Account takeover fraud is outpacing password-based identity controls

At a glance

What this is: This blog explains why account takeover fraud is accelerating in digital marketplaces and why password-based login controls are no longer enough to stop it.

Why it matters: IAM and fraud teams need to shift from point-in-time authentication to continuous identity proofing and risk scoring across the full customer journey.

Context

Account takeover fraud is a customer identity problem, not just a login problem. In digital marketplaces, stolen credentials can let an attacker appear legitimate long enough to place orders, abuse refunds, or drain balances before the platform detects the abuse.

The article’s core governance gap is that passwords and MFA establish access at the front door, but they do not continuously confirm that the person taking high-risk actions is still the rightful account owner. That makes continuous identity verification a control problem for CIAM, fraud operations, and revenue protection at the same time.

Key questions

Q: How should fintech teams reduce account takeover risk when passwords are the main attack path?

A: Fintech teams should reduce dependence on passwords by combining phishing resistant authentication with strong identity proofing, least privilege access, and tighter third-party oversight. Passwordless login alone is not enough if the organisation cannot verify who is enrolling or authenticating. The stronger model is identity based access, where proof of personhood, device trust, and transaction context are checked before access is granted.

Q: Why do marketplaces face higher account takeover risk than many other digital businesses?

A: Marketplaces hold stored payment methods, transaction histories, balances, and customer trust in one account record. That makes each compromised account more valuable and easier to monetise through refunds, chargebacks, or fraudulent orders. The more legitimate history an account has, the better it can hide malicious activity.

Q: What are the signs that account takeover controls are failing in a marketplace?

A: Watch for refund abuse, sudden changes in device or session patterns, repeated account control changes, and chargeback spikes that do not match normal customer behaviour. Those signals often mean the account is still passing login checks but no longer belongs to the person operating it.

Q: What should security and fraud teams do after a marketplace account is compromised?

A: They should contain the abuse path first by revoking active sessions, freezing high-risk transaction paths, and reviewing linked payment and payout settings. The response should focus on stopping monetisation, not just forcing a password reset, because the attacker may already have extracted value.

Technical breakdown

Why password-based account ownership breaks down

Passwords and MFA are authentication controls, not strong proofs of ongoing account ownership. Once credentials are stolen, purchased, or reused, the platform often sees a valid session and a familiar account history, which makes the abuse blend into normal user behaviour. In marketplace environments, the attacker does not need to defeat the login step again to cause damage. They only need to operate inside an account that already looks trusted. That is why account takeover is effective even when basic access controls are in place.

Practical implication: treat initial login success as insufficient evidence for high-risk marketplace actions.

How continuous identity verification changes the control model

Continuous identity verification extends decisioning beyond the login event. It combines device intelligence, possession signals, behavioural context, and transaction risk so the platform can reassess identity when the user changes account details, initiates payments, or requests refunds. This is not the same as adding more friction at every step. The point is to distinguish the legitimate customer from an impostor at moments where value can be extracted, while preserving a low-friction path when the signals remain consistent.

Practical implication: place stronger checks around account changes, payouts, and refunds rather than relying on front-end authentication alone.

Why marketplaces are unusually exposed to ATO abuse

Marketplaces concentrate stored payment methods, account balances, and repeated customer relationships in one place, which gives an attacker both monetisation paths and camouflage. A compromised account can be used to place fraudulent orders, trigger chargebacks, and hide behind a history of legitimate activity. That combination makes marketplaces more attractive than generic consumer apps because the attacker can convert access into direct financial loss quickly. The governance challenge is that the account may still look healthy long after it has stopped being controlled by the real user.

Practical implication: align fraud controls to the value-bearing actions inside the account, not only to access events.

Threat narrative

Attacker objective: The attacker wants to turn a trusted marketplace account into a monetisation channel for fraud, refund abuse, and chargeback-driven loss.

