In 2025, cybercriminals use more advanced and sophisticated tools with Artificial Intelligence to access personal and sensitive information. By tracking the latest trends and threats in online identity theft, one can help citizens and business owners to enhance their security and mitigate the criminal phenomenon.
Some of the latest trends in Online Identity Theft:
AI Generated Phishing Scams
There is significant rise of AI-generated phishing attacks in which cybercriminals use AI to create highly personalized and convincing fraudulent emails which target both citizens’ emails and executives alike. These are Artificial Intelligence bots that crawl and analyze available public personal data from online profiles in order to immitate the tone and style of communications. In this way the AI-generated emails make it difficult to distinguish between genuine and malicious messages. This has resulted in a surge of sophisticated phishing campaigns that can bypass standard email filters and cybersecurity defenses.
Deepfake Technology and Voice Cloning
Another notable rise is the one of deepfake technology as it brings new dimensions to identity theft. Scammers leverage AI-powered voice synthesis to create convincing voice clones. These clones require only a few audio samples from public sources like social media. They are then used to deceive family members or bypass voice-authentication systems, leading to unauthorized access to sensitive accounts and information.
Emergence of Phishing-as-a-Service (PhaaS)
Phishing-as-a-Service (PhaaS), enables cybercriminals to execute sophisticated attacks without extensive technical knowledge. These software kits often incorporate AI capabilities, including deepfake features, allowing the creation of highly convincing phishing schemes. This democratization of cybercrime tools has contributed to the increasing frequency and complexity of phishing attacks.
Synthetic Identity Fraud
Another alarming development is the emergence of synthetic identity fraud. In Synthetic Identity Fraud criminals combine legitimate information, such as social security numbers, with fabricated details to create entirely new identities. These synthetic identities can operate undetected for extended periods, gradually building personal profiles that enable significant financial fraud. This type of fraud is particularly challenging to detect and resolve, as it blends real and fake information seamlessly.
All the aforementioned threats and challenges for LEAs are observed under a wider context in which criminals leverage Artificial Intelligence to create multilingual messages, realistic impersonations, automate processes, to complicate detection efforts by law enforcement agencies.
What citizens, individuals and organizations can do:
Implement phishing-resistant authentication: use advanced authentication methods such as passkeys, hardware security keys, and number-matching push notifications to enhance security (financial institutions and banks in Europe are promoting this security measure in their awareness campaigns).
Establish strong passwords: Develop unique, memorable passwords to verify identities during suspicious interactions, helping to prevent falling victim to scams involving voice cloning or deepfakes.
Monitor your digital footprints: Regularly review and limit the amount of personal information shared online to reduce exposure to data harvesting by cybercriminals.
Utilize identity protection services: Engage services that provide real-time alerts for identity checks and unauthorized activities.
Conduct regular employee training: Organizations should invest in comprehensive training programs to educate employees about the latest phishing tactics and social engineering techniques, fostering a culture of vigilance and awareness.
***
KEMEA – Center for Security Studies
Author: Efstathios Kassios