Customer relationship fraud is moving beyond account opening and into the activity that follows. A TransUnion study reviewed by blog.knowbe4.com and markets.businessinsider.com shows that attackers increasingly exploit established identities, accounts, and communication channels.
- Globally, 81% of suspected digital fraud in the first half of 2026 happened while organizations interacted with people they already regarded as customers.
- Fifty-one percent of U.S. Business leaders said scam and authorized fraud rose during the preceding 12 months.
- Leaders put estimated fraud losses at almost 7% of annual revenue.
- Sixty-seven percent expected synthetic identity fraud to become more prevalent over the following two years.
- Nearly one in five outbound business-to-consumer calls involving U.S. Mobile carriers were spoofed during the first half of 2026.
Onboarding checks are only the first defense
TransUnion’s report, Fraud in the Age of Continuous Trust, found that fraud risk continues after an account has been approved. The exposure can return during authentication, profile updates, and financial activity.
This exposes a weakness in a familiar security pattern. Organizations often apply their strictest identity checks when someone signs up, then relax those controls once a relationship is established. Attackers benefit from that change in attention. A legitimate customer record, known contact number, and recognizable brand can make a fraudulent request look ordinary.
Synthetic identities add another layer. Attackers combine information exposed to them with invented characteristics to create personas that appear credible. The concern is not limited to false applications. A synthetic persona may also be used to obtain access to an existing account or authorize a payment.
AI lets offenders automate much of that work. It can produce identities and persuasive messages while rapidly testing which approach works. Detection systems must therefore adapt at least as quickly as the criminal operation.
Trusted calls and texts become attack surfaces
The report found that close to 20% of outbound business-to-consumer calls involving U.S. Mobile carriers were spoofed in the first half of 2026. In addition, six in ten business leaders said their customers had encountered text spoofing during the previous year.
These attacks exploit recognition rather than technical obscurity. A message may carry the right company name, mention a real product, and appear during a plausible billing or delivery window. A spoofed phone call can produce the same effect, making the request harder to dismiss.
Scam and authorized fraud also placed a heavy burden on losses. Thirty-five percent of U.S. Business leaders identified that category as their organization’s biggest source of fraud-related losses. Some of those incidents persuade a customer to authorize a transfer or disclose credentials under false pretenses.
The trade-off is clear. Businesses cannot eliminate every legitimate call or text without making service unworkable. They need controls that add verification when requests involve money, access, or changes to account information.
Why this matters for security teams
Customer relationship fraud favors attackers who understand how a company communicates. Security teams should connect identity, device, transaction, and communication signals rather than treating each as a separate investigation.
An isolated login alert may look routine. Combined with a recent phone-number change, an unusual payment instruction, and a spoofed text, it becomes a stronger reason to interrupt the transaction. That context is particularly important where the account holder already has years of history with the organization.
One practical example is a bank customer receiving a text that appears to come from the lender. It reports unusual activity and directs the customer toward a “verification” number. Because the institution and customer relationship are genuine, the request may initially seem credible.
The safer response is to open the bank’s official app and check the account there. The customer does not use the supplied link or phone number. For the bank, the same case illustrates why suspicious text spoofing and attempted account changes should be assessed together.
What readers should verify
Consumers should not treat a familiar sender name as authentication. A call from a familiar number or a text mentioning a real account can still be fraudulent. The safest route is an official app, the number printed on a card, or contact information established before the suspicious message arrived.
Requests involving one-time codes, passwords, remote access, new beneficiaries, or unusual payment methods deserve particular caution. Even a genuine customer relationship does not prove that the person currently communicating is the account holder.
Companies should offer an equally obvious verification path. If they warn customers about spoofing, they should also explain how employees will request sensitive information and how customers can independently confirm that a request is legitimate.
What to watch next
TransUnion reported that 43% of U.S. Business leaders described fraud as placing significant or severe pressure on their organizations. Fifty-three percent named synthetic identity fraud as the threat for which they felt least prepared, while 67% expected its scale to increase.
As of June 30, 2026, TransUnion placed U.S. Lender exposure associated with synthetic identities at $2.4 billion. That figure makes lifecycle-based monitoring more urgent, particularly for lenders and other organizations where an established identity carries meaningful account access.
The next sign of progress will not simply be better fraud scores. It will be faster detection of suspicious activity occurring inside legitimate relationships, paired with communication channels that resist easy impersonation.
Key takeaways
- Most suspected digital fraud in the study occurred during interactions involving established customers.
- Spoofed calls and texts give attackers a way to imitate trusted organizations.
- AI is increasing the speed and scale of identity creation and social engineering.
- Authentication and transaction monitoring need to continue after account approval.
- Customers should independently verify unusual requests through an official channel.
Frequently asked questions
What is customer relationship fraud?
It is fraud aimed at established customers, accounts, or transactions instead of relying mainly on fictitious identities created during registration.
How do synthetic identities support fraud?
Attackers combine exposed personal information with fabricated details to construct personas that may defeat weak controls or gain access to existing accounts.
Can a legitimate company name make a text safe?
No. Sender names and phone numbers can be spoofed. Confirm unusual requests through an official app, statement, card, or previously established contact method.
Why should organizations monitor the full customer lifecycle?
Fraud may emerge during registration, login, or a transaction. Connecting activity across those stages gives defenders context that a one-time account-opening check would miss.
What should a customer do after receiving a suspicious call?
End the contact and independently verify the issue using an official app, card, statement, or trusted number. Avoid links and phone numbers supplied in the suspicious message.