Fraud benchmarking in 2025 shows precision beats blanket rejection

At a glance

What this is: Sift’s 2025 fraud benchmark data shows fraud teams are moving from broad rejection toward more precise controls, with payment fraud, account takeover, and manual review all behaving differently across channels and seasons.

Why it matters: Fraud teams, identity leaders, and risk owners should read this as a governance signal: stronger outcomes increasingly depend on tuning controls to transaction context, credential risk, and operational tolerance rather than applying uniform rejection logic.

By the numbers:

• Across industries, the average payment fraud attack rate was 3.15% in 2025.
• Sift says the average manual review rate in Q4 sat at just 2.7%.
• Account takeover attacks averaged 0.99% in 2025 and showed little seasonality.
• Financing, including buy now, pay later, showed the highest risk at a 6% fraud rate.

Context

Fraud benchmarking matters because the operational problem is rarely just volume. Teams have to decide where to apply friction, how much manual review to keep, and when to let more transactions through without opening the door to abuse. In that sense, the article is about risk governance as much as it is about fraud patterns.

The identity intersection is strongest in account takeover and credential leak driven fraud. When attackers can reuse stolen identities or blend into seasonal traffic, payment controls alone are not enough; fraud programs need to understand authentication strength, review thresholds, and the trust assumptions embedded in onboarding and checkout.

The 2025 data suggests the most mature teams are not trying to eliminate every suspicious event. They are calibrating controls to preserve revenue, reduce avoidable friction, and contain known fraud paths more precisely than a broad deny-all posture allows.

Key questions

Q: What breaks when fraud teams rely on blanket rejection instead of precision controls?

A: Blanket rejection usually breaks the balance between loss prevention and customer conversion. It blocks legitimate activity that only looks risky at a surface level, while still failing to distinguish different fraud paths such as payment abuse and account takeover. Precision controls matter because they let teams tune friction to the transaction context rather than treating every anomaly the same.

Q: Why does account takeover change fraud governance so much?

A: Account takeover matters because the attacker enters through a valid identity, not an obviously fraudulent transaction. That means standard payment filters may see a trusted user while the real issue is credential compromise, session abuse, or reused authentication. Fraud teams need IAM visibility because the compromise often starts before the purchase and ends after access is established.

Q: What are the signs that fraud review policy is out of balance?

A: A review policy is usually out of balance when manual checks are high but losses stay flat, or when review drops sharply without a corresponding improvement in fraud outcomes. Another warning sign is inconsistent treatment across payment methods or business lines. The right measure is whether the policy reduces loss while keeping friction proportionate to the actual risk.

Q: How should fraud teams decide when to tighten controls during peak periods?

A: Teams should tighten controls when risk indicators rise faster than conversion pressure can justify. That means watching transaction mix, attack patterns, and authentication signals together, then adjusting step-up checks and review thresholds only for the flows where fraud cost is likely to outweigh revenue impact. Seasonal demand should change the policy, not erase it.

Technical breakdown

Why blanket rejection misses the real fraud control problem

Blanket rejection treats fraud as a simple yes-or-no decision, but modern fraud operations work across multiple layers: device, account, transaction, and behavioral context. A high false-positive rate can damage conversion and customer trust, while overly permissive controls invite abuse. Precision controls aim to distinguish legitimate but unusual activity from malicious activity by using more than a single rule or threshold. That requires better signal quality, cleaner data, and tighter policy tuning. In practice, the question is not whether to block more, but whether the policy logic is aligned to the actual risk profile of each flow.

Practical implication: move from static deny rules to segmented controls that vary by channel, payment method, and customer risk profile.

How account takeover changes the fraud model

Account takeover is different from payment fraud because the attacker begins with a valid identity foothold. Stolen credentials, leaked passwords, and reused logins let the attacker appear legitimate long enough to access stored payment details or personal data. That makes authentication strength, step-up checks, and anomaly detection more important than simple transaction blocking. The article’s low average ATO rate suggests many teams are containing this risk, but the persistence of credential-leak driven spikes shows the control problem remains live. Identity and fraud teams need shared visibility because ATO often starts outside the payment journey but ends inside it.

Practical implication: coordinate fraud and IAM signals so credential leaks trigger stronger verification before account access turns into transaction abuse.

Why review volume should be treated as a policy signal

Manual review is not just an operations metric. It is a sign of how much uncertainty the fraud model is pushing to humans instead of resolving with automation. A very high review rate can indicate weak scoring, poor data quality, or overly conservative policies, while a very low rate can indicate overconfidence or blind spots. The article’s 2.7% Q4 review rate suggests Sift customers are relying more on automated decisioning than many merchants, but the governance question is whether exceptions are still being handled consistently. Review strategy should be measured against both loss prevention and friction cost.

