Account fraud controls need device and behavior intelligence

At a glance

What this is: This is a product-focused analysis of how Descope’s Darwinium connector adds device and behavioral intelligence to fraud controls for authentication and user journeys.

Why it matters: It matters because IAM and fraud teams need controls that distinguish trusted users from attackers who reuse valid credentials, spoof devices, or automate at scale.

By the numbers:

• account takeover cases jumped 76% in 2024, with telecom and online retail platforms hit the hardest

Context

Account fraud is not only an authentication problem. It is a trust problem that spans signup, login, device posture, behavior, and the patterns that emerge across multiple sessions or accounts.

Descope’s article argues that standard login checks can be too narrow when attackers use stolen credentials, proxy networks, emulators, or human assistance to appear legitimate. The identity governance question is how to add fraud signals without turning every journey into a high-friction checkpoint.

Key questions

Q: How should IAM teams detect account fraud without creating too much login friction?

A: Use device integrity, behavioral analysis, and account correlation together so the system can challenge only the sessions that look inconsistent with trusted use. The goal is not universal friction. It is to move risk decisions into the journey so legitimate users pass quickly while spoofed devices, scripted sign-ins, and reused fraud infrastructure are stopped early.

Q: Why do valid credentials still fail to prove legitimate identity in fraud cases?

A: Because attackers can combine stolen credentials with proxy networks, emulators, and behavior that mimics normal users. A successful login proves that the secret worked, not that the actor is trusted. IAM programmes need additional context from the device and the session to tell legitimate access from account abuse.

Q: What are the signs that account takeover controls are being misapplied rather than actually stopping fraud?

A: A common sign is when suspicious logins are detected too late, after funds movement, profile changes, or account recovery abuse has already occurred. Another warning sign is a high number of false approvals from automated checks that do not distinguish normal users from attackers. Effective controls should block risky activity early while keeping legitimate users moving smoothly.

Q: How should teams combine adaptive authentication with fraud detection?

A: Use fraud scores to drive allow, challenge, or block decisions in the same flow that handles authentication. Adaptive authentication works best when it is informed by device and behavioral intelligence, because the control can react to changing attacker methods instead of relying on one static rule for every user.

Technical breakdown

Behavioral risk scoring in authentication flows

Behavioral risk scoring evaluates how a user interacts with the application during signup or login, then compares that pattern to known legitimate or suspicious activity. In this article’s model, the key signals include typing speed, browser behavior, interaction anomalies, scripted journey execution, proxy usage, and low-and-slow velocity patterns. The point is not to replace authentication, but to add context that reveals when a valid credential is being used in an invalid way. That distinction matters because credential stuffing, account takeover, and synthetic identity abuse often succeed precisely because the login details themselves look normal.

Practical implication: feed behavioral telemetry into authentication decisions wherever account abuse risk is highest.

Device profiling and repeat fraud infrastructure

Device profiling looks beyond the session to identify whether the browser or environment itself is trustworthy. Here that includes spoofed or compromised browsers, headless automation frameworks, emulators, virtualized infrastructure, tampered clients, and repeated device fingerprints across accounts or sessions. Durable device intelligence matters because fraud operators can rotate IP addresses and distribute activity over time while still reusing the same underlying infrastructure. That makes device identity a separate control plane from user identity: a valid user account does not automatically imply a trusted device, and a trusted device history can be as important as the credential being presented.

Practical implication: correlate device reuse and environment integrity with account-level authentication events before allowing high-risk journeys.

Adaptive authentication at the point of decision

Adaptive authentication uses risk signals to decide whether a user should be allowed through, challenged for more verification, or blocked. In the connector flow described here, Descope sends login or registration details to Darwinium, receives a risk score, and then applies business logic to the journey in real time. That architecture matters because it places fraud detection inside the decision path rather than after the fact. The result is a more granular control model, where step-up MFA, identity verification, and block decisions are triggered by observed risk instead of a fixed rule applied to every user equally.

Practical implication: wire risk scoring into decision points so authentication can respond to changing fraud methods.

Threat narrative

Attacker objective: The attacker wants to pass as a legitimate user long enough to take over accounts, create fraudulent accounts, and monetize the journey through abuse or transaction fraud.

1. Entry begins when attackers submit stolen credentials, automated signups, or scripted login attempts through proxy networks and spoofed environments.
2. Credential access is sustained by legitimate-looking sessions, reused devices, and account correlation that let the attacker blend into normal traffic.
3. Escalation occurs when the same fraud tooling is used across accounts, promotions, or transactions to amplify abuse while avoiding simple IP-based detection.
4. Impact is unauthorized access, fake account creation, credential stuffing success, and ongoing fraud at scale across the customer journey.

