Account takeover is now the key fraud attack surface in 2025

At a glance

What this is: Sift’s analysis shows payment fraud rates staying relatively steady in 2025 even as account takeover became the more consequential fraud entry point.

Why it matters: Fraud and identity teams need to treat login security, account recovery, and downstream transaction controls as one chain, because the earliest compromise now shapes the rest of the fraud path.

Context

Account takeover is a governance problem because it turns a legitimate customer identity into a fraud conduit. When attackers control the account layer, they can use saved payment methods, loyalty balances, and trusted-session behaviour to bypass controls that are tuned mainly for checkout-stage fraud.

Sift’s data suggests that improving transaction monitoring alone is not enough when the intrusion happens before payment. For identity, fraud, and trust teams, the relevant question is how much assurance exists at login, recovery, and step-up verification, not just at authorisation time.

Key questions

Q: What breaks when account takeover is not controlled before payment activity starts?

A: Payment controls lose much of their value because the attacker is no longer arriving as an obvious outsider. A compromised account carries trust, history, and stored payment methods, which makes fraudulent activity look legitimate enough to pass simple checkout checks. Teams need to stop abuse at login, recovery, and session establishment, not only at payment authorisation.

Q: Why does stronger account authentication reduce fraud losses?

A: Stronger authentication reduces fraud because it blocks or slows the attacker before they inherit a trusted customer context. That matters when stored value, loyalty balances, or saved payment methods are accessible inside the account. If the account never becomes compromised, downstream fraud controls face far less ambiguity and far fewer trusted-session attacks.

Q: What do finance teams get wrong about fraud monitoring?

A: They often rely too heavily on reconciliation and post-payment review, which means the money has already moved before anomalies are challenged. Effective monitoring needs control points inside the workflow, where exceptions can be blocked or escalated in real time. Otherwise, policy becomes documentation instead of enforcement.

Q: What is the difference between card testing and account takeover fraud in e-commerce?

A: Card testing is when fraudsters probe stolen payment card details with small transactions to confirm the card is active. Account takeover fraud is when an attacker gains access to a customer account and uses stored payment methods or pre-approved credit. Both enable fraudulent purchases, but the first validates payment data while the second hijacks an existing account.

Technical breakdown

Why account takeover changes the fraud control boundary

Account takeover shifts the attack surface from payment events to identity events. A trusted account carries prior authentication context, stored payment credentials, and behavioural history, so fraud signals that work well against unknown devices become less reliable. That creates a control boundary problem: the moment an attacker crosses into the account, downstream fraud detection must separate legitimate customer activity from attacker-driven activity using weaker signals than before.

Practical implication: Treat account authentication, recovery, and device assurance as the primary fraud controls, not just the payment gateway.

Why login protection and step-up verification matter more than checkout checks

The article shows that consumers are willing to accept more verification, but adoption of stronger authentication remains low. That gap matters because 2FA and step-up checks are most effective when they interrupt takeover before the account becomes a trusted fraud channel. Once the session is established, checkout controls face a user context that looks normal, even when the underlying actor is malicious.

Practical implication: Shift friction earlier in the journey and apply step-up verification to risky login, recovery, and device-change events.

How trusted accounts hide fraud that card checks can miss

Fraud from a compromised account is harder to distinguish from genuine customer behaviour because the transaction originates inside an already authorised relationship. That is why account-linked fraud in rewards, financing, wallets, and subscriptions can outpace card-based detection. The mechanism is not just stolen payment data, but legitimate account privileges repurposed by an attacker to move value in a way that resembles normal activity.

Practical implication: Correlate login, recovery, and transaction telemetry so account compromise is visible before value moves.

Threat narrative

Attacker objective: The attacker seeks to turn a compromised customer account into a trusted channel for payment fraud, rewards theft, and other monetisable abuse.

1. Entry occurs through account compromise rather than direct checkout abuse, giving the attacker access to a trusted identity and its stored value.
2. Credential access and session reuse let the attacker operate as the customer, often without triggering the same alarms as an external card-not-present attempt.
3. Impact follows when stored payment methods, loyalty balances, or subscriptions are abused for fraudulent transactions that appear legitimate to downstream controls.

Breaches seen in the wild

• Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Account takeover is now the more important fraud governance problem because it converts identity trust into payment abuse. The article’s central signal is not that payment fraud disappeared, but that the attack surface moved earlier in the journey. Once an account is compromised, the attacker inherits behavioural trust, stored value, and a legitimate session context, which makes downstream fraud harder to distinguish and harder to stop.

Authentication is functioning as fraud infrastructure, not just access control. That matters to identity teams because login assurance now directly affects financial loss containment. A weak account recovery path or low-friction login flow does not merely increase account risk; it expands the set of transactions that can be presented as normal customer activity.

Fraud teams need a named concept for this shift: the trusted-account abuse window. That window begins when the attacker first gets into the account and ends only when session trust, payment authority, and recovery access are all removed. The longer that window stays open, the more the organisation is forced to detect fraud from inside a trusted relationship rather than at the edge.

Consumer willingness to verify creates an underused control opportunity. The article shows that users are more open to stronger security than many teams assume, which weakens the argument that stronger account controls necessarily damage conversion. Practitioners should treat login assurance, recovery friction, and behavioural risk scoring as part of the fraud operating model, not as optional UX trade-offs.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

Fraud and identity teams should stop treating checkout as the main battleground. When attackers control the account, the real decision point is whether login assurance, recovery controls, and step-up verification can interrupt abuse before stored value is exposed.

Trusted-account abuse window: this is the period between initial account compromise and removal of session trust, when an attacker can act as a legitimate user. The shorter that window, the less chance fraud has to move from identity access into financial loss.

The practical takeaway is to align fraud controls with identity signals, not just transaction signals. Organisations that connect authentication events, device change events, and payment telemetry will detect account-based fraud earlier and with fewer false assumptions.

For practitioners

• Instrument account takeover and payment fraud together Track login anomalies, recovery events, device changes, and downstream purchase behaviour in a single fraud view so compromise is visible before monetisation.
• Increase step-up checks on risky account events Require additional verification for new devices, password resets, profile edits, payout changes, and high-risk logins rather than waiting for checkout controls.
• Review account recovery as a fraud control Audit password reset, email change, and SIM-swap-adjacent recovery paths for weaknesses that let attackers seize a trusted account without raising a transaction alert.
• Tighten risk scoring on stored-value products Apply stricter thresholds to rewards, wallets, financing, subscriptions, and other products where compromise can quickly convert account access into financial loss.

Key takeaways

• Account takeover has become the key fraud surface because it lets attackers operate from inside a trusted customer relationship rather than from an obvious external payment event.
• The evidence points to a control gap at login and recovery, where weak assurance can translate into downstream loss even when checkout monitoring looks stable.
• Fraud resilience now depends on tying identity assurance to transaction monitoring, so compromise is disrupted before stored value and payment authority are abused.

Key terms

• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Step-Up Verification: Step-up verification is a stronger identity check applied when risk increases, such as during password reset, device change, or privileged access request. It uses higher-assurance signals than a static question, such as device possession, authenticated context, or approved administrative review.
• Trusted Session: A trusted session is an authenticated access period that systems continue to regard as legitimate until it expires or is revoked. For human users, service accounts, and AI-driven workflows alike, a trusted session can become the vehicle for abuse if behaviour is not continuously evaluated.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.