A recent TransUnion report highlights a shift in cybercrime: threat actors are exploiting trust rather than deploying malware, often by impersonating trusted brands or existing customer accounts. Through social engineering, deepfake technology, text spoofing, compromised credentials, and AI, attackers can present themselves as a customer or as the organisation, making fraud more convincing and harder to detect.
The report notes that most fraud now occurs after a customer relationship has been established, with 58% of organisations worried that fraud is evolving faster than their detection capabilities.
The piece cites synthetic identities as a key tactic, built from leaked data and enhanced by deepfakes to defeat onboarding checks. Account login incidents accounted for 53% of suspected digital fraud in the first half of 2026, and attackers are moving beyond script-driven automation to engineered pipelines that bypass security controls. AI is increasingly used to personalise attacks and pressure targets across channels, including voice deepfakes used in calls to corporate help desks.
A leading example is a data-theft campaign against Salesforce customers that began in 2025 and continued into 2026. Experts urge organisations to audit every entry point into the CRM—OAuth apps, guest or portal users, API keys—and to tighten identity verification, reduce data held, and implement stricter controls around help desk resets to mitigate this evolving threat.