Online Form Fraud Expands Beyond Login Theft to Personal Identity Information

According to forms.app's 2026 Form Security Report, fraudsters created over 22,000 malicious forms impersonating financial institutions (26%), gaming platforms (24%), and government agencies (21%). The scams have evolved beyond stealing login credentials to collecting national ID numbers, ID photos, and authentication codes simultaneously, enabling identity theft and account takeover.

What Is Online Form Fraud?

Online forms serve as contact points between organizations and users for inquiries, event registration, hiring, grant applications, and payments. While created on legitimate platforms, these forms can be impersonated by fraudsters who exploit the same features to pose as banks, government agencies, gaming companies, and other trusted entities. The form itself may appear professional, but the creator's identity and true purpose of data collection are not guaranteed.

How the Fraud Works

Attackers employ several deceptive tactics:

Display familiar logos, company names, and official-looking layouts
Promise free grants, game items, or unrealistic benefits
Claim shipping fees or "account verification" is required
Distribute questions across multiple fields—each appearing innocent individually, but collectively providing identity theft credentials

What Information Is Being Stolen?

Analysis of 21,901 confirmed malicious forms (April-October 2026):

Most Frequently Requested Information:

National ID numbers: 5,028 cases (23%)
Passwords: 5,002 cases (23%)
Address and date of birth: 11%
ID photos/selfies: 10% each
Credit card numbers: 8%
One-time authentication codes/PINs: 5%
Cryptocurrency wallet recovery phrases: 2%

Dangerous Multi-Data Combinations:

National ID + photo/selfie (1,543 cases) → Enable online identity verification fraud
Password + one-time authentication code (263 cases) → Instant login to two-factor authenticated accounts
Password + card/bank details (643 cases) → Immediate fund theft

Targets and Attack Patterns by Industry

Fraud Distribution by Sector:

Financial services: 26% (banks 9.9%, payment/fintech 9.0%, crypto 4.1%, investment 3.1%)
Gaming/betting: 24%
Consumer services: 22%
Government/public sector: 21%

Top Impersonated Organizations:

South African Social Security Agency (SASSA): 618 cases
Garena Free Fire (game): 537 cases
Facebook: 354 cases
Vinted (marketplace): 341 cases
PayPal: 183 cases

Industry-Specific Tactics:

Gaming fraud: Offer free diamonds, skins, or coins in exchange for login credentials; users may have connected Facebook/Google accounts
University fraud: Request student email passwords under guise of financial aid
DHL fraud: Request small re-shipping fees for card details (74% of DHL impersonations); 70% of accounts registered in Italy
Crypto fraud: Impersonate customer support, request 12-word recovery phrases (holders can control all funds and transactions cannot be reversed)
Rental fraud: Request deposits/fees before property viewings; claim fees will be refunded

Red Flags and Evasion Tactics

Nine deception methods found in actual fraudulent forms:

Trust building and urgency: Official imagery, high ratings, countdown timers
Terminology disguise: Replace "password" with asterisks, abbreviations, or altered spelling
Hidden requests: Embed questions in images or instruction text within input fields
Contradictory messaging: Display "legal, encrypted information" while requesting card number and expiration date
Distributed long forms: Scatter seemingly innocent questions across lengthy applications
Semantic manipulation: Call one-time codes "chat codes" or claim sharing PINs "protects your account"
False promises: Claim rental fees will be refunded
Multi-stage fraud: Forms lacking payment functions may direct users to separate money transfer services
Obfuscation of intent: Collect personal data without visible payment mechanisms

How to Spot Fraudulent Forms

Forms accessed through unfamiliar or suspicious links
URL, post-submission destination, and referring message links don't align
Password fields appearing in forms or surveys rather than official sites/apps
Requests for one-time authentication codes or PINs
Demands for cryptocurrency wallet recovery phrases
Unrealistic offers (free items, suspiciously low rent, easy loans)
Questions distributed across multiple fields that collectively reveal identity information

Prevention Strategies

Core Rules:

Verify suspicious requests through official websites, apps, or phone numbers—never use links in forms
Enter passwords only on official service websites/apps; never in surveys, sweepstakes, or external forms
Never share one-time authentication codes or PINs with anyone
Never provide cryptocurrency recovery phrases to anyone, including support staff (recovery phrases grant full fund control)

When Reviewing Forms:

Check form URL, message links, and post-submission destination for consistency
Consider what information is revealed when all answers are combined
Watch for passwords obscured with symbols or altered spelling
Verify questions aren't hidden within images

If Suspicious: Report the form to the platform for review. forms.app accepts reports via its abuse reporting form and customer support email, which are reviewed by trust and safety teams.