International Fraud Awareness Week 2026: AI, Fraud-as-a-Service, and Your Identity

International Fraud Awareness Week 2026 is November 15-21. The goal is to raise awareness about some of the most common types of fraud and scams, and provide resources and learning materials to help people stay safer online. It’s also a good time to look ahead at the dangers and risks we will all face in the coming year. 

Fraud Trend #1: Agentic fraud

AI has been part of the fraud story for a while now. Agentic fraud takes it to the next level. 

1. AI agents keep running after human scammers go to bed

Before the start of this year, most AI agents available to the public were rudimentary at best. They might be able to answer an email or two and surf a website to recommend a product, but they didn’t go much beyond that. 

OpenClaw changed all that by making advanced AI agents available to anyone, and top AI providers like OpenAI and Anthropic quickly followed suit. It’s no surprise that threat actors are taking full advantage. 

Today, AI agents can withstand friction and roadblocks and keep running without human intervention. They can also:

• Access files
• Send messages
• Make phone calls
• Purchase products
• Transfer money
• Do recon on potential targets
• Write scripts for phishing, fraud, and scams
• Find and exploit vulnerabilities
• Take over accounts

All this with no human ever laying eyes on any part of the process. And they work around the clock. 

Expect the scale of agentic fraud to explode in 2027. All the tools are already out there. 

2. AI agents can be hacked

AI agents purpose-built for fraud is only one part of the story. The other part is that millions of people have brought unpredictable AI tools into their daily lives. 

Already, around half of security and technology professionals report seeing or suspecting AI agents within their organizations acting in unexpected or unauthorized ways. 

For the folks who have connected their finances to AI agents like Muse, this is particularly bad news. Their agents may click on bad links, buy scam products, or fall victim to fraud before they even realize what’s happened. 

According to some sources, you don’t even need to grant your agent full permissions. It will take them. Our verdict? Don’t trust an AI agent to keep your data or your finances safe from fraudsters. 

Fraud Trend #2: Fraud-as-a-service

Fraud-as-a-service has been around for a while, and it’s only growing. Cybercriminals don’t even need deep technical skill to run a serious operation. They can take advantage of subscriptions, tutorials, and customer support. 

On the dark web, a buyer can pick up a phishing kit with ready-made login pages for major banks, a malware package that steals saved passwords, or a list of stolen card details, all from a storefront that looks nice and polished. Some of these services even offer refunds and reviews, because sellers depend on repeat business.

The tools are getting more capable, too. A phishing kit used to produce a crude message with obvious spelling errors. Now the same kit can generate messages that read like they came from your bank, your employer, or a friend based on AI reconnaissance, and it can adjust the wording for each target. Deepfake-as-a-service alone has seen a 39% increase in dark web conversations since the beginning of this year. 

For 2027, expect more organized attacks that rely on AI deepfakes and well-researched, personalized, and polished phishing lures. These are both more attainable than ever before. 

Fraud Trend #3: ID scan-based fraud

In September of this year, a major identity verification provider, IDScan, experienced a breach. 153 million government IDs showed up on a dark web service called Nexus. According to cybersecurity researcher Brian Krebs, the breach had been active for some time. 

The breach was unprecedented. More than 150 million Americans had scans of their IDs exposed, and while Nexus is now down, the damage could last throughout the coming year. 

Last year, a senate investigation showed that fraud losses due to four major data broker breaches topped $20 billion. None of those data brokers had full ID scans, which can be used for anything from accessing medical records to opening new lines of credit to purchasing or selling a house. 

If your ID was exposed, which is probable if you’ve ever used a car rental service, had to scan your ID for a marijuana dispensary, or interacted with any business that works with IDScan, the damage is done. But there are still ways you can protect yourself from the fallout in the coming year. 

Damage Control and Fraud Prevention in 2027

AI agents primed for fraud are everywhere. The dark web is full of packages ready-made to steal your identity and open up fraudulent accounts or purchases in your name. If your ID was caught up in Nexus, it’s probably in some cybercriminal’s hands right now. 

So what comes next? 

1. Start with the credit system

Cybercriminals can use your breached ID and other personal info to ask for loans in your name. A credit freeze stops most attempts before they start. 

While you’re at it, look at what’s already there and check back every couple months. You can pull your credit reports for free at annualcreditreport.com. Watch for accounts you don’t recognize, addresses you’ve never lived at, and credit checks from lenders you never contacted. Criminals can wait months before using stolen IDs, so just because you’re clean now doesn’t mean you will be in a month. 

2. Cut off the tax fraud pathway

Tax fraud is one of the most common uses of a stolen Social Security number, and it often shows up when your real return gets rejected. The IRS offers a free Identity Protection PIN that prevents anyone from filing a return in your name without it. Request one at IRS.gov. 

3. Reduce your chance of account takeover

Stronger logins matter more now. Use passkeys or a hardware security key where they’re offered, and avoid relying on text messages for codes. Phone numbers can be hijacked through SIM swapping, where a criminal convinces a carrier to transfer your number to a new SIM. Call your mobile provider and ask about port-out protection, which adds a PIN before a number can be moved.

4. Set up alerts for everything

Turn on transaction notifications for every bank and card, and set the threshold low. Criminals often start with small test charges to see whether anyone notices, so an alert for a few dollars can be your first warning. 

5. Make it harder for cybercriminals to cross-reference data

Your data may already be out there on the dark web, but there are always gaps. Cybercriminals fill those in using publicly available sources like data broker sites and social media. Opt out where you can and lock down your social media privacy settings. 

6. Report when things go wrong

Start at IdentityTheft.gov. It creates an official report and a recovery plan, and banks and creditors often ask for that report before they’ll remove fraudulent charges or accounts. You can also report fraud to the Internet Crime Complaint Center (IC3) of the FBI. 

Final thoughts

Fraud is operating at a scale that wasn’t possible a year ago. You can’t opt out of that reality, but you can make yourself a harder target. 

Learn more: 

• Read our full guide to the privacy and security risks of Meta’s AI agent, Muse.
• Discover how AI tools like ChatGPT are facilitating shopping scams.
• Learn about AI inferences and how they can fuel cybercrime as well as surveillance pricing.