Phishing Scams in 2026
AI-written lures, invoice fraud, MFA fatigue and OAuth consent phishing: what actually reaches a growing SaaS team, what stops it, and who to call in Canada and the US.
How phishing reaches a growing SaaS company in 2026, and the controls that actually stop it
Phishing scams are messages, calls or prompts that impersonate someone you trust so that you hand over access, approve a sign-in, or move money. For a SaaS company the prize is rarely one password. It is a live identity-provider session, an OAuth grant into Google Workspace or Microsoft 365, or a payment finance releases.
Every few weeks we get a version of the same call. A Series A founder forwards a thread: a vendor they really do pay "updated its banking details," the email came from the vendor's real domain, the grammar was perfect, and a five-figure payment has already left. Usually nobody clicked anything suspicious. The attacker had sat in the vendor's mailbox for weeks, reading invoices.
That is what phishing looks like now. The red flags in older guides (bad spelling, generic greetings) were never great signals, and generative AI removed most of them. The AI-driven attack patterns we track make lures cheaper to tailor at scale. So the defense has to move from "spot the fake" to "make the fake useless."
How big is the phishing problem in Canada and the US?
The reported numbers are large and they undercount. The FBI's 2025 Internet Crime Report logged 1,008,597 complaints and $20.877 billion in reported losses. Phishing and spoofing was the most-reported category at 191,561 complaints. Business email compromise produced 24,768 complaints but about $3.05 billion in losses, which is why it matters more to a company than the raw click count.
North of the border, the Canadian Anti-Fraud Centre's top frauds of 2025 put spear phishing second by dollar loss: 813 reports, 571 victims and $67.9 million, against $704 million in total reported losses across more than 112,000 reports.
Breach data agrees. The Verizon 2026 DBIR found credential abuse in 39% of breaches and third parties involved in 48%, and reported that mobile social engineering (texts and voice calls) succeeds about 40% more often than email phishing. IBM's 2026 Cost of a Data Breach report puts the global average breach at $4.99 million. A 60-person company cannot absorb that like an enterprise.
What do the four phishing patterns that reach SaaS teams look like?
1. AI-written lures that read like your own team
The lure references a real customer, a real Jira ticket or a real board meeting, because the attacker scraped LinkedIn, your changelog and your status page. It arrives as email, Slack Connect, a Teams chat or a text. The SMS and voice side is growing fastest because phones sit outside your mail filter.
2. Business email compromise and invoice fraud
No malware, no link. A compromised or look-alike vendor mailbox sends a "new remittance details" letter, or a fake CEO asks the controller to pay an urgent invoice before a board call. If one person can change a payee and release the wire, your own process does the attacker's work.
3. MFA fatigue and adversary-in-the-middle session theft
MFA fatigue is simple: trigger push prompts until a tired engineer taps Approve. MITRE catalogs it as Multi-Factor Authentication Request Generation. Adversary-in-the-middle is quieter. A phishing kit proxies your real Okta, Entra or Google sign-in page, the user completes MFA normally, and the kit steals the session cookie. The attacker is now logged in, and your MFA log shows a successful sign-in.
4. OAuth consent phishing
The user is asked to "sign in with Google" or "allow access" to an app called something like "DocuSign Viewer." No password changes hands. The app gets a token with mailbox or Drive scope that survives a password reset. MITRE tracks this as Steal Application Access Token. Across our assessments, it is the least monitored of the four.
Voice-cloned executives and deepfake video need their own playbook, covered in the dark side of AI.
Which controls actually stop phishing, and which only feel like they do?
Vendors will dispute this ranking. It reflects what we see work at 30 to 200 people.
Control | Stops | Does not stop | Our priority for a 30 to 200 person SaaS |
|---|---|---|---|
FIDO2 security keys or passkeys on the identity provider | Credential phishing, adversary-in-the-middle relay, MFA fatigue | OAuth consent grants, payment fraud | First. Admins and finance in week one, everyone by day 90 |
Push MFA with number matching | Blind MFA fatigue approvals | Adversary-in-the-middle kits, which relay the number too | Acceptable stopgap, not the end state |
SMS or email one-time codes | Password-only reuse attacks | Almost every modern phishing kit | Retire for staff accounts |
Admin consent required for third-party OAuth apps | Consent phishing | Session theft | First 30 days. Built into Google Workspace and Microsoft 365 |
Callback to a known number plus dual approval for payee changes | Invoice and bank-change fraud, CEO fraud | Nothing technical; it is a process control | First 30 days. Highest return per hour spent |
Secure email gateway add-on | Commodity bulk phishing | Clean-domain BEC, texts, Slack, consent prompts | Lower than most vendors claim if native filtering is on |
Annual click-rate simulations | Gives you a metric for the insurer | The click itself, reliably | Lower priority than a one-click report button |
The CISA fact sheet on phishing-resistant MFA makes the same ranking: phishing-resistant MFA is the gold standard, FIDO/WebAuthn is the only widely available form, and number matching is for teams that cannot move yet. Identity first, then payments, then everything else: the core of our process risk and controls work.
