Bot abuse is scaling faster than enterprise fraud controls

At a glance

What this is: This analysis says bot-led fraud is accelerating faster than enterprise defenses, with Arkose Labs reporting sharp quarter-over-quarter growth in total, malicious, and intelligent bot attacks.

Why it matters: For IAM, fraud, and digital identity teams, the message is that account controls, challenge flows, and risk scoring must account for machine-speed abuse, not just human login abuse.

By the numbers:

• Total attacks from bots and fraud farms rose 121% in Q2 over Q1 2023, according to Arkose Labs.
• Malicious bot attacks increased 167% in Q2 over Q1 2023, according to Arkose Labs.
• Intelligent bot attacks increased 291% in Q2 over Q1 2023, according to Arkose Labs.

Context

Bot abuse is a scale problem and a governance problem. When automated traffic overwhelms login, account recovery, signup, and support flows, identity controls stop measuring people and start measuring adversarial automation. That changes the security model for digital products that depend on trusted consumer interaction.

Arkose Labs' quarterly report argues that malicious bots and fraud farms are now operating at machine speed, with attackers able to industrialise account abuse faster than many enterprises can tune defenses. The practical question for identity and fraud teams is how to make assurance decisions when much of the traffic is no longer human.

The article's underlying point is that fraud controls are being outpaced by attacker economics. If the cost of launching abuse keeps falling while detection and interdiction remain friction-heavy for defenders, the organisation loses both revenue and identity signal quality.

Key questions

Q: What should teams do first when bot abuse starts overwhelming account flows?

A: Start with the identity journeys attackers abuse most often: signup, password reset, account recovery, and customer support. Those are the quickest places to add step-up verification, risk signals, and adaptive friction without waiting for a full platform redesign. If those paths remain easy to automate, other controls will only catch downstream damage.

Q: Why do bots and fraud farms create such a large fraud risk?

A: They lower the skill barrier and raise the attacker’s scale at the same time. When a service packages tooling, guidance, and support, more operators can launch attacks that would otherwise require technical expertise. The result is more fake accounts, more credential abuse, and more pressure on identity workflows that were designed for real users.

Q: What are the signs that bot defenses are failing?

A: A common sign is when account creation, login, or recovery traffic looks healthy in aggregate but hidden abuse keeps increasing. Other signals include distorted conversion metrics, repeated support-flow abuse, and a rise in suspicious sessions that pass basic checks but still produce losses or account takeovers.

Q: How should security teams balance bot blocking with customer experience?

A: Use adaptive controls that add friction only when a session looks suspicious, rather than applying the same challenge everywhere. That approach preserves the consumer journey for legitimate users while making automation more expensive. The goal is not maximum blocking, but selective resistance where abuse is most profitable.

Technical breakdown

How fraud farms turn bot abuse into a service model

Fraud farms convert technical abuse into a repeatable service. Instead of a single attacker building custom tooling for one target, a provider packages bots, guidance, and infrastructure so less-skilled operators can launch account creation, credential stuffing, scraping, and support-flow abuse at scale. That changes the threat from isolated automation to industrialised abuse, where volume, reusability, and support matter more than individual sophistication. In identity terms, this is not just traffic noise. It is an attack supply chain that lowers the barrier to entry for account takeover and fake account operations.

Practical implication: treat bot abuse as an industrial service model and tune controls for repeated, distributed attack patterns rather than one-off anomalies.

Why intelligent bots are harder to govern than basic automation

The article distinguishes intelligent bots from basic bots. Basic bots are repetitive and easier to pattern-match, while intelligent bots can adapt to context, alter timing, and navigate workflows more like a person. That makes static blocking less effective because the attack surface includes device signals, session behaviour, and interaction patterns, not just IP reputation or request volume. For IAM and fraud operations, the hard problem is maintaining assurance when adversarial automation can mimic legitimate user journeys closely enough to contaminate telemetry and distort risk scoring.

Practical implication: use layered behavioural signals and step-up friction that can adapt when automation starts resembling normal user behaviour.

How account recovery and support workflows become abuse channels

The article highlights password resets, customer support, fake account creation, scraping, and credential stuffing as common bot-led abuse paths. These are identity workflows, not just application endpoints, because they rely on trust decisions about who is allowed to enroll, recover, or re-enter an account. When those flows are weakly governed, bots can exploit them to take over accounts, create fraudulent identities, or harvest data. The technical issue is that identity assurance often drops at the exact moment users are most vulnerable and high-value decisions are made.

Practical implication: harden recovery, enrollment, and support paths with controls that raise attacker cost without breaking legitimate consumer access.

Threat narrative

Attacker objective: The attacker objective is to monetise automated abuse by taking over accounts, creating fake identities, and extracting value from consumer-facing digital properties.

