September 2023 to December 2025, and about a quarter also involved elder financial exploitation. IC3 logged 61,559 crypto investment complaints in 2025, up 48 percent, with $7.228 billion lost. Crypto ATM losses rose 58 percent to $389 million, and 6,188 of the 13,460 complaints came from people aged 60 or older. In Australia, AUSTRAC suspended Cryptolink's registration for three months from 9 August 2026, which took its 96 crypto ATMs offline.

Much of it runs from scam centers. FinCEN's scam center alert of 3 September ties them to transnational criminal organizations, mainly in Southeast Asia. They buy phishing and laundering on guarantee marketplaces. Funds move through money mules and stablecoins. The FATF describes a conglomerate based in Cambodia that laundered at least USD 4 billion from August 2021 to January 2025. It also cites a Cambodian conglomerate's stablecoin, marketed as immune to asset freezing.

The 2023 edition of this page called these the never ending issues of cryptocurrencies, and the biggest crypto scams on record bear that out.

The same edition blamed a lack of regulation, which is out of date. MiCA applies in full from 30 December 2024 (Regulation (EU) 2023/1114, Article 149), as does the EU crypto travel rule (Regulation (EU) 2023/1113, Article 40).

The US GENIUS Act of 18 July 2025 regulates payment stablecoins, and the growth moved to scams in which the customer pays.

Your control point is the first payment to a new exchange or crypto ATM operator. Make it a rule input, and add FinCEN's red flag for exchanges that advertise services "with no KYC".

Which impersonation and consumer scams are rising in 2026?

Imposter scams have topped the FTC's reports every year since 2020. In 2025 there were over 1 million, with over $3.5 billion lost. Texts were the most reported contact method. Social media cost the most. Reported FTC losses overall are up nearly 430 percent since 2020.

Government impersonation is the sharpest case. The FBI's 17 September update counted nearly 61,000 law enforcement or government impersonation complaints from January 2025 to July 2026, with more than $1.6 billion lost. Scammers accuse the victim of wrongdoing, threaten severe consequences and demand payment by prepaid card, courier, wire, crypto or cash fed into a crypto kiosk.

The UK runs the other way on impersonation. Police and bank staff impersonation losses fell to £55.5 million in 2025, the lowest since 2020, while authorized push payment fraud rose 19 percent to £576.4 million. The growth is in malicious payee scams, where the customer pays for goods or services that never arrive. UK Finance notes they often start with small payments that grow, which makes them harder to spot.

IC3 complaints from people aged 60 and over rose 37 percent to 201,266, and their losses rose 59 percent to $7.748 billion, the pattern behind elder financial exploitation red flags.

What are the most common telecom fraud schemes in 2026?

Start with SIM swaps. Unauthorized SIM swap cases filed with Cifas rose 402 percent in the first half of 2026, after a 38 percent rise in 2025, and the new SIM intercepts the codes sent to the phone. IC3 logged 971 SIM swap complaints and $17.4 million lost in 2025.

Phone and text contact carries the costlier cases. UK Finance traces 17 percent of APP cases but 28 percent of losses to telecoms, usually higher value scams such as impersonation. FinCEN's program had helped interdict $54.5 million in phone scam funds by April 2026. The control: a payee change, a new device or a higher limit within days of a SIM change goes to review.

How are fake identities and account takeovers getting past onboarding?

Cifas' National Fraud Database shows the shift. It took a record 444,993 cases in 2025. Identity fraud, at 242,003, fell 3 percent as criminals turned to taking over existing accounts, particularly through mobile phones. Fake IDs keep multiplying in a new form: Cifas reports synthetic identities becoming industrialized, with long term profiles that blur real users and AI generated imposters. More people also sell or share their own identity documents under financial strain.

The first half of 2026 kept the pace, with over 220,000 cases, identity fraud up 9 percent and loan identity fraud up 49 percent. In the US, 23 percent of institutions in the Federal Reserve Financial Services survey reported account takeover, which FRFS calls a 7 percent increase on the year.

Mules move the proceeds. Cifas members filed nearly 13,000 money mule cases in six months, up 70 percent, partly because a filing reason for muling was added in 2025.

Check liveness and the document at onboarding, then rescreen at the first phone, email or payee change.

Alert quality: why false positives still hide the real cases

False positives bury the cases that matter, and UK Finance's card data shows the pressure behind them. It calls the shift a "higher volume, lower value" trade off: remote purchase fraud cases rose 13 percent while their losses rose 3 percent.

