AI-based fraud is reshaping holiday checkout trust

At a glance

What this is: This report summarises consumer survey findings on holiday checkout trust, showing that AI-based fraud concern is high but fast, low-friction onboarding still drives account signup.

Why it matters: It matters because identity teams supporting ecommerce, loyalty, and fraud controls have to reduce fraud without adding so much friction that they suppress conversion and account creation.

By the numbers:

• 84% of consumers said they're concerned about AI-based fraud attacks this holiday season.
• 81% of consumers said they are worried about fraud while shopping online this holiday season.
• 79% of consumers said they would sign up for a brand's loyalty account instead of guest checkout if the process took 30 seconds or less.
• 85% said they rely on their mobile phones to access their accounts.

Context

Holiday checkout is a trust problem as much as a fraud problem. Consumers are balancing speed, convenience, and confidence while retailers try to stop account abuse, fake signups, and AI-assisted deception without breaking the buying journey.

The report centers on identity verification and onboarding as the operational controls that shape that balance. For ecommerce and loyalty programmes, the question is not whether friction exists, but whether it is placed where it protects risk without killing conversion.

Key questions

Q: How should retailers reduce fraud without making checkout too slow?

A: Use progressive verification. Keep low-risk browsing and sign-up flows fast, then increase assurance only when users request account recovery, payment enrolment, or other high-value actions. That approach preserves conversion while still creating a real control point where fraud risk is highest. Measure both fraud loss and abandonment so you can see whether the balance is working.

Q: Why do consumers still abandon account creation even when they worry about fraud?

A: Because users usually experience the friction immediately and the fraud risk abstractly. If signup feels slow, they default to guest checkout even when they understand the threat. Identity teams need to reduce visible effort while preserving enough assurance to prevent low-quality registrations and abuse.

Q: What are the signs that onboarding controls are too weak or too heavy?

A: Too weak looks like rapid fake signups, repeat abuse, and accounts that are hard to trust after creation. Too heavy looks like high abandonment, guest checkout overuse, and low loyalty enrollment. The right balance shows up when conversion stays healthy without a corresponding rise in suspicious registrations.

Q: What should teams do when mobile authentication becomes the preferred consumer path?

A: Treat the phone as part of the trust model, not just the login device. Bind enrolment, authentication, and recovery to signals the mobile channel can support, then use stronger checks only when risk increases. That approach fits consumer behaviour while avoiding password-only dependence.

Technical breakdown

Why AI-based fraud changes checkout trust

AI-based fraud lowers the effort required for impersonation, social engineering, and password attacks, which means attackers can scale convincing outreach faster than traditional manual fraud campaigns. In checkout and account creation flows, the issue is not only stolen credentials. It is that AI can help fraudsters personalize messages, mimic tone, and automate attempts across many targets, increasing both volume and credibility. That shifts the defensive burden toward stronger identity signals at enrolment and authentication time, especially where consumer trust is already fragile.

Practical implication: move fraud controls earlier in the journey, before account creation and checkout decisions are finalized.

Why frictionless onboarding matters to account conversion

The report shows that many consumers still prefer guest checkout, but they will create an account when the process is quick enough. That makes onboarding a trust architecture problem, not just a UX issue. If identity proofing is too heavy, users abandon. If it is too weak, fraud gets in. The best systems shorten time-to-complete while still binding the account to a credible identity signal, which is why pre-fill and mobile-centric flows matter in this context.

Practical implication: design onboarding so it captures identity assurance without extending the path beyond the user's tolerance for delay.

Why mobile authentication is becoming the default trust layer

Consumers in the survey reported strong preference for mobile access and mobile-based authentication, which reflects how identity is shifting toward devices that users already carry and unlock frequently. That does not make mobile proofing automatically secure, but it does create a more usable trust channel than passwords alone. For practitioners, the technical challenge is binding account creation, access, and step-up verification to a device and identity signal that can be reused without turning the flow into a password-dependent bottleneck.

