Last year, agentic shopping was still experimental. This year, customers are comfortable handing part of their holiday shopping over to AI — and fraudsters are already adjusting their playbooks to match.

Customers are heading into the 2026 holiday season ready to use agentic help, and the fraud patterns already show it. This month’s Gauge also leads with a fraud ring worth watching as the holiday rush begins: a group that cycled through payment methods on mobile devices to chase down tickets to a high-demand event.

The Fraud Temperature Gauge is tracking the month by month evolution of fraud at the speed of AI, drawing on and adding more context to the constantly updating data from https://intelligence.forter.com/. 

Holiday readiness this year has an agentic twist. Agents were already in the picture last year, and their use spiked around the holidays. This year, it’s likely to be even more noticeable. Agentic use was already climbing by the 2025 holidays, and this year’s starting point is higher across the board.

This year, the shift from LLM chatbots toward AI personal assistants is already having an impact. Forter’s data shows that over the course of September:

  • Transactions from Muse were up 42% in just two days
  • Transactions from Instinct and Grok Bot went up over 250%

A rising Muse floats all AI boats

The impact isn’t confined to the personal assistants themselves.

  • Since Muse arrived, OpenAI’s daily orders are up 16% week over week
  • All agentic orders are now x5.3 their early August level

Assistants will attempt transactions on your site whether or not you’ve optimized for that. So if you haven’t yet, it might be time. Find out if your site is agent-ready with a free online assessment by Ora.ai — no sign-up required.

Forter’s consumer research found that 67% of Americans plan to engage in AI holiday shopping in 2026, and 78% of holiday shoppers are comfortable letting AI handle at least one part of their shopping journey. Retailers who provide customers with a great agentic experience may gain an edge on their loyalty, and the opportunity to become more of a habit, in the year to come.

On the non-agentic front, there are areas merchants should be focusing on to make sure they’re protected during the seasonal rush.

How to prepare for the holidays is always a challenge. Looking at industries that typically experience new trends earlier can help. The betting/predictions industry is one of these: it often sees strong trends develop before they spread to other industries — something we’re seeing play out right now.

So, this month, we’re taking a deep dive into what trends there tell us about what to put on your holiday readiness checklist this year:

  • Account takeover (ATO), in part driven by AI
  • Identity verification/Know Your Customer (KYC) bypass
  • Multi-account fraud and abuse
  • Device takeover (DTO)

Fraud ring deep dive: The costume change crew

This month’s fraud ring earns a Halloween-season nickname: one device fingerprint, a lot of different masks. The group cycled through payment methods — mobile wallets, PayPal, credit cards — while opening new accounts on the same free webmail domain, the fraud equivalent of changing costumes between doors on Halloween night. The variety served two purposes: finding a vulnerability, and trying to bypass velocity controls.

This ring made repeated attempts from Latin America using Android devices, often over mobile networks, to try to buy tickets for a high-demand international sporting event in the US.

  • Target: Tickets for one specific international soccer match. High AOV (roughly 500–3K+). High-value event tickets with immediate resale potential.
  • Fraud method: Payment method cycling and repeated authorization failures. Rapid-fire attempts within minutes, trying different payment methods (mobile wallets, PayPal, Visa, etc.) to get one to authorize.
  • Connection: Primarily mobile network (65%).
  • Payment: 65% mobile wallets, 26% PayPal, 9% credit card (especially premium Visa). All PayPal transactions linked to cards issued in the same Latin American country as the IPs. The ring rotated between digital wallets to bypass velocity controls.
  • Platform: 100% mobile web on Android/Chrome.
  • Device: One device fingerprint appears in 70% of transactions, across multiple newly created accounts on the same free webmail domain.

Takeaway: As we head toward the holidays, expect fraudsters — and especially fraud rings — to explore high-level vulnerabilities as well as individual opportunities. If they find a weakness relating to a particular payment method, device, or browser, they’ll have time to prepare to exploit it at serious scale under the cover of the holiday rush.

By the numbers

  • 2.3 million attacks in October. Credit card fraud remains high. Account-based attacks like ATO or multi-account creation grab the headlines, and are certainly increasing, but at the same time credit card fraud is still a major source of potential loss for businesses.
  • 3.5K large, coordinated fraud rings detected across the network — holding roughly steady month over month. They typically hit multiple sites, many times each. In today’s reality, most fraud rings use AI tools in their attacks.
  • Over 65% of fraud and abuse methods in betting/gaming/prediction involve multi-account creation or account takeover — a 234% surge in ATO YoY.
  • Device takeover (DTO) is emerging as an advanced attack vector: it’s grown in betting by more than 500% in the last year. That’s a huge increase, reflective of a real explosion in this type of attack.
  • DTO is x2 more common in non-mobile devices (laptops, desktops) than in mobile devices. Non-mobile devices present extra opportunities to find and exploit vulnerabilities, and are more likely to be used by less tech-savvy individuals.

Vertical spotlight: Account Takeover (ATO) in betting

In betting, Forter has seen a massive 234% surge in ATO attacks year on year, and stopped an average of ~749,000 ATO transactions per month this year.

Fraudsters aren’t managing this kind of growth alone. They’re working with AI.

AI impact on ATO:

  • Malicious use cases: Black hat AI tools (like FraudGPT, WormGPT, EvilGPT, DarkBARD, OnlyFake, etc.) lower the barrier to entry, and enable scale.
  • Phishing: Phishing campaigns that are highly personalized, mimicking legitimate brands and styles, across platforms — at scale.
  • Credential stuffing: Credential stuffing that’s smarter and more scalable. AI infers password variations from leaked data.
  • Global reach: Widespread connectivity, with localization. Culturally adapted content in any language.

Identity verification and KYC bypass

Identity verification bypass tools and services are also growing, including for KYC processes, which are often thought of as more reliable. Fraudsters are finding ways of getting around the checks that organizations use to distinguish legitimate identities from false ones. Deepfake videos and photos, and fake documents, are far easier and faster to create with AI’s help.

Finance, fintechs, and regulated industries more generally are particularly hard hit by this trend. But many industries use some form of identity verification in their processes. Fraudsters often test their products on relatively smooth flows such as ride-sharing apps to prove that they work. This is part of a wider pattern of criminals investing in their longer-term audience and market.

Device takeover

2026 is the year that device takeover (DTO) has truly emerged as an advanced attack vector. It’s grown by more than 500% in the last year.

Malware, remote access tools, and device emulators allow fraudsters to hijack trusted devices, bypassing device-based security controls while executing fraudulent deposits, withdrawals, and betting activity.

AI means that fraudsters no longer need deep technical expertise to carry out this kind of attack. Malware, Remote Access Trojans (RATs), and emulators are much easier to create. At the same time, targeted, personalized phishing attacks have become fast and simple to carry out.

Bad bots

Sophisticated bot networks and credential stuffing are accelerating — another AI use case for non-technical fraudsters — and are seen in over 40% of attacks against betting sites. Bad bots are tied to high-damage order values: more than x6 the value of good bots.

In an ordinary month, bad bots might represent only ~18% of traffic, but they account for more attempted transactions than all the other bots put together.

Get real-time fraud data

This month’s ecommerce fraud trends are a snapshot. The fraud landscape moves faster than any monthly recap can capture. For a real-time view of attacks blocked, ATO patterns, and fraud trends across industries and regions, explore Forter’s Fraud & Abuse dashboard.

You can filter by vertical or region to see

Published on October 28, 2026   •  
6 minute read   •  
Author: Forter Team