New data from Infobip’s 2026 Fraud & Security Report highlights how AI makes it easier for fraudsters to launch large-scale phishing campaigns while also helping organizations develop more advanced defenses like AI-powered detection tools that identify and stop scams before they reach customers.
In an interview with Retail Insider, Andro Galinović, Chief Information Security Officer (CISO) at Infobip, discusses the issue.
Why does holiday shopping create such a strong opportunity for fraudsters to impersonate trusted retailers and brands?
Holiday shopping season is one of the many annual consumer events where consumers are acting on urgency to get the best products and their favorite wishlist items at the best price they can find before December 25. Shoppers are rushing to make sure they have what they need before products run out, and they want to purchase at the lowest possible price (especially if they’re buying for multiple people).
Timely events like holiday shopping, peak summer travel, and even routine bank alerts that require authentication are a breeding ground for scammers who are eager to take advantage of our sense of urgency, knowing it often overrides caution. In fact, we found that shopping events are primary drivers of fraud peaks – December had the highest volume of harmful messages detected in 2025, followed closely by November due to Singles Day, Black Friday, and Cyber Monday all taking place within that month. Bottom line: phishing works because it hinges on human behavior rather than technical vulnerabilities.
When a brand texts you with a holiday “promotion” offering 25% off certain items, it’s worth taking a moment to ensure this is a legitimate deal before clicking on any links, sharing information, or interacting in any way.
How is AI changing the way scammers create and scale phishing messages, fake promotions, and fraudulent notifications targeting shoppers?
Tech innovation and advancements have been transformative for our society, but has in some ways been a double-edged sword by providing bad actors with new tools they can use to more effectively scam at scale.
In an already complicated mobile threat environment riddled with sophisticated phishing tactics and growing communication abuse, AI adds a new layer of complexity by making it easier for fraudsters to personalize, automate, and scale phishing campaigns, as well as optimize attacks, identify vulnerabilities faster, and adapt to blocking measures as consumers hit the block button now more than ever before (blocked messages grew by 12 times year-over-year in North America alone).
With AI, fraudsters can use breached databases to personalize their attacks and make it more difficult to distinguish them from real communications, mimic writing styles, access hundreds of thousands of fraudulent domains to dodge block lists, and use various channels such as voice calls and emails to increase credibility. Moreover, sophisticated fraudsters are able to hide harmful content inside of images to avoid text filters. As a result, scammers are easily able to reach and scam more people, get a sense of their priorities to personalize phishing messages, and exploit their behavior around timely events.
What are the biggest red flags consumers should look for to distinguish legitimate retailer communications from AI-powered scams?
While it’s essential for businesses and telecom providers to strengthen their security measures and infrastructure, there are ways consumers can spot spoofed text messages on their own:
- Double check sender names, phone numbers, and other information.
- Look for verification asks in a message. Verified brands typically direct consumers to log in through an official app or website rather than sending a link within a message.
- Inspect links and look out for mismatching domains, shortened hyperlinks, and misspellings.
- Take a beat before addressing and responding to messages that demand immediate action, warn of account suspension, or threaten consequences.
- Report suspicious messages help mobile operators.
In short, consumers must remain vigilant when they receive any message that hinges on urgency and immediate action, as well as avoid clicking any unexpected links. If there’s ever any suspicious activity, opting to speak with a mobile provider is a good first step that can foster reassurance.
How can retailers use AI and other security tools to detect and stop fraudulent communications before they reach customers?
One major trend we’re seeing is the emergence of AI-powered firewall solutions, which we saw blocked 27% more SMS (Short Message Service) threats than in previous years. These solutions operate within telecom providers’ network infrastructure so they have more direct control over SMS traffic, whereas traditional enterprise security solutions only operate at the application layer, making it more difficult for telecom providers to intervene.
AI also enables real-time detection of threats, making it easier for businesses to stop threats that get past initial blocking and defense. Last year showed a 71% growth in AI-powered fraud detection, with companies adopting this tactic seeing significantly reduced exposure to fraud because of AI’s ability to automatically flag traffic patterns consistent with artificially inflated traffic (AIT), SMS pumping, and bot-driven one-time password exploitation – all of which cost enterprises an estimated $8.5 billion annually.
We’re also seeing some companies strengthen authentication measures across various channels (SMS, voice, WhatsApp, RCS (Rich Communication Services) Messaging, Viber, and other locally dominant OTT (over-the-top) platforms. This enables brands to verify customers on the channels they most prefer without compromising on security standards. Network API adoption is also gaining traction, with SIM (Subscriber Identity Module) swap detection, number verification, and Know Your Customer (KYC) matching proving useful for enterprises to intercept mobile fraud before it impacts customers. In addition, more companies are adopting number masking to keep customers and employees safe by enhancing contact privacy.
What emerging fraud trends are you seeing in retail, and how should retailers prepare for the back-to-school season and other high-volume shopping periods?
Fraud trends in retail touch every part of the customer lifecycle, from account registration to checkout. We’re seeing bots generate fake accounts, account takeover attacks obtaining payment information, fraudsters intercepting one-time passwords, and fake transaction confirmations designed to enable chargebacks.
Because retailers process millions of daily transactions, any friction in customer verification directly impacts customer conversion. AIT (Artificially Inflated Traffic) attacks on retailers are on the rise due to AI maturity, causing large and unexpected SMS fees that show up before attacks are detected. To protect themselves and shoppers, businesses must adopt real-time detection tools, automated security solutions, and network APIs (Application Programming Interface) to prevent these from happening, ensure customer safety, and protect their business bottom line.
More from Retail Insider:
