Ecommerce fraud is outpacing sales as AI changes buying behavior

At a glance

What this is: Signifyd says ecommerce fraud is now growing faster than sales, with AI-assisted discovery and changing fulfillment behavior creating new abuse paths across the customer journey.

Why it matters: For IAM, fraud, and identity teams, the signal is that trust controls now need to extend beyond login and checkout into account, return, and fulfillment workflows where abuse is shifting.

By the numbers:

• North American ecommerce sales across all verticals grew 8.35% year over year in H1 2026, according to Signifyd.
• North American fraud pressure jumped 38.6% during the same period, according to Signifyd.
• Significantly not as described claims rose 48% year over year, according to Signifyd.
• Ecommerce sales originating from AI-assisted search increased more than 815% during the first half of 2026, according to Signifyd.

Context

Ecommerce fraud is not tracking sales growth in a neat one-to-one pattern. It is concentrating where customer behavior, fulfillment choices, and product traits create easier abuse conditions, which means risk teams have to look at the whole journey rather than only payment authorization.

That matters for identity and fraud governance because the control problem is no longer limited to verifying a shopper at checkout. Account takeover, returns abuse, BOPIS misuse, and first-party claims all sit in adjacent parts of the journey, where trust decisions and account lifecycle controls can either absorb or amplify loss.

The article’s central point is typical of mature fraud environments, not an outlier event: once merchants improve conversion and convenience, attackers and abusive customers move toward whichever interaction remains easiest to exploit.

Key questions

Q: Why does ecommerce fraud no longer track sales growth one-to-one?

A: Fraud follows opportunity, friction, and policy gaps, not revenue alone. When merchants improve convenience through larger carts, BOPIS, or faster checkout, they also create new places for abuse to hide. The right control model measures where trust changes across the journey, not just how much the business sells.

Q: How should retailers handle first-party fraud separately from account takeover?

A: Treat them as different control problems. Account takeover is about stolen identity or credentials, while first-party fraud usually involves the legitimate account holder exploiting returns, disputes, or fulfillment policies. That means different evidence standards, different workflows, and different loss metrics are needed to avoid misclassifying the problem.

Q: What are the signs that ecommerce fraud controls are missing suspicious activity early enough?

A: Common warning signs include rapid bursts of new account creation, multiple logins from the same IP, mismatched billing and shipping details, repeated failed logins, abnormal geolocation, and bot-like typing or mouse movement. When these signals appear together, the fraud program is likely reacting too late and should tighten risk scoring earlier in the session.

Q: When should fraud teams prioritize journey-wide controls over checkout friction?

A: As soon as fraud begins appearing in fulfillment, returns, or account management rather than only at authorization time. If loss is shifting downstream, tightening checkout alone will miss the abuse path. The better test is whether controls still work after the transaction is approved and the order is in motion.

Technical breakdown

Why fraud now follows customer journey friction, not just volume

Modern ecommerce fraud is increasingly opportunistic rather than volume-driven. Attackers and abusive customers look for the mix of products, delivery methods, and policies that create the least resistance and the highest return. That is why categories with modest sales can still experience sharp fraud spikes, while fast-growing categories may see fraud climb even faster than revenue. In identity terms, the issue is not only whether a shopper is known, but whether the merchant’s trust decision remains valid after the account, basket, fulfillment, and returns context changes. The control surface is broader than checkout authentication.

Practical implication: treat fraud scoring as a journey control, not a checkout gate.

How AI-assisted search changes the discovery layer of fraud risk

AI-assisted discovery changes where demand originates and how quickly intent can be formed. When shoppers arrive through AI-mediated search or referral paths, merchants can see very different basket composition, channel mix, and fraud patterns than in traditional search traffic. That does not mean AI causes fraud by itself; it means it alters the path to purchase and can compress the time between discovery and transaction. For identity practitioners, this widens the gap between who appears legitimate at point of sale and what downstream behavior later reveals. Monitoring source context becomes more important as a trust input.

Practical implication: enrich fraud decisions with channel-origin signals and post-purchase behavior.

Why first-party fraud needs different governance than account takeover

First-party fraud, including significantly not as described claims, is structurally different from credential theft. In account takeover, the attacker impersonates a user to obtain control. In first-party fraud, the customer is usually the account holder, but the claim, return, or dispute is abusive. That distinction matters because the signals, remediation paths, and evidentiary standards differ. IAM and fraud teams should not collapse both under a single abuse label, because the governance response depends on whether the issue is identity compromise, policy exploitation, or deliberate misrepresentation.