• Count alerts per confirmed case, rule by rule. A rule that never confirms only adds queue.
• Price the decline. Put the fraud each rule stopped beside the good customers it turned away, then tune on both.
• Route small card cases apart from transfers, so analyst time follows the money at stake.

Is ransomware still a fraud trend?

Yes, though the payments are falling. FinCEN's December 2025 analysis counted 7,395 Bank Secrecy Act reports on 4,194 ransomware incidents from 2022 to 2024, with more than $2.1 billion paid. Payments peaked in 2023 at about $1.1 billion, up 77 percent, then fell to about $734 million across 1,476 incidents in 2024. The median payment that year was $155,257.

That corrects the 2023 edition of this page, which cited ACFCS for ransomware SARs reaching 1.2 billion. The figure was dollars. FinCEN's November 2022 analysis counted 1,489 ransomware filings for 2021 worth nearly $1.2 billion.

IC3 received 3,611 ransomware complaints in 2025 with $32.3 million in adjusted losses. It calls the figure artificially low, since some victims report no loss and the count leaves out lost business, time and remediation.

Harmful ransomware carries a sanctions risk for whoever pays. OFAC can impose civil penalties "based on strict liability" when a ransom reaches a sanctioned person (OFAC advisory). So the receiving address goes through a crypto wallet check against sanctions and ransomware intelligence before any payment. Backups and incident insurance cut how often a firm faces that choice.

What are the most common types of fraud and scams to know in 2026?

To identify the types to know for your book, Table 2 lists IC3's 2025 counts by complaints, with the newest UK figure beside each.

Table 2. The most common types of fraud and scams in 2026

Investment fraud costs the most in IC3's data, $8.6 billion, and it's the costliest APP scam in the UK, a record £221.5 million. Phishing is the reverse: the most complaints and $215.8 million in losses. That split tells fraud detection and fraud management teams where the work goes: phishing fills the alert queue, investment scams the loss report.

What did the 2026 FIFA World Cup bring in scams, betting risks and financial crime?

The tournament ran from 11 June to 19 July 2026 in 16 cities across the US, Canada and Mexico. FIFA World Cup fraud started before kickoff. On 27 May the FBI warned of spoofed FIFA websites that sold fake tickets and hospitality and harvested personal data through misspelled domains. Its advice to fans: type fifa.com directly and avoid sponsored search results.

On 11 May, FinCEN's notice warned of human trafficking around host cities and asked for SARs carrying the key term FIN-2026-HTWORLDCUP. Its red flags include several hotel rooms and ride fares in a short period, often late at night or early in the morning, with no business purpose.

Match fixing and betting fraud: the AML risk

Betting is where fraud and money laundering meet in football. The FATF's football sector report says betting "can be used both for the generation of illegal proceeds from game fixing and for pure money laundering purposes". In a case Belgium reported, a group tied to football bought casino chips in large amounts with no economic justification. A foreigner among them was suspected of bribing players before matches, mostly at clubs in financial trouble, and an online betting company abroad took exceptionally high bets on those games. Police already knew the group from an investigation into rigged matches.

The rules aim at the operator. The Council of Europe's Macolin Convention of 2014 covers suspicious sports betting, betting that reliable evidence links to a manipulated competition, and asks each party to consider "requiring sports betting operators to apply customer due diligence", with records and reports, inside its AML framework.

None of the regulator releases read for this page, up to 30 October 2026, reports a fixed or scripted match at the tournament. For a bank or payment firm the sports integrity signal sits in the money: payments to betting operators that the law where the customer lives doesn't allow, the Convention's test for illegal betting.

The three dates at the top will be the first lines to change, once the FTC and IC3 publish their 2026 counts. FinCEN's date has already changed how scam reports get filed. Its alert of the same day gives scam center SARs the key term FIN-2026-SCAMCENTERS, for field 2 and the narrative. Use it on the reports you file this week.

Sources and method. Written by Fatih Coşkun and fact checked by Javid Khasayev, Senior Anti Fraud Specialist at GoldenPay, on the publish date. Each figure was reread on 30 October 2026 in its publisher's own document: the IC3 2025 report and its May, June and September 2026 alerts, the FTC's 25 March 2026 testimony, FinCEN's ransomware and scam analyses, scam center alert and World Cup notice, the FATF's July 2026 update and 2009 football report, INTERPOL's March 2026 assessment, UK Finance's 2026 report, Cifas Fraudscape 2026 and its August update, the ONS bulletin of 22 October 2026, AUSTRAC's 10 August release, the FRFS 2026 Risk Officer Report, the ACFE's 2026 study and the Macolin Convention.