Practical implication: align authentication with mobile-centric journeys and reserve stronger step-up checks for higher-risk events.

Breaches seen in the wild

• Coupang Signing Key Breach: Unrevoked signing key credentials expose 33.7 million records after employee offboarding failure at Coupang.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Holiday checkout fraud is now an identity design problem, not just a detection problem: the consumer survey points to a market where fraud concern and conversion pressure are present at the same time. That means the governance question is where to place trust decisions so the business can still acquire accounts without creating avoidable exposure. Practitioners should treat checkout as an identity control point, not a pure commerce funnel.

Speed has become a trust signal: the finding that consumers will sign up when onboarding takes 30 seconds or less shows that delay itself has security and revenue consequences. In identity programmes, that collapses the old assumption that stronger controls must always feel heavier. The practical conclusion is that verification has to be contextual and fast, or users will self-select into weaker guest paths.

Mobile-first authentication is becoming a practical recovery path for consumer identity: the report's emphasis on phone-based access reflects a shift away from password-centric trust models that consumers no longer fully believe in. That does not remove fraud risk, but it changes where assurance can be anchored. For IAM and fraud teams, the implication is that mobile devices are now part of the account assurance layer, not just an access channel.

AI-based fraud widens the gap between consumer perception and attacker capability: people may recognize fraud risk, but AI lets attackers industrialize personalization, impersonation, and password abuse faster than traditional controls assume. That makes checkout governance a moving target for both merchants and identity teams. The field needs to align identity proofing, onboarding, and authentication as one policy surface, not three separate decisions.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

Trust and conversion now share the same control surface: checkout teams can no longer separate fraud prevention from account growth. When consumers will only tolerate a short signup path, assurance has to be built into the journey design rather than bolted on afterward.

Identity verification is doing more than fraud prevention: in consumer commerce, it is also a growth control because it determines whether a visitor becomes a durable account holder. That shifts programme ownership toward teams that can balance risk, UX, and lifecycle value in one flow.

For practitioners

• Strengthen account assurance at enrolment Use identity verification signals that bind a new account to a real person or device before the account becomes a reusable fraud asset.
• Compress onboarding without removing assurance Redesign signup so low-friction steps happen first, then reserve stronger checks for risk-based escalation points that do not block ordinary shoppers.
• Use mobile as the primary authentication channel Prefer mobile-based verification and authentication paths for consumer accounts where users already rely on phones for access and daily login.
• Treat guest checkout as a risk boundary Apply stricter step-up checks when shoppers avoid account creation, since guest flows often carry less identity continuity and weaker recovery options.

Key takeaways

• AI-based fraud is raising consumer concern during the holiday shopping season, which means trust has become a material checkout design issue.
• Fast onboarding still matters because many shoppers will create an account when the experience is quick and low-friction.
• Retailers that align identity verification with mobile-first consumer behaviour are better placed to reduce fraud without suppressing signups.

Key terms

• AI-Assisted Fraud: Fraud that uses generative models to create, adapt, or scale attack activity such as scripted account creation, credential stuffing, or social engineering. The key shift is speed and variability, which makes static detection weaker and raises the value of runtime enforcement and identity-aware controls.
• Seamless Onboarding: Seamless onboarding is an identity onboarding flow designed to verify a user quickly with minimal friction while preserving trust and security. In this article’s context, biometrics can shorten the first access experience, reduce abandonment, and improve conversion. The focus is not speed alone, but a smoother path from registration to trusted use.
• Step-Up Verification: Step-up verification is a stronger identity check applied when risk increases, such as during password reset, device change, or privileged access request. It uses higher-assurance signals than a static question, such as device possession, authenticated context, or approved administrative review.
• Mobile Authentication: The use of a mobile device or mobile app to verify a user’s identity during sign in or step up access. It can improve usability and support strong authentication, but it also introduces risks from device compromise, insecure recovery, app tampering, and weak session protection.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.