How do you build a reporting culture that beats the click?
Someone will click. What matters is whether they tell you in five minutes or after the wire clears.
One button, one channel. A report button in the mail client and a single Slack channel. No form.
Thank people, every time. One public "good catch" does more than a quarter of simulations.
No blame for the clicker. Punish a self-report once and you lose your best early warning.
Revoke, then investigate. On a report: kill sessions, revoke the OAuth grant, reset credentials, then look at the logs.
Your incident response plan for a small business should name who does each of those steps after hours.
Where do you report phishing and fraud in Canada and the US?
If money moved, call your bank first and ask for a wire recall. Then report externally the same day.
Canada: The Canadian Anti-Fraud Centre at 1-888-495-8501 or through the Report Cybercrime and Fraud system, plus your local police. If personal information was involved, assess whether the breach creates a real risk of significant harm under PIPEDA, and under Quebec Law 25 if you hold Quebec residents' data.
United States: File a complaint with the FBI at ic3.gov. For wire fraud, include the beneficiary bank and account details. State breach notification laws, and HIPAA if you handle health data, may also apply.
Keep the original message with full headers. Privacy notification decisions are part of our data security and privacy practice.
What does a 90-day phishing defense plan look like?
Days 1 to 30: identity and money
Enforce phishing-resistant MFA for every admin, finance user and anyone with production access.
Require admin approval for new third-party OAuth apps and review existing grants.
Write the payment rule: no payee change without a callback to a number already on file, and two approvers above a set threshold.
Turn on SPF, DKIM and DMARC for your own domains, starting DMARC at p=none to monitor.
Days 31 to 60: detection and reporting
Add the report button and the reporting channel. Announce the no-blame rule from the CEO.
Alert on impossible travel, new inbox forwarding rules and new OAuth grants.
Shorten session lifetimes for admin roles and require re-authentication for sensitive actions.
Days 61 to 90: everyone, and proof
Roll phishing-resistant MFA to all staff and retire SMS codes.
Move DMARC toward p=quarantine once legitimate senders are aligned.
Run one tabletop on an invoice fraud scenario with finance in the room.
Document all of it. SOC 2 auditors and cyber insurers will ask.
For a scored starting point, our cybersecurity baseline assessment maps these controls.
What phishing defenses do NOT stop
Training does not stop a well-built lure. A tailored message that references a real deal will fool careful people. Train for reporting speed, not perfection.
Phishing-resistant MFA does not stop consent phishing or payment fraud. A token granted by the user and a wire approved by the controller are both "legitimate." That is why the table has three separate first-30-day items.
Authentication checks do not help if the vendor is breached. Their real mailbox passes SPF, DKIM and DMARC. Only the callback rule catches it.
You may not need a phishing platform yet. A company under about 20 people, with founders approving every payment, gets more from MFA, the callback rule and native mail filtering than from a paid simulation tool. Buy the platform when an insurer, auditor or enterprise customer asks for evidence of training.
Frequently asked questions
Is MFA enough to stop phishing?
Not the common kinds. SMS codes and push approvals can be relayed by adversary-in-the-middle kits. Security keys and passkeys resist this because they will only sign in to the genuine domain.
What should we do in the first hour after someone clicks?
Revoke the user's sessions, remove any new OAuth grants and inbox rules, reset credentials, and if money moved, call your bank to request a recall. Then report to the CAFC or IC3.
Does a SaaS company need phishing simulations for SOC 2?
SOC 2 expects security awareness training and evidence that it happened. It does not require simulations specifically. Simulations are a convenient form of evidence, not a requirement. Our GRC team can show what auditors usually accept.
Who should own phishing defense in a company without a CISO?
Someone with authority over both identity and finance processes. Often that is the COO or CTO, with a virtual CISO setting the priorities.
Written by Victoria Arkhurst, CISSP, CRISC, CISA, CDPSE, 25+ years in security and risk. If a suspicious thread just landed, book a call with our team.
Related Articles
Cybersecurity Incident Response
What Are SSPM Tools?
Ransomware Attack In the Midst
Ransomware Best Practices
Threat Modeling in Product Design
Is your Board asking About AI?
Our Industry Certifications
Our diverse industry experience and expertise in AI, Cybersecurity & Information Risk Management, Data Governance, Privacy and Data Protection Regulatory Compliance is endorsed by leading educational and industry certifications for the quality, value and cost-effective products and services we deliver to our clients.
We specialize in transforming scaling SMB's, Startups, SaaS businesses in regulated industries into cyber-resilient organizations with cost-effective Virtual / Fractional CISO & AI Governance Services.
Awards & Recognition
