Trust Is Not What It Seems — And Fraudsters Are Counting on It

Threat actors don’t need to rely on malware to breach organizations anymore. They’re simply calling help desks and politely asking for access, with a little help from artificial intelligence.

After a disruptive cyberattack hits, customer trust can take a while to rebuild. But now, threat actors are impersonating trusted brand names and existing customer accounts to abuse customer relations.

“Trust has become easier to exploit and harder to establish,” warned a new TransUnion report. Threat actors use social engineering, deepfake technology, text spoofing, compromised credentials, and artificial intelligence (AI) to become whoever they need to be, whether that’s a new or existing customer, or the organization itself.

Many organizations have improved security during sign-up and onboarding processes in light of more attacks. Organizations must continue to adapt since “most fraud now occurs after the customer relationship has already been established,” according to the report. It found 58% of organizations were very or extremely concerned that fraud is evolving faster than their abilities to detect or prevent it.

The use of synthetic identities plays a big role in that. Threat actors can spin those up with ease, given widespread data breaches that exposed millions of individuals’ sensitive information, explains Brian Killeen, vice president of global identity solutions at TransUnion. Scammers will replicate leaked documents or use deepfakes to bypass identity proofing checks at onboarding.

The credit reporting agency found that account login accounted for 53% of all suspected digital fraud during the first half of 2026. Conducting scams has become easier for threat actors as tooling advances, Killeen adds. Threat actors aren’t just automating account creation with scripts; they’re actually building logic into automated pipelines to reverse-engineer security controls, he explains. That allows them to pinpoint exactly where and how defenses are blocking their attacks.

“Trust is under pressure,” Killeen tells Dark Reading.

You Can’t Spell “Impersonation” Without AI

In 2025, the FBI warned of an uptick in cybercriminals targeting employee self-service portals — websites used for payroll, benefits, and other human resources services – at both private companies and government agencies. Threat actors created fake search engine advertisements to lure users into visiting malicious sites that mimicked legitimate companies’ logos and layouts. Once the victim logged in, attackers stole login credentials and financial information.

And the situation continues to evolve. Over the past year, AI has helped criminals to personalize attacks and spread them across channels— from email to Teams. Deepfakes add another layer of credibility, explains Javvad Malik, lead chief information security officer (CISO) advisor at Knowbe4.

Amid booming AI adoption that security has trouble matching, the security awareness company is also seeing more attempts to exploit AI systems, or to take advantage of poorly configured AI tools and agents, he adds.

“The social engineering techniques remain similar, but attackers are also using AI to find weaknesses and are beginning to target AI agents directly,” Malik tells Dark Reading.

The AI attack surface is ripe for the taking. New research from Check Point on brand impersonation trends from Q3 flagged a phishing campaign where threat actors impersonated Anthropic’s Claude assistant. Fraudulent emails, playing up urgency with a due payment notice, requested 500 euros with an “update payment” link intended to trick users into clicking, putting credentials and financial information at risk. Since April, Knowbe4 tracked a 228% increase in AI brand impersonation, says James Dyer, head of threat intelligence. Attackers are abusing the global focus on utilizing AI within businesses as a perfect covert operation for their phishing attacks, Dyer adds, warning that the problem compounds when attackers center their attacks around breaking news headlines.

A Moving Target

Attackers’ methods have evolved from deploying malware to exploiting identity when it comes to attacks against customer relations because: Why take the time to write a script when they can just get a password reset, poses Dave Lewis, global advisory CISO at 1Password.

The industry spent a decade training people not to click links, and attackers responded by simply asking nicely, he adds. The most common type of attacks he’s observed right now don’t involve “anyone in a hoodie typing furiously,” but instead phoning the help desk to manipulate users into giving away multifactor authentication (MFA) codes, which he labels “the most effective zero-day of 2026.”

Walking in through the customer relationship management (CRM) system’s front door is another tactic he’s observed, pointing to the data-theft campaign against Salesforce customers that started in 2025 and continued into 2026.

“Nobody ‘hacks’ the CRM,” Lewis tells Dark Reading. “They just log in with a key you handed to a vendor, or a guest account nobody remembers creating.”

The target moved from the data center to the Software-As-a-Service (SaaS) layer, where one compromised integration gives attackers many targets per compromise. Detection lags because SaaS platforms log differently from traditional infrastructure, adds Lewis.

Threat actors also use AI to build voice deepfakes from executives’ public recordings, deploy them in high-pressure desk calls, and then use AI again to move through hybrid environments within minutes of gaining access. But that doesn’t exactly signal an increase in sophistication, Lewis says.

“Technical sophistication is down,” he says. “Operational sophistication— research, patience, scripting, follow-through— is up. It’s less of the ‘evil genius’ and more ‘well-run call center with bad intentions’.”

Recommendations: Rinse and Repeat

Killeen stressed that “what once looked legitimate and trusted can change” as threat actors slip further under the radar, cloaked behind more convincing and personalized impersonation tactics. Organizations across industries are seeing more scams, authorized fraud, and good customers being manipulated, he warns.

Organizations must learn and adapt quickly because attackers aren’t wasting any time. Killeen recommends that organizations take a look at their existing controls to uncover vulnerable points and understand where the biggest losses are. Even if organizations stand up strong security at the front door, they could still fall victim to downstream risks.

“It’s taking a risk-based approach, looking at things holistically, and how do you prioritize those things accordingly, based on your vulnerabilities,” Killeen advises.

Killeen and Lewis agree that attacks against customer relations warrants checking every door leading into the CRM. That includes every OAuth application, integration, guest or portal user, and API key.

“Revoke anything without a named owner,” Lewis adds. “Scope the rest. Repeat quarterly, because they grow back.”

He also recommends that organizations fix the help desk process attackers continually abuse, rather than people who work it. Scripted identity verification for resets, callback to a number of record, and manager approval for any privileged or MFA reset are ways to reduce risk in that area.

“Drop speed metrics like average handle time for identity-sensitive support interactions,” Lewis adds. “They drive agents to prioritize speed over verification.”

Holding less customer data is another area organizations can prioritize to limit risks. Implement retention limits on customer records, purge dormant accounts, and don’t include production customer data in sandboxes, Lewis recommends.

“Data you don’t hold can’t be stolen,” he says.