TL;DR: Black Friday and Cyber Monday 2025 drove a 13.6% jump in account takeover attack rates across Sift's Global Data Network, with digital commerce seeing ATO rise from 1.35% to 1.67% and e-commerce fraudulent attempt values surging 93% to $250, according to Sift. Peak-season fraud now behaves like a scaled identity abuse problem, not a holiday nuisance.
At a glance
What this is: This Sift analysis shows that Black Friday and Cyber Monday traffic surges are being used to scale account takeover and fraud attempts, not just to hide them.
Why it matters: For IAM, fraud, and identity teams, the signal is that peak-season controls must govern login, step-up, and transaction risk as a single abuse path, not separate events.
By the numbers:
- Black Friday and Cyber Monday 2025 drove a 13.6% rise in account takeover attack rates across Sift's Global Data Network.
- Digital commerce account takeover rose from 1.35% to 1.67% during BFCM 2025.
- E-commerce fraudulent attempt values surged 93% to $250 during BFCM 2025.
Context
Account takeover during peak retail periods is not just a login problem. When transaction volume spikes, fraudsters can blend credential abuse, payment testing, and high-value purchase attempts into normal consumer activity, which makes both detection and response harder.
The article is fundamentally about how seasonal demand changes the fraud operating environment. For identity and fraud practitioners, the important governance question is whether authentication, step-up, and transaction monitoring are tuned to the same risk picture or still managed as isolated controls.
Key questions
Q: What breaks when account takeover controls are too focused on checkout fraud?
A: Teams lose visibility into the earlier stages of abuse, where attackers use legitimate login access to reach stored payment methods, recovery options, and loyalty value. Checkout-only controls often detect fraud too late because the transaction is already coming from a trusted account. Stronger governance needs to cover authentication, recovery, and session behaviour.
Q: Why does high holiday volume make fraud harder to spot?
A: High volume gives attackers cover because legitimate browsing, checkout, and account activity all increase at the same time. That noise reduces the signal value of velocity limits, simple rule sets, and isolated login monitoring. Fraud teams need channel context and transaction context together, otherwise low-friction abuse blends in until the monetisation step succeeds.
Q: What do security teams get wrong about ATO prevention during seasonal spikes?
A: The common mistake is treating login protection as the whole problem. In practice, an attacker who gets into an account can still attempt payment changes, purchases, or promotion abuse unless those steps are separately governed. ATO prevention has to extend through the transaction path, not stop at the authentication screen.
Q: Should organisations use the same controls for authentication and checkout risk?
A: Yes, when the same identity is being trusted across both steps. Authentication may confirm access, but checkout determines monetisation, so separated controls create a gap attackers can exploit. The better model is shared risk scoring, step-up where needed, and consistent policy enforcement across the full account lifecycle.
Technical breakdown
Why peak traffic helps account takeover campaigns
Account takeover becomes more effective when genuine user volume is high because fraudsters can hide in legitimate traffic patterns. Automated login abuse, credential stuffing, and scripted purchase attempts all benefit from the noise created by holiday surges. The risk is not only that more attacks happen, but that more of them look normal enough to evade threshold-based controls. That makes telemetry quality, behavioural baselines, and real-time decisioning more important than static deny lists or simple velocity limits.
Practical implication: tune fraud controls to seasonal baselines and require adaptive decisioning when traffic patterns change quickly.
Why e-commerce fraud values can rise while overall averages fall
A fall in average fraudulent transaction value can indicate broad low-value testing, where attackers probe cards, accounts, or payment paths before scaling up. But a sharp increase in e-commerce attempt values shows a second pattern at the same time: attackers concentrating on high-payoff baskets while concealment is easier during peak demand. That split matters because it means a single fraud metric can hide two different behaviours. Teams need to read value, volume, and channel together, not separately.
Practical implication: segment fraud analytics by channel and basket value so testing activity does not obscure high-value abuse.
How AI-driven scams and agentic commerce change the fraud surface
Generative AI makes phishing, fake storefronts, and impersonated brand experiences cheaper and more convincing, which lowers the effort required to capture credentials or payment details. At the same time, consumer use of AI for product discovery and automated shopping introduces new abuse points around bulk purchasing, promotion fraud, and inventory draining. This is where identity governance intersects with fraud governance: when discovery, login, and payment are all mediated by automated systems, trust has to be enforced across the whole transaction path, not just at authentication.
Practical implication: extend fraud controls beyond login to cover AI-mediated discovery, checkout, and promotion abuse.
Threat narrative
Attacker objective: To turn holiday traffic into cover for credential abuse, payment testing, and monetised account takeover at scale.
- Entry occurs through automated credential abuse, phishing, or impersonated shopping experiences that let attackers blend into peak-season traffic.
- Credentialed access is then used to test accounts, validate payment methods, and attempt purchases or account changes while demand noise reduces detection confidence.
- The attacker objective is to monetise compromised accounts and high-value retail transactions while avoiding chargebacks, blocks, and customer suspicion.
