More than one in three login attempts observed across Asia Pacific were flagged as high or critical risk, according to new research from Akamai, well above the global average.
Key Takeaways
- 36.4% of APAC login attempts were flagged high or critical risk, against a global average of 26.6%, the second-highest rate of any region.
- Banking and fintech together account for 12.5% of observed attack activity in APAC, making financial services the region’s most targeted sector.
- Globally, online scam detections doubled from 3.2 million to 6.4 million year-over-year, overtaking phishing for the first time in Q1 2026.
APAC trails only Latin America for login risk
Akamai’s latest State of the Internet security report found that 36.4 percent of APAC login attempts were flagged as high or critical risk, exceeding the global average of 26.6 percent. The region recorded the second-highest proportion worldwide, behind Latin America at 37.8 percent, and ahead of North America (23.6 percent) and EMEA (23.7 percent).
Financial services bear the brunt in APAC
Banking (6.4 percent) and fintech (6.1 percent) together account for 12.5 percent of observed attack activity in the region, making financial services APAC’s most targeted industry. In July 2026, Akamai tracked simultaneous attacks against one APAC financial institution using two different tactics: an automated barrage of 42,000 requests over seven days designed to mass-validate credential databases, and a separate, far quieter attempt using just 164 requests engineered to slip past rate limits and set up synthetic accounts.
In Southeast Asia specifically, Akamai researchers identified 2,157 URLs linked to campaigns that used travel-related searches to redirect users to regional gambling platforms, targeting cryptocurrency investors, financial institutions, consumer brands and commerce businesses for credential theft and payment fraud.
Scams are now outpacing phishing
Globally, online scam detections doubled year-over-year from 3.2 million to 6.4 million, overtaking traditional phishing for the first time in the first quarter of 2026, as attackers prioritise immediate financial fraud over long-term credential theft. The average lifespan of a phishing campaign has also dropped sharply, from 48.3 days in the fourth quarter of 2025 to just 22 days in the second quarter of 2026.
“Fraudsters are getting better at hiding in plain sight. What looks like a routine login, a new account or a small payment could be part of a larger attack, with AI and automation making these schemes easier to scale and blend in. The challenge for businesses is that suspicious activity does not always look suspicious in isolation. Organizations need to connect the dots across the entire customer journey to identify fraudulent intent early, while ensuring that legitimate customers can continue to transact seamlessly,” said Reuben Koh, Director of Security Technology and Strategy, APJ at Akamai.
Moving beyond reactive defences
Akamai recommends that organisations adopt behavioural detection and bot management across the entire account lifecycle, from registration and authentication through to payments, and look beyond individual phishing sites to spot shared infrastructure behind coordinated campaigns.
