Experian's 2026 fraud numbers move the work from catching events to proving people

Experian's 2026 U.S. Identity and Fraud Report describes a market in which scams run across messages, websites, documents, voices, images and account activity, rather than arriving as discrete incidents ^[1]. The report contrasts this with the older model, in which fraud meant a forged check, a stolen credit card or a false invoice ^[2] - artefacts you could catch at the moment of the transaction.

The sentence that should reorganise a budget is this one: according to the report, a fraudulent payment or account change may be the final step in a longer chain of deception ^[3]. If that is true, transaction monitoring is inspecting the last link of a rope that was tied somewhere else, usually at onboarding or account recovery.

The business-side concerns in the report line up with that reading. AI-generated phishing is named a leading concern, alongside document forgery, automated bot attacks and synthetic identities ^[4]. Three of those four are identity-manufacture problems, not payment-anomaly problems. You do not catch a synthetic identity by scoring its first purchase; you catch it, or fail to, at the point where you decided it was a person. Experian puts verification weight at account opening specifically, where firms need to detect stolen credentials, synthetic identities and manipulated documents ^[5].

Consumer numbers point the same direction. Seventy-one percent say accurate online recognition is important ^[6], and 84% say they will accept additional verification when it helps prevent fraud ^[7]. Behavioral biometrics make 83% feel secure, with banking app authentication, physical biometrics, ID verification and passwordless login also ranking highly ^[8]. Awareness of the attack side is broad but uneven: about 60% have heard of scams using AI-generated images or video, 53% of AI-generated phishing messages, and 47% of deepfake voice impersonation ^[9]. Nearly half feel more like a target than a year ago ^[10].

The service-channel cost is the part that tends to get underpriced. The report says criminals can imitate emails, messages, websites, documents, voices and customer support interactions ^[11], and it lists account recovery alongside account opening and high-value transactions as a moment where extra checks may be appropriate ^[12]. Every channel where a human can be talked into a reset now needs its own identity proof, and voice is no longer evidence. The report's own answer is risk-matched authentication, with routine activity from a familiar device requiring fewer steps ^[13].

Two more data points worth carrying into planning. Eighty percent of U.S. businesses already use machine learning or generative AI in fraud management ^[14], which Experian says requires reliable data, model monitoring and human review ^[15]. And 27% of consumer-reported account openings were for AI chatbot accounts, up from 16% in 2025 ^[16] - eleven points, or roughly a 69% relative rise ^[17]. That is new account surface being created faster than most verification stacks were scoped for.

Watch three things. First, the measurement set Experian recommends: fraud losses alongside false declines, abandonment, conversion and customer satisfaction ^[18], because verification spend only defends itself if false declines are counted. Second, whether stated willingness to accept extra checks survives contact with real friction; 84% is a survey answer, not a funnel ^[7]. Third, the consent gap: only 23% of consumers feel they have complete control over how their personal data is used online, while 56% want that level of control ^[19] - a 33-point gap ^[20] sitting underneath every verification signal you are about to start collecting. These figures come from Experian, a vendor in this market, and much of the consumer data is self-reported.