TL;DR: Account takeover fraud unfolds across identity, device, behavior, and transaction signals long before money moves, according to Feedzai, which cites a European bank case with seven blocked attempts in 27 minutes and zero losses. Transaction-only monitoring misses the journey-level evidence that separates legitimate change from takeover.
At a glance
What this is: This is an analysis of why account takeover fraud must be detected as a session-long progression, not a single payment event.
Why it matters: It matters because IAM and fraud teams need shared identity, device, and behavioral context to stop compromised sessions before transaction controls become the first and only line of defence.
By the numbers:
- The FBI recorded approximately 4,700 account takeover complaints in 2025, resulting in over $359.7 million in reported losses.
- A European retail bank blocked seven account takeover attempts in less than 30 minutes.
Context
Account takeover fraud is a sequence of changes across a customer session, not a single bad payment. Identity signals, device changes, network context, and behavior all shift before cash-out, which means transaction controls alone see the outcome too late.
For IAM and fraud practitioners, the real governance gap is segmentation: authentication, device trust, behavioral analytics, and payment risk are often treated as separate decisions. The article shows that the control boundary has to move upstream into the full digital banking journey.
Key questions
Q: How should financial institutions reduce account takeover risk in online payment channels?
A: Financial institutions should combine stronger authentication, real time monitoring, and user education. MFA reduces the value of stolen credentials, while transaction alerts help catch unusual activity before losses spread. Teams should also watch for phishing, spoofed messages, and credential reuse across breached accounts. The best results come from layering controls so one failed check does not become a complete account compromise.
Q: Why do legitimate login credentials still leave banks exposed to account takeover fraud?
A: Because successful authentication only proves the right credential was presented. It does not prove the same customer is still operating the account once the device, IP address, payee history, or interaction pattern begins to change.
Q: What are the signs that a customer session may be under takeover?
A: Common indicators include unusual typing or interaction patterns, device changes, bot-like behaviour, and high-risk account actions that do not match the user’s normal profile. CIAM programmes should treat those signals as triggers for additional verification or containment, not as standalone alerts.
Q: Should fraud teams separate identity verification from transaction monitoring?
A: No, not when the same actor can manipulate both identity evidence and payment behaviour in one flow. The stronger pattern is to evaluate identity proofing, device trust, behavioural risk, and payment context together so the decision reflects the full exposure, not just one checkpoint.
Technical breakdown
Why transaction-only fraud detection misses account takeover
Transaction-only monitoring inspects the payment at the end of the attack path, after the account has already been used, probed, or repurposed. Account takeover often starts with legitimate credentials, then adds a new device, a changed network location, and subtle behavioral drift. Each signal can look normal in isolation. The technical failure is not the absence of controls, but the absence of correlation across the session. Fraud models that do not ingest identity, device, and behavioral context cannot distinguish a true customer from a takeover using the same account surface.
Practical implication: move risk scoring earlier in the session and correlate identity, device, and behavior before authorising payment.
How device and network context strengthen identity risk
Device and network intelligence add continuity to an otherwise fragmented trust model. A previously unseen IP address, device switch, or new beneficiary can be harmless on its own, but together they form a sequence that changes the confidence in the session. In digital banking, the important question is not whether the account authenticated, but whether the current session still resembles the legitimate customer’s historical pattern. When those signals feed the payment decision in real time, the organisation can distinguish account familiarity from account control.
Practical implication: enrich authentication and payment decisions with device reputation, IP history, and payee-history context.
Why behavioral drift is the strongest session-level signal
Behavioral drift is the gradual divergence between normal customer interaction and attacker activity. The article’s example shows transfer size changes, repeated beneficiary changes, paste detection, and suspicious session movement, all of which can build a stronger risk picture than any single event. This matters because attackers often adjust tactics when initial transfers are blocked. The model has to notice the change in pattern, not only the final amount. That is what turns fraud analytics from static checks into session-based detection.
Practical implication: monitor behavioral sequence changes, not only individual anomalies, and feed them into real-time fraud decisions.
Threat narrative
Attacker objective: The attacker’s objective is to cash out through repeated fraudulent transfers while staying inside a trusted-looking customer session.
- Entry begins when compromised credentials are used in a normal-looking customer session, giving the attacker legitimate account access rather than a noisy intrusion event.
- Credential abuse becomes visible as a new device, previously unseen IP address, and new beneficiary appear in quick succession, changing the session trust profile.
- Escalation occurs as the attacker repeats transfer attempts, changes beneficiaries, and reduces the amount to test which transactions will pass.
- Impact is attempted cash-out through multiple transfers, but the bank declines later payments and prevents losses.
Breaches seen in the wild
- Gitloker GitHub extortion campaign: Phishing via GitHub notifications tricked developers into authorising malicious OAuth apps; Gitloker then wiped repos and demanded contact.