Practical implication: separate ATO, returns abuse, and SNAD workflows in fraud governance.

NHI Mgmt Group analysis

Journey-level fraud governance is now the right unit of control: the article shows that fraud is moving across discovery, checkout, fulfillment, and post-purchase resolution, not staying at a single control point. That means merchants that only tune checkout friction are measuring the wrong boundary. The relevant practitioner conclusion is to govern trust across the whole customer journey, not just the transaction.

AI-assisted discovery is a risk amplifier, not a root cause: the more important finding is that AI changes referral behavior and purchase intent formation, which changes the fraud surface merchants have to monitor. That is an identity and trust problem because the merchant’s confidence in the shopper is now influenced by channel context, not only account status. Practitioners should treat AI-origin traffic as a separate governance signal, not a novelty metric.

First-party fraud is a distinct control class: SNAD and related abuse cannot be handled as if they were only account compromise. The governance failure is assuming all bad outcomes come from bad actors outside the customer relationship. Merchants need different evidence standards, case handling, and loss analytics for first-party abuse versus identity theft.

Behavior change creates control debt: larger baskets, BOPIS growth, and store-credit usage all increase the amount of policy and fulfillment logic that can be exploited. The named concept here is journey trust drift: as merchants optimize convenience, the confidence assumptions behind approval decisions decay faster than the controls that were designed for a simpler checkout model. Practitioners should re-baseline controls whenever fulfillment or discovery behavior changes.

Fraud teams should stop using sales growth as a proxy for risk growth: the article’s central warning is that revenue and abuse no longer move in parallel. That breaks a common planning assumption in fraud operations and makes category-specific monitoring essential. The practitioner conclusion is to align governance to abuse patterns, not topline growth curves.

From our research library:

• U.S. fraud losses are projected to reach $40 billion by 2027.

What this signals

Journey trust drift: ecommerce teams should expect convenience features to outpace static fraud rules unless governance is rebuilt around discovery, fulfillment, and post-purchase control points. The control question is no longer whether a shopper looks legitimate at checkout, but whether that trust remains valid after the order moves through the rest of the journey.

Fraud teams that anchor their programme to sales growth alone will miss the places where abuse is accelerating faster than revenue. The better operating model is category-specific monitoring tied to product traits, channel origin, and policy exposure, with clear ownership across fraud, identity, and commerce operations.

For practitioners

• Re-baseline fraud rules by journey stage Separate discovery, account, checkout, fulfillment, and returns signals so that each stage has its own risk thresholds and review logic.
• Split first-party abuse from account takeover Create distinct case types and evidence requirements for SNAD, returns abuse, BOPIS misuse, and credential-based compromise so response teams do not mix different failure modes.
• Add channel-origin context to decisioning Feed AI-assisted search referrals, basket characteristics, and fulfillment choice into risk scoring so the engine can evaluate trust in the full purchase path.
• Reconcile fraud reporting with category behavior Track fraud pressure by product line and shopping behavior, not just by sales growth, to identify categories where abuse is expanding faster than revenue.

Key takeaways

• Fraud is decoupling from sales growth, which means revenue expansion no longer tells merchants where abuse will appear.
• The article shows that AI-assisted discovery and changing fulfillment behavior are expanding the places where trust can be exploited.
• Merchants need journey-wide fraud governance that separates account compromise, first-party abuse, and downstream fulfillment risk.

Key terms

• First Party Fraud: Fraud committed by a real, verified customer who abuses legitimate access to obtain refunds, disputes, chargebacks, or reimbursements. The identity is authentic, but the behaviour is deceptive. In practice, the control problem shifts from proving who the user is to proving whether the claim is consistent, credible, and repeatable.
• Buy Online, Pick Up In Store: Buy online, pick up in store is a fulfilment model where customers place orders digitally and collect goods at a physical location. It creates a fraud bridge because a compromised online account can be turned into physical product loss if pickup verification does not independently challenge the order.
• Not as described (SNAD) claim: A dispute or return claim asserting that a delivered item does not match the description, condition, or expectations created at purchase. In fraud governance, SNAD matters because it can represent legitimate dissatisfaction, policy exploitation, or deliberate first-party abuse.
• Journey-level fraud governance: A fraud operating model that evaluates trust and abuse across the full purchase lifecycle, from discovery to post-purchase resolution. It is stronger than checkout-only prevention because it recognises that risk can emerge in fulfilment, returns, and account management after approval.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps practitioners connect identity controls to the broader security programme they run every day.