May 25, 2026

World War Fraud: The Invisible Infrastructure Enabling AI-Accelerated Identity Crime

The fraud battlefield has changed.

AI-driven identity theft and impersonation are no longer isolated attacks against individual companies. They are organized, automated, and launched through common infrastructure that allows fraud networks to move faster than defenders can respond.

The White House has rightly elevated cyber-enabled fraud, including identity theft and impersonation, as a growing national security concern in recent cybersecurity initiatives. But the real test is what comes next: moving from a reactive “pay and chase” model to stopping fraud before it happens. To meet this threat with the urgency it demands, policymakers and industry leaders need to understand how fraud is changing and why the next phase of the fight requires a broader view of the battlefield.

The truth is, we have entered a new era. In 2026, both sides are in an exponential AI arms race to win the future of identity.

This is “World War Fraud.” And it may determine whether consumers, companies, and government agencies can trust that anyone is who they say they are online in the coming years.

The Battlefield is Expanding

The problem is bigger than most people realize. AI-accelerated fraud is organized, automated, and deployed at scale by adversaries who are often just as technically sophisticated as the companies they target. These attackers are not operating only at the edge of the internet. They are using the same basic infrastructure that powers everyday digital life, including email, domains, phone numbers, and other systems that were never built for this level of abuse.

At the same time, digital creation tools have democratized the ability to look legitimate online. Almost anyone can use WordPress or countless other tools to create a fake business, build a credible-looking web presence, and support a broader identity fraud operation.

Today, roughly 8,000 fraud rings are targeting the U.S., driving a meaningful share of fraud activity across sectors. These networks are not attacking one industry at a time. They are moving across financial services, government benefits, lending, marketplaces, telecom, and other parts of the digital economy using repeatable systems built for scale.

Our analysts went deeper into one fraud operation that purchased 340 domains, created more than 24,000 fake identities, and used them to launch more than 35,000 identity attacks in a matter of weeks. The ring avoided traditional linkages. There were no repeated emails, phone numbers, addresses, or Social Security numbers tying the attacks together.

But the infrastructure trail revealed the network.

Identity creation, email generation, domain setup, and attack execution are increasingly automated, allowing fraud actors to move from preparation to deployment almost immediately. The result is a faster, more scalable, and harder-to-detect fraud environment.

That represents a fundamental shift. The signals fraud teams have relied on for years are being stripped away by design. And it’s not just happening in the U.S. The defenders, attackers, and the infrastructure are truly global.

Infrastructure as Fraud Enablement

Another key takeaway from our research is that identity fraud is no longer just an identity problem. It is a trust infrastructure problem.

Socure analysts found that AI-powered fraud operations rely heavily on infrastructure providers, particularly domain registrars and free email providers, to create and launch identity fraud attacks at a speed and scale not seen before. Our analysis found that 15 free email providers are used in more than 96% of identity-related fraud activity, while 28 domain registrars are behind 99.95% of fraud volume tied to custom domains.

In other words, while the attacks may appear dispersed across sectors, much of the underlying activity is concentrated within a relatively small set of infrastructure providers.

That does not mean these providers are intentionally enabling fraud. It means they are now part of the fraud surface. If the industry wants to slow industrialized fraud, the infrastructure layer has to join the fight.

Fraud networks only become visible when viewed through shared infrastructure, including domains, email systems, registrar patterns, and coordinated behavior.

Together, these findings point to a clear conclusion. The next phase of the fraud fight cannot be limited to individual sectors or individual identity signals. It must also address the infrastructure that allows industrialized fraud to scale.

World War Fraud is Just Beginning

Socure’s research is designed to make this battlefield visible: who the attackers are, what infrastructure they use, where defenders are losing visibility, and why shared intelligence across companies, sectors, and infrastructure providers is becoming necessary.

This isn’t a one-off project. This is an invisible war that we’re all in. We’ll continue to put a spotlight on it, not just as research reports, but with the ambition to create real-time views of fraud rings around the world.

Frequently Asked Questions

What is World War Fraud?
World War Fraud refers to the new era of AI-accelerated identity crime. An exponential arms race in which organized fraud networks use automated infrastructure to launch identity attacks at a speed and scale not previously possible.

How many fraud rings are targeting the U.S.?
Roughly 8,000 fraud rings are actively targeting the U.S., operating across financial services, government benefits, lending, marketplaces, telecom, and other sectors.

What infrastructure do identity fraudsters use?
Fraud operations rely heavily on domain registrars and free email providers. Socure analysts found that 15 free email providers account for more than 96% of identity-related fraud activity, while 28 domain registrars are behind 99.95% of fraud volume tied to custom domains.

Why is AI making identity fraud worse?
AI has democratized fraud at scale, enabling automated identity creation, email generation, domain setup, and attack execution. Traditional signals like repeated phone numbers or addresses are being stripped away by design.

What is identity fraud?
Identity fraud occurs when someone illegally obtains and uses another person’s private information, such as a Social Security number or financial details. The perpetrator typically uses this stolen data for their own financial gain, like opening fraudulent accounts, making unauthorized purchases, or securing loans in the victim’s name.

Mike Cook

Mike Cook is Head of Fraud Insights at Socure and works alongside Data Science, Product, Sales, and the Fraud Investigation team to help ensure solution optimization across all the markets Socure serves. Mike has been an innovator in fraud, identity, and credit risk for 40 years and has created several patents for identity risk technologies.