Breaches seen in the wild

• Moltbook AI agent keys breach: Moltbook breach exposed 1.5M AI agent keys.
• DeepSeek database exposure 2025: An unauthenticated DeepSeek ClickHouse database exposed over a million log lines with plaintext chat history and API keys in 2025.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Account fraud is now a trust-layer problem, not just an authentication problem: traditional login checks answer whether credentials are valid, but they do not reliably answer whether the session is legitimate. Device signals, behavioral analysis, and account linkage are increasingly the controls that separate identity proof from fraud intent. For IAM teams, the practical conclusion is that authentication policy alone is too shallow for modern account abuse.

Device intelligence creates a distinct control plane for fraud operations: repeated device fingerprints, emulator use, headless browsers, and client tampering are infrastructure signals, not just user signals. When attackers can rotate IP addresses and still reuse the same fraud substrate, the risk model has to follow the device and not just the user account. Practitioners should treat device profiling as a core identity trust input, not an optional add-on.

Adaptive authentication is where fraud and IAM governance meet: the strongest pattern in this article is not a standalone detector, but a decisioning flow that can allow, challenge, or block based on live risk. That changes the governance burden from static policy enforcement to calibrated journey control. Teams that still rely on fixed authentication steps are leaving the decision point too late in the path.

Behavioral and device signals close the gap between valid credentials and valid intent: the article’s core lesson is that an attacker can present correct secrets and still be the wrong actor. That is the governance gap fraud programmes must now name explicitly: valid authentication artefacts do not guarantee trusted use. The implication is to move trust decisions closer to issuance and journey execution, where fraud actually manifests.

Credential trust debt is accumulating across customer journeys: account takeover, synthetic accounts, and distributed automation all exploit the assumption that successful login equals legitimate identity. That assumption no longer holds when attackers can borrow legitimacy through stolen data, proxies, and device spoofing. The practical conclusion is that identity programmes must account for trust decay across the full lifecycle, not just at first authentication.

From our research library:

• AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
• Read next: AI Agent Observability, Audit and Incident Response Guide

What this signals

Device and behavioral signals are becoming part of the identity decision stack: when attackers can make a login look valid, the programme has to decide whether the device and the journey are valid. That shifts account fraud control from authentication alone to contextual trust evaluation across the session.

Account takeover and synthetic account abuse should be treated as lifecycle problems: signup, login, step-up verification, and transaction approval are all decision points where fraud can surface. Organisations that only harden login will miss the broader abuse pattern that spans the whole customer journey.

For practitioners

• Embed device profiling in login and signup flows Send device integrity and browser signals into authentication so the journey can distinguish trusted devices from spoofed, emulated, or tampered environments.
• Use behavioral risk scoring at high-risk decision points Evaluate typing patterns, velocity, proxy use, and scripted interactions before allowing access to accounts, promotions, or valuable transactions.
• Correlate device reuse across accounts Look for repeated fingerprints, cross-account device correlation, and shared fraud tooling that indicate organised abuse rather than isolated user events.
• Trigger step-up controls from live risk Route suspicious journeys to step-up MFA, identity verification, or blocking based on risk score rather than on a fixed login rule.

Key takeaways

• Account fraud now succeeds by looking legitimate at the device and behavior layers, even when credentials are stolen or synthetic accounts are created.
• The article cites a 76% jump in account takeover cases in 2024, reinforcing that fraud tooling is scaling faster than traditional authentication can respond.
• Risk-based decisioning that combines device profiling, behavioral telemetry, and step-up controls is the control pattern most likely to reduce abuse without blanket friction.

Key terms

• Behavioural Risk Scoring: Behavioural risk scoring is the process of combining multiple runtime signals into a single assessment of suspiciousness. The score is not a verdict on identity by itself, but a structured way to turn interaction patterns, device consistency, and environment checks into actionable fraud decisions.
• Device Profiling: Device profiling is the creation of a persistent identity for the browser or endpoint used in a session. It helps teams recognize spoofing, emulation, reuse, and tampering across logins or registrations, even when the attacker changes credentials or IP address.
• Adaptive Authentication: Adaptive authentication changes the strength of login checks based on context such as device, location, source network, and session history. It helps IAM teams respond to suspicious access without forcing every user through the same high-friction path.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.