Online forms are a cornerstone of modern digital life, but they’ve also become a prime hunting ground for fraudsters. A new report from forms.app, the online form builder, offers a rare, data-driven look at how scammers weaponize these everyday tools, revealing that the humble login page is now their most potent weapon.
The company’s Form Security Report 2026, released today from London, analyzes every form flagged on its platform between April and October 2026. The findings paint a clear picture of scammers’ tactics, their preferred disguises, and the specific data they are desperate to steal from unsuspecting users.
Form Security Report 2026 by forms.app explores phishing and fraud forms, which brands are targeted, who is behind the fraud, and how forms.app fights it.
Also worth a look: Outdoo AI launches AI trainers and closed loop coaching to fix AI skills gap and QuickLaunch puts campus security first as universities expand digital identity access.
Most people never think about who is behind a form, and they shouldn’t have to. Our job is to make every form on forms.app one they can trust.”— Tolga Kizilkaya, Co-founder of forms.app
According to the report, the finance sector bears the brunt of these attacks. While the top three most-impersonated brands come from other industries, a staggering 26% of forms that mimic a legitimate organization pose as a bank, payment app, crypto platform, or investment firm. The single most impersonated brand, however, is SASSA, South Africa’s social security agency, which attackers use to harvest national IDs under the guise of updating phone numbers or claiming grants.
Digging into the mechanics of the scams, the report identifies the fake login page as the most common phishing form, accounting for 23% of all confirmed cases. These pages are designed to capture passwords directly. Close behind, at 17%, are forms used for identity and KYC (Know Your Customer) harvesting. The data sought is telling: national ID numbers were requested by 5,028 confirmed phishing forms, narrowly edging out passwords at 5,002. While passwords enable immediate, direct abuse, ID numbers are far more dangerous long-term—they cannot be changed and make victims a lasting target for intricate, ongoing scams.
The report also lifts the veil on who is behind these operations. Fraudulent accounts were created from 168 different countries, with the highest concentrations in Indonesia (13.5%), the United States (12.6%), and Nigeria (8.7%). A significant 39% of banned users showed signs of using a VPN at sign-up, and the accounts themselves are largely disposable: 96% of phishing accounts published only a single form, and 91% were registered using free webmail addresses.
On the defensive side, forms.app details its multi-layered detection system, which combines rules built from recurring fraud patterns, similarity checks, a fine-tuned local AI model, and manual reviews. This layered approach is proving increasingly effective. Over the six-month period, 63% of bans were fully automatic, a figure that climbed from just 18% in May to a robust 77% by October, showing the system learns and improves with every action taken.
To explore the full findings, the Form Security Report 2026 is available online at https://forms.app/en/security-report-2026, with a complete 40-page PDF version also accessible.
About forms.app
forms.app is an online form builder designed for teams to create professional-looking forms and collect unlimited responses. Trusted by over 4 million users, the platform offers free team collaboration, an AI form generator, a drag-and-drop editor, 5,000+ templates, conditional logic, custom PDF generation, payment collection, e-signatures, and a wide range of native integrations. Its free forever plan includes unlimited responses and team members, available at https://forms.app.
Why it matters: This report highlights a critical shift in cybercrime—attackers are increasingly targeting unchangeable personal data like national ID numbers, not just passwords. For businesses and individuals, it underscores the need for heightened vigilance when interacting with online forms, as even a trusted brand’s login page can be a convincing facade for fraud.
Tolga Kizilkaya
forms.app
info@forms.app
Visit us on social media:
LinkedIn
Instagram
YouTube
TikTok
X
Bluesky
