TransUnion said Thursday that scam and authorized fraud has overtaken classic account takeover as the top loss driver for many U.S. companies, with criminals using spoofed phone calls and texts to trick people who already have real relationships with banks, carriers, and retailers.
Existing customers are the target
The credit bureau’s semi-annual Fraud in the Age of Continuous Trust report, based on a June 2026 survey of business leaders, found that 81% of suspected digital fraud globally in the first half of 2026 involved interactions with existing customers rather than brand-new identities. In the United States, synthetic identity fraud and third-party card theft still matter, but executives increasingly described losses that begin with a trusted channel: a call that looks like it came from a card issuer, a text that mirrors a shipping alert, or a voice clone that sounds like a relative asking for a verification code.
“Organizations need a more connected understanding of trust,” Brian Killeen, vice president of global identity solutions at TransUnion, said in the company’s release. The report argues that fraudsters no longer need to invent fake people at scale when they can hijack the trust built through years of legitimate account history.
Spoofed calls on U.S. mobile networks
One concrete metric in the study: nearly one in five outbound business-to-consumer calls reaching U.S. mobile subscribers in the first half of 2026 showed signs of spoofing on carrier networks. That does not mean every spoofed call is criminal, but it quantifies how often the phone number on your lock screen may not belong to the institution it claims to represent.
Six in ten business leaders also said their customers were hit by text spoofing in the last year. Combined with generative-AI voice tools, that channel feeds payment fraud and “authorized” transfers where the victim willingly approves a Zelle or wire after social engineering — losses banks may treat differently from a stolen card number.
How losses rank inside U.S. firms
TransUnion’s U.S. breakdown showed scam and authorized fraud at 35% of cited primary loss types, ahead of account takeover (16%), first-party fraud (18%), synthetic identity (18%), and third-party fraud (9%). Globally, scam and authorized fraud led at 29%. Retailers face promotion-abuse risk at account creation, while financial services see concentrated danger at login and payment authorization — the moments when a spoofed call pushes someone to “verify” credentials.
What to do if a call feels wrong
Hang up and call back using the number on the back of your card or on the company’s official website — not a number the caller provides. Banks and government agencies will not demand gift cards, crypto, or instant wire transfers to “clear” fraud alerts. If you already shared a one-time code, tell the institution immediately and ask to freeze outbound transfers.
Enable carrier call-labeling and spam filtering where available, but do not treat a “verified business” badge as proof: spoofing can still slip through. For business owners, TransUnion’s data implies that employee training and step-up authentication at payment initiation matter as much as perimeter firewalls.
Why this lands on a bank-security Thursday
The same morning brought separate reporting that major U.S. banks are blocking third-party AI agents from customer logins. Different headline, same mechanism: attackers and poorly vetted tools both want session access that looks like the real cardholder. TransUnion’s numbers give scale to the social half of that problem — the phone call that convinces someone to hand over what a bot cannot yet steal on its own.
Fraud teams told the survey they estimate losses near 7% of annual revenue in the past year, a figure that should push consumers to treat inbound “fraud department” calls with the same skepticism as an email from a stranger — even when the relationship is years old.