Salt Lake City – – September 13, 2026 -- Netcraft now provides digital risk protection to seven of the top 12 U.S. financial institutions after five additional banks selected the firm in 2026, the cybercrime detection company announced. The company also serves nine of the world's top 15 banks.
Netcraft surpasses 4.1 million takedowns for 2026, exceeding its full 2025 total
Netcraft passed 4.1 million takedowns for the year in early September 2026, a figure that already eclipses its entire 2025 output. The company attributes the surge to accelerating new customer growth, rising volumes of AI-driven attacks, and expanded coverage through Preemptive Domain Disruption, Phone Scam Disruption, and enhanced social media protection.
Banks cite automation across phishing, social, phone and ad channels as the deciding factor
A vice president for brand protection at a leading U.S. financial institution said Netcraft caught threats that prior coverage missed and removed them quickly, with automation spanning social media, phishing, phone numbers, and malicious ads saving the security team many hours weekly.
CEO Ryan Woodley links bank wins to a broader shift against criminal infrastructure economics
"Earning the trust of five more of the U.S.'s largest banks represents another critical moment in the growth and evolution of Netcraft," said Ryan Woodley, CEO of Netcraft. "Surpassing 4.1 million takedowns also shows the scale and scope of the impact we have on the global threat ecosystem."
Netcraft targets the ROI calculation behind phishing-as-a-service operations
Criminals are using automation, generative AI, and mature phishing-as-a-service tooling to produce more convincing attacks across more channels, according to the company. Netcraft argues that detection alone does not change the economics for attackers, while rapid, repeated removal of infrastructure raises the cost of each campaign and shortens the window during which criminal returns accumulate.
Financial institutions face abuse across a fragmented surface that includes phishing sites, lookalike domains, social media impersonation, malicious ads, mobile apps, messaging platforms, phone numbers, and scam infrastructure on the deep and dark web.