September 2026 Summaries

Anthropic’s September 2026 Threat Intelligence report describes how AI is enabling familiar fraud techniques to operate at greater speed, scale, and automation, including account farming, credential theft, KYC-session interception, app-based scams, and card-data resale. One Russian-speaking actor reportedly used residential proxies, antidetect browsers, automated onboarding bypasses, and autonomous vulnerability testing to create fraudulent accounts and steal credentials, while also capturing legitimate KYC sessions through lookalike verification sites and reusing them from different devices. A separate China-based app studio allegedly created more than 20 differentiated dating apps with AI-driven personas, gig-worker-assisted interactions, review-only behavior designed to evade app-store scrutiny, and payment redirection outside platform protections. The report also highlights carding infrastructure that enriches and markets stolen payment data through searchable online tools. Across these cases, the underlying attacks are largely established techniques, but AI reduces the expertise and staffing required to execute them, making device intelligence, behavioral signals, automation detection, and context-aware risk assessment increasingly important alongside conventional identity, credential, and payment checks.

Fingerprint has introduced several fraud-detection signals for web and mobile designed to identify social engineering, automated abuse, and suspicious device activity. Active Call Detection identifies whether a cellular or VoIP call is occurring during sensitive actions such as password resets or transfers, helping organizations recognize possible phone-based scams without collecting call details or requiring additional permissions. Browser classification now distinguishes genuine Chrome from other Chromium-based browsers, reducing opportunities for bots to impersonate Chrome and improving risk-model data. Developer Tools Detection has expanded to mobile, checking indicators such as developer mode, debugging, development signing, and Xcode execution that may suggest reverse engineering or automation. Proximity Detection is now available for web browsers, using permission-based location data to create coarse, non-identifiable zone identifiers that can expose device farms, multi-accounting, or identity resets occurring without meaningful physical movement. Availability, plan eligibility, and SDK or JavaScript Agent version requirements vary by signal.

Fingerprint describes its OEM partnership model, which allows fraud, identity, and payment platforms to embed its device identification technology and more than 100 real-time risk signals into their own products under white-label or co-branded arrangements. The company argues that outsourcing device intelligence can reduce development time from quarters or years to weeks, avoid ongoing maintenance caused by browser, operating system, privacy, and fraud-evasion changes, and provide more accurate recognition of visitors across conditions such as cleared cookies, incognito browsing, and VPN use. Partners can use these signals to improve risk scoring, adaptive authentication, fraud-ring detection, transaction security, checkout experiences, and chargeback prevention while reducing false positives and unnecessary verification steps. Fingerprint positions embedded device intelligence as an increasingly essential specialist capability, similar to embedded payments and identity verification, and contends that platforms adopting it can better meet enterprise expectations without diverting resources from their core products.

Travel and hospitality platforms face expanding fraud risks as seamless booking, unified identities, loyalty programs, stored payments, and interconnected partners create more opportunities for account takeover, loyalty-point theft, reservation manipulation, refund abuse, and later chargebacks. The report argues that high-value, time-sensitive transactions, uneven controls across distributed ecosystems, and automated customer-service systems enable fraud to spread across multiple services before it is detected, with loyalty programs becoming especially attractive because points function as readily redeemable stored value. Traditional login, MFA, checkout, refund, and dispute controls remain useful but may identify fraud too late, after financial losses, support costs, and reputational damage have accumulated. It recommends shifting toward continuous, real-time session-level risk evaluation using behavioral, device, account-state, and contextual signals, allowing platforms to challenge suspicious activity before bookings, redemptions, or refunds are completed while minimizing friction for legitimate travelers.