Breaches seen in the wild
- 23andMe credential stuffing 2023: Credential stuffing into 18,000 accounts exposed nearly 7 million people through the DNA Relatives feature.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Peak-season fraud is now an identity governance problem, not just a payments problem. The article shows that attack growth tracks holiday demand, which means the abuse path is built on account trust, transaction trust, and customer trust at the same time. Identity and fraud teams should treat login, step-up, and checkout as one control surface rather than three separate workflows.
Seasonal uplift creates a fraud camouflage effect that weakens static controls. When real customers generate massive traffic spikes, fixed thresholds and narrow velocity rules lose discriminatory power. The practical lesson is that governance must move toward adaptive risk scoring, because the same behaviour can mean normal commerce in one minute and coordinated abuse the next.
High-value fraud is concentrating where friction is lowest and payoff is highest. The rise in e-commerce attempt values shows that attackers are not only testing accounts, they are selectively targeting baskets and channels with stronger monetisation potential. That should push practitioners to re-examine where step-up authentication, behavioural challenge, and transaction limits are actually enforced.
AI-generated deception is widening the fraud intake layer. Fake storefronts, impersonated brands, and manipulated search and ad placement reduce the cost of credential harvest and payment capture. For identity programmes, this means the perimeter now includes discovery, not just authentication, and fraud controls need to reflect that broader trust boundary.
From our research library:
- Sophisticated multi-step fraud rose 180%, according to Sumsub's Identity Fraud Report 2025-2026.
What this signals
Peak commerce periods expose a control-stacking problem. Authentication, step-up, behavioural analytics, and checkout controls need to operate as one policy chain because attackers exploit the handoff between them. If those controls are tuned independently, seasonal traffic makes the gap wider and the signal weaker.
Fraud teams should expect more monetisation after the holiday window closes. Compromised accounts often surface later through disputes, chargebacks, and customer complaints, which means the operational impact extends beyond the shopping event itself. The programme question is whether detection, customer communication, and response ownership are already aligned for that second wave.
For practitioners
- Tighten seasonal fraud baselines Recalibrate account takeover thresholds before peak shopping periods so holiday traffic does not look anomalous only after losses start.
- Unify login and transaction risk decisions Tie authentication, step-up, and payment approval to the same risk engine so an account flagged at login does not pass unchallenged at checkout.
- Segment fraud analytics by channel and value Track low-value testing separately from high-value purchase attempts so average metrics do not hide concentrated abuse in e-commerce.
- Prepare escalation paths before peak periods Define who reviews suspicious spikes, who owns customer notification, and who can adjust controls when fraud patterns shift quickly.
- Extend monitoring to AI-mediated discovery Watch impersonated storefronts, paid ad abuse, and search-result manipulation because those channels now feed credential capture and fraudulent checkout attempts.
Key takeaways
- Black Friday fraud is scaling with legitimate demand, which turns holiday traffic into a cover mechanism for account takeover and payment abuse.
- The article's evidence shows higher ATO rates and sharply higher attempted transaction values in e-commerce, which means attackers are targeting both volume and payoff.
- Practitioners should govern login, step-up, and checkout as one risk path so seasonal spikes do not create blind spots between controls.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-04 — Insecure Authentication | The article centres on account takeover driven by weak or abused authentication during peak traffic. |
| NHI-05 — Overprivileged NHI | Fraud workflows often fail when account privileges and transaction rights are broader than needed. | |
| Recommendation — Harden authentication paths and challenge anomalous logins before attackers can monetise account access. Limit transaction and account-change privileges to reduce the blast radius of compromised access. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Access and authorisation decisions are central to stopping ATO from becoming purchase fraud. |
| Recommendation — Align entitlements and authorisations with risk-based access checks across login and checkout. | ||
| NIST SP 800-53 Rev 5 | IA-5 — Authenticator Management | Credential abuse and account takeover depend on weak authenticator lifecycle governance. |
| Recommendation — Manage authenticators tightly so exposed or abused credentials do not remain valid through peak periods. | ||
| MITRE ATT&CK | TA0006 — Credential Access | The attack pattern relies on credential acquisition and reuse to drive account takeover. |
| Recommendation — Map holiday ATO patterns to credential access activity and prioritise detection of automated abuse. | ||
Key terms
- Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
- Step-up Authentication: Step-up authentication is an additional verification step triggered when a session becomes higher risk or a user attempts a sensitive action. It is used to reduce exposure without forcing extra friction across every interaction, which makes it useful for runtime access governance.
- Behavioural Risk Signal: A behavioural risk signal is an observable action or pattern that suggests increased likelihood of unsafe security behaviour. Examples include repeated simulation failures, risky handling of data, or ignoring recommended actions. Used well, these signals inform targeted guidance rather than broad, generic awareness campaigns.
- Chargeback Pressure: Chargeback pressure is the downstream operational and financial burden that appears when fraudulent or disputed transactions are reversed after purchase. It can lag the original attack by weeks, which means peak-season fraud often creates a second wave of workload in the next quarter.
Deepen your knowledge
NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.
Published by the NHIMG editorial team on July 12, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org