- 23andMe credential stuffing 2023: Credential stuffing into 18,000 accounts exposed nearly 7 million people through the DNA Relatives feature.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Account takeover is a session problem, not a payment problem: Fraud teams that only evaluate the transfer event are inspecting the last symptom of a longer compromise path. Identity, device, and behavior all shift before money moves, so transaction-only controls are structurally late. The practitioner conclusion is that ATO governance has to start at session risk, not cash-out risk.
Journey correlation is the missing control plane: The real weakness is not the lack of login checks, but the absence of a control plane that links authentication, device trust, behavioral evidence, and beneficiary history. Each signal is weak by itself and decisive in sequence. The practitioner conclusion is that fraud operations need cross-signal correlation rather than isolated point checks.
Continuous trust is the governance model banks now need: Successful authentication proves a credential was presented, not that the customer still controls the session. That is an identity governance problem because the trust decision has to evolve as the journey evolves. The practitioner conclusion is that identity assurance in digital banking must be continuously re-evaluated, not assumed after login.
Session drift should be treated as a named concept: identity-to-transaction gap: This gap is the distance between a customer being authenticated and the bank still knowing who is operating the account when money is moved. It widens when device, behavior, and payee context are not carried into the payment decision. The practitioner conclusion is to close that gap before fraud teams rely on the transaction as the first meaningful control.
Fraud and IAM programmes are converging on the same trust problem: Banks already authenticate users, but ATO shows that authentication alone does not preserve identity integrity across the session. That makes fraud prevention and IAM shared governance domains, not separate ones. The practitioner conclusion is to align identity signals with fraud decisioning so the organisation can preserve trust across the full digital journey.
From our research library:
- U.S. fraud losses are projected to reach $40 billion by 2027.
What this signals
Identity-to-transaction gap: The most important control gap in account takeover is the distance between a trusted login and an untrusted payment decision. Banks that do not carry identity, device, and behavior context forward leave fraud teams reacting at the end of the attack path.
Fraud programmes should be designed to see sequence, not just anomaly. A new device, a first-time beneficiary, and a change in transfer behavior are each weak signals on their own, but together they create the session-level picture that determines whether the account is still under legitimate control.
For practitioners
- Correlate session signals before payment approval Feed device history, IP reputation, beneficiary novelty, and behavioral drift into the same risk decision instead of scoring the transfer in isolation.
- Treat beneficiary change as a risk transition Flag first-time payees and beneficiary switches as session changes that require added scrutiny, especially when paired with a new device or unseen IP.
- Use authentication as an input, not the decision Keep login success in the model, but require downstream signals to confirm that the customer session still matches expected behavior.
- Build step-up triggers from sequence patterns Trigger additional verification when small anomalies stack up across the session, such as new device, changed amount, and repeated transfer attempts.
- Align fraud and identity telemetry Unify IAM and fraud operations so analysts can trace whether the same identity, device, and behavioral profile persists from login through transfer.
Key takeaways
- Account takeover becomes harder to stop when institutions inspect only the transaction and ignore the preceding session changes.
- The article’s bank example shows that seven blocked attempts, two new beneficiaries, one new device, and one unseen IP can all appear inside a 27-minute attack window.
- Fraud prevention improves when IAM and payment risk share the same session context instead of operating as disconnected controls.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-63 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | TA0006; TA0008 — Credential Access; Lateral Movement | The article centers on credentialed session abuse and movement across payment attempts. |
| Recommendation — Map account takeover telemetry to credential access and lateral movement patterns in your detection pipeline. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The case depends on validating whether the active session still matches the authorized user. |
| Recommendation — Use PR.AA-05 to align access decisions with session risk and evolving entitlements. | ||
| NIST SP 800-63 | SP 800-63B — Authentication | The article shows authentication is necessary but insufficient without continuous session validation. |
| Recommendation — Apply SP 800-63B to strengthen authentication, then extend trust checks beyond login. | ||
| CIS Controls v8 | CIS-5 — Account Management | Account and session governance are central to preventing takeover-driven abuse. |
| Recommendation — Use CIS-5 to govern account lifecycle, session trust, and high-risk access paths. | ||
Key terms
- Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
- Session risk: The changing level of trust assigned to an active login or token after it has been issued. Session risk reflects device state, application context, privilege depth, and behavior, so a session that began legitimately can become unsafe before it ends.
- Behavioural Drift: Behavioural drift is the gradual change in what an identity does compared with what it was originally approved to do. For AI agents, drift can come from prompt changes, model updates, expanded integrations, or altered workflows, which makes access review alone an incomplete control.
- Transaction Risk: Transaction risk is the likelihood that a payment, deposit, withdrawal, or transfer is abusive, compromised, or inconsistent with normal behaviour. It is distinct from login risk because a legitimate session can still produce fraudulent or non-compliant financial activity.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.
Published by the NHIMG editorial team on October 16, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org