Practical implication: define acceptable manual review thresholds by business line and monitor whether exceptions are shrinking because controls improved or because risk is being ignored.

NHI Mgmt Group analysis

Precision fraud control is now a governance discipline, not just a detection problem. The article shows that risk teams are tuning approval logic, review thresholds, and authentication requirements rather than relying on broad rejection. That shift matters because the best control is the one that preserves legitimate commerce while still catching abuse, not the one that simply blocks the most traffic. Practitioners should treat fraud policy as a living governance model, not a fixed rule set.

Account takeover remains the clearest bridge between fraud and identity security. The article’s discussion of credential-leak-driven spikes shows that fraud outcomes are often downstream of identity compromise. That means authentication strength, step-up policies, and session risk signals are part of the fraud stack, not a separate IAM concern. Teams that split these functions too cleanly will miss the attack chain and react too late.

Manual review capacity should be interpreted as a control design choice, not an efficiency brag. When review rates drop, the key question is whether the automation is genuinely more precise or whether exceptions are being hidden in the model. The named concept here is review-to-risk alignment: the balance between human review effort and the real uncertainty in the transaction flow. Practitioners should use that lens to decide where humans still add value.

Fraud tolerance has to track business context, especially in seasonal and regulated flows. The article’s holiday and vertical-specific patterns show that a single global threshold is too blunt for modern commerce. Fraud governance now has to understand revenue goals, product mix, and customer journey friction. The practical conclusion is that risk policy should be segmented, measurable, and tied to transaction context rather than applied uniformly across the estate.

From our research library:

• Sophisticated multi-step fraud rose 180%, according to Sumsub's Identity Fraud Report 2025-2026.

What this signals

Review-to-risk alignment is the practical test emerging from 2025 fraud benchmarks. Teams should judge whether manual review is still carrying uncertainty that automation cannot resolve, or whether it has become a default crutch that masks poor policy design.

Fraud and identity governance are converging around the same operational question: how much trust can be granted at the point of access without forcing unnecessary friction. For practitioners, that means aligning authentication, review, and transaction scoring rather than managing them as separate controls.

The most useful benchmark for 2026 will not be raw fraud volume alone. It will be whether risk teams can keep precision high enough to protect revenue while avoiding the broad rejection patterns that damage legitimate commerce.

For practitioners

• Define risk thresholds by payment context Set different approval, step-up, and review thresholds for cards, BNPL, and high-risk checkout flows instead of using one global policy.
• Join fraud and identity signals Feed credential-leak, anomalous login, and session-risk signals into fraud decisioning so account takeover does not look like ordinary customer activity.
• Recalibrate manual review capacity Use review rate, loss rate, and conversion impact together to determine whether human review is catching uncertainty or simply slowing legitimate customers.
• Segment controls for seasonal traffic Relax or tighten friction only where the business context justifies it, then validate the outcome after peak periods rather than assuming the setting was correct.

Key takeaways

• 2025 fraud performance shows that broad blocking is too blunt for modern commerce, especially when payment channels, seasonal traffic, and user risk vary so widely.
• The data points to a tighter link between identity compromise and fraud outcomes, with account takeover and credential leaks shaping part of the threat picture.
• Fraud programs now need segmented policy, shared identity signals, and review thresholds that reflect actual uncertainty rather than blanket caution.

Key terms

• Payment Fraud Attack Rate: The payment fraud attack rate is the share of transactions blocked because they were judged fraudulent. It is a control signal, not a raw fraud count, so it reflects how aggressively a risk system intervenes against suspicious orders. Seasonal volume changes can move this rate even when underlying fraud pressure stays high.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Manual Review Rate: The proportion of transactions or events routed to human analysts instead of being decided automatically. This is not just an operations measure. It is a governance signal showing how much uncertainty the fraud policy still pushes to people rather than resolving through scoring, rules, or step-up controls.
• Precision Fraud Control: A fraud control strategy that targets high-risk activity without broadly rejecting legitimate behaviour. The goal is to tune decisions to the transaction context, identity signals, and business tolerance so that prevention remains effective while customer friction and revenue loss stay proportionate.

Deepen your knowledge

The NHI Foundation Level course covers NHI governance, machine identity security, IAM, and secrets management in a practitioner-focused format. It is suitable for security teams that need a common language for governing identity risk across systems and workflows.