Identity Scams Evolve Into Multi-Stage Attacks

Identity Scams Evolve Into Multi-Stage Attacks Victims Increasingly Face Multiple Compromises From a Single Incident Tiffany Wang • June 9, 2026     Credit Eligible Get Permission Image: Prostock-studio/Shutterstock Fraud is no longer a one-time event for victims, warns the Identity Theft Resource Center. Rather, it's a cascade that crashes through a victim's life, affecting one vulnerable account after another. See Also: AI Impersonation Is the New Arms Race-Is Your Workforce Ready? One in four victims who reported their incidents to the Identity Theft Resource Center in 2025 experienced multiple attacks in a chain as one breach enabled another. What begins with email or voice phishing can lead to an email or bank account takeover and escalate to unauthorized access of multiple accounts. Of the 6,000 individuals who reported to the center experiencing identity theft between April 2025 and March 2026, more than 300 of them experienced at least four separate compromises. "Even as recent as five years ago, it was - you had a fraudulent credit card charge, that was pretty much it," said James Lee, ITRC president. "Now scammers are able to unleash multiple events, primarily because they're able to use artificial intelligence to generate basically a script that is much more believable. They generate all the materials around it - the website, the application, the download - all of the things they generate around these scams are much more believable today." For adult workers, the share of identity theft through malware-compromised devices rose by almost 80%, surpassing conversation-driven scams as the most prominent attack method for the first time since ITRC started tracking trends five years ago. Individuals aged 35 to 64 tend to manage their professional and personal lives through smartphones and computers, meaning a single compromised device can open the gate to an entire ecosystem. Lee said attacks usually start with impersonation of a business and a method for gaining a foothold through manipulation. In the past, a single fraudulent transaction might have been where the campaign ended. Now, attackers like to continue and bring in their teammates to maximize their gain. "What starts out as a representative from your bank - it's not actually your bank - then they're going to say, 'but we've seen this as a pattern, and we have a law enforcement partner we're working with, and we would like to put you in contact with the sheriff, the local police department, could be the FBI.' We've had people say it's the CIA," Lee said. "They go through another round of 'Look, we've investigated this case, and we see this as a pattern. We need access to your laptop, so we can see if there's been any malware planted on there that's linked to this criminal enterprise,'" Lee said. The threat actors behind such attacks are multinational criminal organizations spanning Southeast Asia, Latin America, Eastern Europe and the Middle East. North Korea is also a significant player, where stolen personal identifier information is repurposed into cover stories for IT worker scams (see: How to Spot a North Korean Job Candidate). As these groups increasingly adopt and experiment with AI tools, an already sophisticated threat landscape can be even harder to combat. "We just don't know what's coming next. We could usually predict what was coming down the road. Five or 10 years ago, we could say, 'Okay, there's going to be this new technology, or there's going to be this new something, and that's going to result in more attacks, and it's going to be on a time frame that we could prepare for - that's out the window," Lee said.