AI Fuels a 341% Surge in Phishing and Raises the Cost of Identity Attacks

Generative AI is changing the economics of identity attacks. It can help attackers produce more convincing messages, automate fraud attempts and imitate real people across voice and video. The reported rise is sharp: SlashNext measured a 341% increase in phishing in six months, while malicious phishing messages have grown 4,151% since ChatGPT became publicly available in November 2022.

Those figures describe phishing activity, not the share of attacks that AI caused. The distinction matters. Still, the trend sits alongside a broader rise in identity-focused security incidents: IBM’s 2024 Threat Intelligence Index reported a 71% year-over-year increase in attacks targeting identities. CrowdStrike has reported that compromised identities are involved in 80% of breaches.

The practical concern for organizations is that identity checks sit between people, software and sensitive data. As Jim Alkove, former Salesforce Chief Trust Officer and Microsoft Security CVP, put it: “If you don’t know who and what’s interacting with your data, you can’t secure it.” AI gives attackers new ways to make those interactions appear credible.

More convincing attacks, at greater scale

Phishing now spans more than suspicious email links. The reported attack types include business email compromise, QR code scams, malicious attachments and messages sent across multiple channels. Generative tools can help tailor text to a recipient and produce it in different languages, weakening detection methods that look for awkward wording or common spelling errors.

Attackers can also use machine learning to examine large amounts of data for software weaknesses, according to Alkove. That puts pressure on security teams to adjust defenses as attack methods change, often while working with limited resources. The challenge is not simply spotting a bad message; it is establishing whether a person, device or automated process should be trusted at each point of access.

Deepfakes add another route to impersonation. Christopher Tennyson, product marketing director at Kount, said a fraudster can use a small number of examples of someone’s face and voice to mimic that person in a video or voice call. That can make familiar verification steps less reliable when a request arrives through a channel people have learned to trust.

Automated fraud has changed in a similar way. Tennyson said older bots tended to perform narrow, repetitive actions, making them easier for machine learning systems to identify as nonhuman. Attackers adapted by using AI to make bot behavior look more like a person’s. Generative AI has extended that capability, including attempts to get past common bot checks such as CAPTCHA.

These developments put pressure on detection systems that rely on consistent patterns. A system trained to identify automated behavior may need to account for bots that vary their actions. A text classifier that flags language errors may miss fluent, personalized messages. And when an attacker can imitate someone’s voice or appearance, an organization may need additional ways to confirm identity before acting on a sensitive request.

Costs spread beyond the breach

The immediate financial loss is only one part of the damage. Identity incidents can interrupt operations, require staff to investigate and contain the event, and weaken customer and partner confidence. Alkove noted that a major security incident can affect long-term trust as well as day-to-day business. The source cites an average breach cost of $9.48 million for U.S. companies.

In 2023, the Identity Theft Resource Center recorded 3,205 data compromises, 72% above the previous high it had tracked in 2021. The center also reported that nearly 11% of publicly traded companies were compromised that year. The article cites more than $10 billion in reported fraud losses for 2023, a 14% increase from 2022. These figures cover broad security and fraud trends; they do not establish that AI caused each incident.

Disruption can extend beyond technical response. Jim Kaskade, CEO of Conversica, said AI can increase the efficiency and success rate of large-scale phishing and credential stuffing, making interruptions more frequent and severe. Teams may have to shift time and resources from product work to incident response. Security staff can face sustained stress, and Alkove warned that pressure can contribute to burnout and human error.

There are also less visible effects on company plans. Hal Lonas, CTO of Trulioo, said attacks can damage employee morale and create a sense that internal teams are unprepared. Organizations may become reluctant to release new products or adopt technology if they expect those systems to attract attacks. That caution can slow experimentation even when the technology itself could improve how the business operates.

Further costs can include legal expenses, higher cyber insurance premiums, investment in new security tools and the work of rebuilding confidence after an incident. Alkove also pointed to lost business opportunities: customers and partners may hesitate to work with a company associated with repeated security failures. Kaskade described potential effects on growth and access to credit or funding, as well as pressure on company performance.

What defenders need to watch

Chris Hills, chief security strategist at BeyondTrust, said identity attacks using AI are still developing. He expects attackers to streamline their methods and move through attack paths faster. His warning focuses on the difficulty of distinguishing authentic audio and video from fabricated material, with end users, engineers and executives all facing harder verification decisions.

Jim Kaskade predicted that 60% of attacks would be AI-fueled. That is his forecast, not a measured share of incidents. His comments point to a likely direction of concern: deepfakes, synthetic identities and more tailored phishing may become more common as attackers combine automated tools with stolen personal information.

For security teams, the reports and interviews suggest a need to review how identity is established across email, messaging, account access and live conversations. A single check may not be enough when attackers can imitate a person or produce convincing text at scale. Teams also need to consider how they will respond when detection systems are uncertain, and how they will keep incident response from consuming the capacity needed for normal product and security work.

The figures show a fast-growing phishing problem and rising pressure on identity defenses, but they don’t measure the effectiveness of any particular countermeasure. The next test for organizations will be whether their verification and response processes can adapt as attackers use AI to make fraudulent interactions harder to distinguish from real ones.