This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Microsoft's Cyber Signals report details a significant surge in AI-driven fraud between April 2024 and April 2025, during which the company blocked 1.6 million bot signup attempts per hour and thwarted $4 billion in fraud. Malicious actors are leveraging generative AI to rapidly create convincing fake e-commerce storefronts, job listings, and phishing campaigns, while using deepfakes and voice cloning to enhance social engineering. In response, Microsoft has implemented AI-powered detection and fraud-prevention features across its products, including Edge, Defender, and Quick Assist, to protect users from these evolving threats.
Between April 2024 and April 2025, Microsoft reportedly blocked 1.6 million bot signups per hour and disrupted $4 billion in fraud attempts linked to AI-enhanced scams. The company's Cyber Signals report details how generative AI is being used to fabricate realistic e-commerce sites, job offers, customer service bots, and phishing lures. Fraud actors now automate mass-deceptive campaigns with fake reviews, deepfakes, and cloned brand domains at unprecedented scale and speed.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to gain a personal advantage over others such as through cheating, fraud, scams, blackmail or targeted manipulation of beliefs or behavior. Examples include AI-facilitated plagiarism for research or education, impersonating a trusted or fake individual for illegitimate financial benefit, or creating humiliating or sexual imagery.
The incident involves cybercriminals using generative AI, deepfakes, and voice cloning to create highly convincing fake storefronts and job listings to defraud individuals for financial gain.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The risk is caused by human cybercriminals intentionally deploying generative AI tools post-deployment to execute sophisticated fraud campaigns.
Added categories peak at 4: Severe (Epistemic Harm, Inferred)
The incident details a massive global surge in AI-driven cyber fraud and scams, leveraging deepfakes, voice cloning, and generative AI to target consumers and job seekers. While the financial scale is significant with 4 billion dollars in thwarted fraud, the national security implications are minor and primarily affect economic security and societal trust in digital platforms.
The report describes generative AI tools being used by scammers to augment their capabilities, allowing them to write code, generate fake reviews, and create websites much faster than before.
Risk Level 3: Limited Risk. The report describes the use of chatbots and AI-generated content such as deepfakes and voice cloning to run scams, which fall under the category of AI systems requiring transparency obligations.
The scammers leverage AI-powered customer service chatbots to interact with victims and delay chargebacks, as well as voice generation and deepfakes to clone voices and conduct fake interviews.
The reports provide consistent, detailed statistics from Microsoft's Cyber Signals report regarding the scale of AI-driven fraud, including specific figures on thwarted fraud ($4 billion) and blocked bot signups (1.6 million/hour). The role of generative AI in enabling these scams is clearly explained, and there are no major conflicting accounts among the sources.
Some of the described activities, like Storm-1811's Quick Assist abuse, did not use AI, which could lead to overestimating the role of AI in all reported tech support scams.
Technology
Lowered technical bar for fraud
Generative AI makes creating believable scam content cheap and fast.
Easily bypassed ethical algorithms
Scammers bypass safety filters by slightly rephrasing their prompts.
AI-powered deception tools
Chatbots and deepfakes mimic real humans to stall chargebacks and fool victims.
Data Inputs
Social media data scraping
Scammers scrape personal data to create highly targeted phishing lures.
Stolen credentials on dark web
Stolen customer information is sold on the dark web to feed scam campaigns.
Web scraping of company data
Scammers scrape company sites to build detailed profiles of employees.
Human Factors
Convenience over safety priority
Users treat security as an afterthought to maintain online convenience.
Insufficient digital literacy
Users lack the training to identify sophisticated AI scams and deepfakes.
Vulnerability to psychological triggers
Scammers exploit trust in social proof, urgency, and fake reviews.
Process and Methods
Scam-as-a-service availability
Unsophisticated scammers can purchase advanced kits on the dark web.
Inadequate employer verification
Job platforms lack multi-factor authentication for employer accounts.
Lack of proactive fraud controls
Historically, security controls were not embedded directly into product design.
Management
Reactive security approach
Security is often treated as an afterthought rather than a design requirement.
Slow adoption of defense AI
Attackers adopt new technologies faster than defensive organizations can.
Regulatory Environment
Global jurisdiction challenges
Cybercriminals operate internationally, making cross-border enforcement hard.
Lagging AI ethics guidelines
Ethical principles exist but lack strong legal enforcement mechanisms.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
