forms.app report finds fake logins top form fraud at 23%

forms.app’s Form Security Report 2026 tracks phishing and fraud across its platform from April to October 2026. Fake login pages were the most common scam, while finance was the most targeted industry and SASSA was the most impersonated brand.

Why it matters: - Online forms are a growing fraud channel because scammers can use them to steal passwords, national IDs and other personal data. - The report shows which scams are most common, which brands are being abused, and how quickly fraud patterns shift over time. - forms.app says its detection system also offers a look at how automated defenses are adapting as attackers change tactics.

What happened: - forms.app released its Form Security Report 2026 on Oct. 27, 2026. - The report analyzes every form flagged on the platform from April through October 2026. - The company says the report covers phishing and fraud forms, the brands impersonated, real examples and how forms.app removes abusive forms. - The full report is available here.

The details: - Finance was the most targeted industry, and 26% of forms that impersonated an organization posed as a bank, payment app, crypto company or investment firm. - SASSA, South Africa’s social security agency, was the most impersonated brand. - Attackers used SASSA-themed forms to collect national ID numbers under the pretext of changing phone numbers or claiming grants. - Fake login pages were the most common phishing form, accounting for 23% of confirmed phishing forms. - Identity and KYC harvesting was the second most common phishing form, at 17%. - National ID numbers were the most requested data point, appearing in 5,028 confirmed phishing forms. - Passwords were requested in 5,002 confirmed phishing forms. - Phishing accounts operated from 168 countries. - Indonesia accounted for 13.5% of those accounts, followed by the United States at 12.6% and Nigeria at 8.7%. - 39% of banned users showed signs of VPN use at sign-up. - 96% of phishing accounts published exactly one form. - 91% signed up with a free webmail address. - forms.app says its detection system uses four layers: rules based on recurring fraud patterns, similarity checks, a fine-tuned local model and manual reviews. - The system improved with each ban, and 63% of bans were fully automatic over the six-month period. - Automatic bans rose from 18% in May to 77% in October.

Between the lines: - The data suggests scammers favor low-effort, disposable accounts that can be created quickly and abandoned after one campaign. - The focus on national IDs points to fraud that can outlast a password reset because identity numbers cannot be changed. - The increase in fully automatic bans suggests forms.app’s fraud controls became more effective as the system learned from repeated abuse patterns.

What’s next: - forms.app is likely to keep refining its fraud detection as new scam patterns emerge. - The report gives brands and security teams a reference point for spotting common impersonation tactics before they spread further. - forms.app also says the 40-page PDF version of the report is available for deeper review.

The bottom line: - Fake login pages remain the most common form of online form fraud, but the bigger risk is the scale, speed and adaptability of the accounts behind them.