1. Entry begins when a fraudster steals, buys, or otherwise obtains valid account credentials from a legitimate user.
2. Escalation occurs when the attacker uses the trusted session to place fraudulent orders, abuse refunds, or initiate transactions that look routine.
3. Impact follows through chargebacks, direct financial theft, operational dispute handling, and customer loss when the abuse is discovered late.

Breaches seen in the wild

• 23andMe credential stuffing 2023: Credential stuffing into 18,000 accounts exposed nearly 7 million people through the DNA Relatives feature.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Account takeover is now a continuous identity assurance problem, not a login problem. The article’s pattern is clear: credential theft creates access, but the business loss happens later when the attacker behaves like a legitimate customer inside the account. That changes the control objective from authenticating entry to validating ownership at the moments that can produce fraud. For marketplaces, the practitioner conclusion is that identity assurance must follow the transaction path, not stop at sign-in.

Marketplace identity risk is amplified by stored value and behavioural camouflage. Digital marketplaces give attackers a place to hide because legitimate history, saved payment methods, and recurring transactions make abuse harder to separate from normal usage. That is why a valid account can become a fraud engine without triggering obvious access anomalies. The implication is that fraud and IAM teams cannot work as separate lanes when the same account is used to authorise value-bearing actions.

Continuous identity verification is a governance model, not a product feature. The important shift is operational ownership across login, account maintenance, and high-risk commerce events. Device signals, possession checks, and behavioural context only matter if they are tied to decision points that can block or step up risk in real time. Practitioners should therefore treat continuous verification as part of customer identity governance, not as an add-on to authentication.

Identity proofing at issuance time is not enough when account control can drift after login. The platform may have been satisfied that a person was real at onboarding, but the attacker only needs to become the active operator later. That means the control assumption is temporal, not just technical: identity can be valid at one moment and compromised at the next. The practitioner conclusion is to govern account ownership as an ongoing state, especially where value can be extracted quickly.

What this signals

Continuous identity proofing is becoming the practical control boundary for marketplace fraud. Once an account can be used as a trusted shell for refunds, payouts, and orders, the real question is no longer whether the user passed login. It is whether the platform can still distinguish the rightful account owner from an impostor at the moment value moves.

Identity and fraud programmes need a shared decision layer. Marketplace abuse sits between CIAM, fraud operations, and revenue protection, so silos create blind spots. A control that works at onboarding but fails during transaction execution is not a complete control, and practitioners should measure trust at each value-bearing step.

For practitioners

• Map high-risk marketplace actions Identify the account events that create direct loss, such as refunds, payout changes, address updates, and balance transfers, then require step-up verification at those points.
• Add multi-signal decisioning to fraud flows Combine device reputation, possession signals, behavioural context, and historical session patterns before approving transactions that move money or change account control.
• Separate login assurance from transaction assurance Treat successful authentication as one input, not the final decision, and create distinct risk thresholds for sign-in, account changes, and commerce events.
• Tune chargeback and refund controls to account history Flag refund abuse when a trusted account suddenly changes device, velocity, or payout behaviour, even if the login itself looks normal.

Key takeaways

• Account takeover in marketplaces is dangerous because a valid session can still belong to the wrong person, so login controls alone do not stop fraud.
• The article shows that attackers can turn trusted accounts into refund, payout, and chargeback channels, which makes the downstream business loss larger than the initial compromise.
• Practitioners should move identity decisions to the transaction layer and use multiple signals to confirm ownership whenever account value can be extracted.

Key terms

• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Continuous identity validation: A governance model that checks identity trust throughout execution rather than only at login or periodic review. For AI and machine identities, this means verifying access, scope, and behaviour in real time so actions can be constrained while they are happening.
• Chargeback: Chargeback is the allocation of technology costs back to the business unit, product, or service that incurred them. For AI workloads, it becomes a governance control when pricing and attribution are reliable enough that cost responsibility can influence design, usage, and prioritisation.
• Multi-Signal Authentication: Multi-signal authentication uses several independent signals to judge trust instead of relying on a password alone. For customer identity programmes, those signals can include device context, behavioural patterns, and possession evidence, which helps distinguish a legitimate user from an impostor after credentials are compromised.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.