- Akamai's Fraud and Abuse Report 2026 says reused kits and hosting can let replacement scam sites appear within hours of a removal.
- Akamai also says credentials exposed by scams and breaches can be tested against other services. It does not say the same actors run both.
- Leaders should ask whether teams track scams by shared infrastructure and measure the cost of fake accounts, not just count blocked domains.
Taking down a scam website feels like a win. Akamai's Fraud and Abuse Report 2026 suggests the win can be short. The report says operators recycle their phishing kits, hosting set-ups and payment back ends. A working copy can follow a takedown in a matter of hours.
The lesson here is that a scam domain is a doorway, not the building. A team that counts removed doorways is measuring the wrong thing.
One address, more than 1,200 doorways
Akamai described a retail scam built on over 1,200 fake shop addresses ending in .shop. All of them sat on one IP address, the numeric location of the server behind a site. The pages reused the same code and payment-page designs. They were built to capture card numbers, expiry dates and security codes.
A ticket scam used the same pattern. It went after fans of a major sporting event. Akamai says the sites imitated official ticketing and hospitality portals. They were designed to send payment and personal details to one shared collection system. Some checkouts asked for passport or ID details, saying this was needed for delivery or entry.
The point is that each address was one more way into the same operation. Block one, and another could keep passing data to the same place. Akamai says the stolen data could then feed payment fraud, account takeover and identity abuse.
The way in is not always a website. In one campaign, a paid social media advert led shoppers to a fake app marketplace. The app people then downloaded gathered sensitive data and misused device permissions. Fake job posts on four major social platforms pointed applicants to phishing forms.
How the doorways stay hidden
Akamai describes several tricks that make blocking harder. Operators register look-alike addresses in batches and park them, unused, for weeks or months. A parked domain can build a clean record before any scam goes live.
Some sites show different pages to different visitors. A security scanner may see harmless content. The intended victim sees the fraud. Location and browser details can decide which page appears. A defender who checks a suspect site with a scanner may not see what a customer sees.
Attackers also host phishing pages on hacked websites. That borrows the good name of an established address. Because the kits and hosting are recycled, a replacement can follow a takedown within hours.
Where stolen credentials get used
The report also covers login and sign-up forms. Akamai says credentials exposed through scams and breaches can give access to existing accounts. Automated programs try stolen logins on other services. The report does not say who runs these programs, or that they are the scam-site operators.
Password reuse is the weak spot. When a person has used one password in several places, Akamai says, an attacker who gets in may reach stored payment methods, loyalty points or personal details. They can then alter account and recovery settings, which makes it harder for the owner to get back in.
Akamai gives figures for scale. It looked at 30 days of login traffic spanning July and August 2026. It classed 26.6% of the recorded attempts as high or critical risk. Account verification requests made up 40% of that risky login traffic. Such checks can show an attacker whether an email address has an account.
Sign-ups are a target too. Akamai links 8.3% of account creation attempts in 2025 to suspected fraud. Criminals open fake accounts to claim welcome bonuses, abuse promotions, hold stock for resale and test stolen cards with small buys. The business pays fees, chargebacks and penalties. Real shoppers find limited stock gone.
SMS pumping is another route. Automated requests trigger sign-up or password-reset texts to premium-rate international numbers. The business pays for each text. Akamai says some schemes involve rogue telecom carriers that share the revenue with the fraudsters.
Akamai says a victim may only notice when a purchase alert arrives, loyalty points vanish or a password stops working. The business then deals with disputed payments, refund requests and the slow work of restoring access.
Read the numbers with care
These are Akamai's figures from its own sample. The 26.6% covers attempts flagged as possible threats that need investigation. That is not confirmed fraud. The 8.3% is also described as suspected fraud. The figures show how much suspicious traffic Akamai sees. They are not a measure of losses.
Questions to put to your team
Start with how scam reports are handled. Do analysts track shared infrastructure, such as one IP address or one reused payment page? Or do they close the ticket once a domain is down?
Next, ask whether your teams check suspect pages as a real customer would. A scanner-only check can be fooled by the page-switching Akamai describes.
Then look at your own front door. Can your sign-up and login pages reveal whether an email address has an account? Are there limits on reset and verification texts sent to one number or region? Does anyone know what fake accounts cost in fees, chargebacks and lost stock?
A takedown removes an address, not the operation behind it. Stolen logins can also keep turning up at your login page, whoever collected them.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Help Net Security.