1. Entry occurs through high-volume bot activity directed at consumer web and app workflows such as account creation, scraping, password reset, and credential stuffing.
2. Credential access is attempted through abuse of login and recovery flows, where bots test reused credentials or manipulate support processes to bypass user verification.
3. Escalation follows when attackers turn successful automation into account takeovers or large-scale fake account creation, expanding access and monetisation potential.
4. Impact lands in distorted business metrics, lost revenue, increased operational load, and consumer harm from account-related fraud.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Bot abuse has become an identity governance problem, not just a fraud problem. When machine-generated traffic dominates the interaction layer, enterprises are no longer deciding only whether a user is legitimate. They are deciding whether the session itself is authentic enough to trust. That shifts the control plane from static perimeter blocking to continuous assurance across signup, login, recovery, and support.

Fraud farms are the commercialization layer of bot abuse. The article shows that attackers are selling access to capability, not merely using their own tooling. That means defenders are no longer up against individual bad actors with variable skill but a supply chain that packages methods, support, and scale. The implication is that bot defense must assume reusable adversary infrastructure, not isolated campaigns.

Identity assurance breaks where business teams least want friction. Account creation, password reset, and customer support are designed to reduce customer pain, which makes them attractive abuse targets. Arkose Labs' findings reinforce a longstanding pattern: the most user-friendly identity journeys often carry the weakest abuse resistance. Practitioners should read that as a control design failure, not a UX trade-off to accept.

Device intelligence and behavioural signals are becoming core identity evidence for consumer systems. In a world where much of the traffic is automated, trust cannot come only from credentials or a successful login challenge. The field is moving toward richer evidence at the interaction layer, because that is where bot activity leaves the clearest operational traces. Security teams should treat this as an identity telemetry problem first and a blocking problem second.

Bot pressure exposes the gap between identity policy and economic reality. Organisations can write rules for users, but adversaries optimise for attack economics. If an abuse path remains profitable, it will be industrialised. That is why bot governance now belongs inside IAM, fraud, and application security conversations together, with practitioners aligning controls to attacker incentives rather than solely to authentication events.

What this signals

Bot abuse now sits at the intersection of IAM, fraud, and application security. Teams that treat it as a narrow anti-abuse problem usually underinvest in the identity journeys that matter most. The more reliable model is to govern the full consumer path, from enrollment to recovery to support, because that is where automation extracts value.

Adaptive friction is becoming a governance pattern, not just a point control. When suspicious sessions are slowed while legitimate users move through with less resistance, the organisation is effectively assigning different trust treatment based on interaction evidence. That is a better fit for modern consumer identity than uniform challenge policies.

Identity telemetry is now operational evidence. Device signals, behavioural biometrics, and session patterns should be treated as inputs to assurance decisions, not as isolated fraud data. Where that telemetry is missing or siloed, bot abuse can scale faster than the organisation can recognise it.

For practitioners

• Tighten account recovery controls Apply stronger verification and step-up checks to password resets, support-assisted recovery, and account change requests so automated abuse cannot reuse the weakest user journey as an entry point.
• Instrument behavioural risk signals Feed device intelligence, interaction patterns, and session behaviour into fraud and IAM decisions so suspicious automation can be identified before it reaches takeover or signup success.
• Segment bot traffic by abuse pattern Track fake account creation, scraping, credential stuffing, and support manipulation as separate abuse classes, because each path needs different thresholds and different response logic.
• Raise attacker cost at the interaction layer Use adaptive friction that becomes harder for suspicious sessions and easier for verified users, so adversaries pay more for each successful attempt while legitimate consumers see less disruption.
• Align fraud and IAM operating models Review whether identity teams, fraud teams, and application owners are using the same definitions for legitimate traffic, abuse, and takeover so controls do not fail at handoff points.

Key takeaways

• Bot abuse is not just traffic inflation. It is a governance problem that undermines account trust, recovery flows, and consumer-facing identity decisions.
• Arkose Labs reports that attacks from bots and fraud farms rose 121% quarter over quarter, with even faster growth in malicious and intelligent bot activity.
• The practical response is to harden high-abuse identity journeys, use behavioural telemetry, and make suspicious automation pay a higher cost than legitimate users.

Key terms

• Bot Abuse: Bot abuse is the use of automated traffic to impersonate or overwhelm legitimate users and processes. In identity programmes, it matters because the attacker targets registration, login, recovery, and support workflows to gain trust, create synthetic accounts, or take over existing ones at scale.
• Fraud Farm: A fraud farm is an organised group of human operators used to perform abuse that automated tools would block. In identity workflows, fraud farms generate authentic human signals that can bypass bot detection, making each session appear legitimate even when the operation is coordinated.
• Access Friction: Access friction is the delay, inconsistency, or effort a person experiences when trying to reach a system or task. It becomes a governance issue when it is high enough to encourage shortcuts, exceptions, or support-heavy workarounds that weaken the intended control model.
• Account Recovery: Account recovery is the process used to restore access when a user cannot authenticate normally. In mature IAM programmes, recovery is treated as part of the trust chain because a weak reset path can bypass stronger login controls and become the easiest route to account takeover.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.