Fraud benchmarks show crypto risk surging while ATO falls

At a glance

What this is: Sift’s Q3 2025 fraud benchmark shows stable payment fraud, sharply lower account takeovers, and a steep rise in cryptocurrency fraud.

Why it matters: Fraud and identity teams should read this as a signal that stronger authentication is helping in one area while newer payment channels and behavioural signals need more attention.

By the numbers:

• Payment fraud attack rate remained stable at 3.1% overall in Q3 2025.
• Manual review rate dropped 21% year over year to 2.2% in Q3 2025.
• Cryptocurrency fraud surged 110% year over year, reaching a 6.7% fraud rate.
• Account takeovers declined 55% year over year as 2FA adoption rose 10%.

Context

Fraud benchmarking is most useful when teams treat it as a governance signal rather than a scorecard. This update shows that attack rates can stay flat while the mix of abuse changes, which means operational controls need to track payment method, authentication strength, and review thresholds separately.

The identity link here is direct: stronger authentication is associated with lower account takeover activity, while newer payment channels with weaker guardrails are absorbing more abuse. For fraud, IAM, and trust and safety teams, the challenge is no longer only blocking volume but separating legitimate users from synthetic or opportunistic behaviour with less manual intervention.

Key questions

Q: What should fraud teams do first when payment fraud stays flat but attack methods change?

A: Start by splitting reporting and controls by payment rail, user journey, and dispute type. A flat aggregate rate can hide a sharp shift in attacker preference, so the first job is to expose where risk is actually moving before you change thresholds or review workloads.

Q: Why does stronger 2FA reduce account takeover but not eliminate account abuse?

A: Because 2FA mainly raises the cost of credential reuse and stuffing, while attackers can still exploit recovery flows, stolen sessions, social engineering, or compromised devices. Teams need layered account defence, not login-only protection, if they want to reduce residual abuse.

Q: How do fraud teams know if automation is replacing manual review safely?

A: Look for stable or improving false-negative rates, not just fewer analyst queues. If manual review drops while losses or reversals rise, automation is absorbing too much uncertainty and the decision model needs recalibration.

Q: When should teams prioritise crypto fraud controls over card fraud controls?

A: When the crypto channel is growing faster than your ability to validate identity, dispute behaviour, and transaction intent. Newer rails with weaker guardrails can become the path of least resistance, so prioritise them when their abuse rate or growth outpaces the rest of the portfolio.

Technical breakdown

Why payment fraud can stay flat while risk shifts underneath

A stable attack rate can mask a substantial change in attacker behaviour. When the overall percentage holds steady, fraudsters often move into methods, segments, or merchant flows where controls are weaker or less mature. That is why payment method mix matters as much as headline fraud rate. In this article, card payments still dominate fraudulent volume, but cryptocurrency stands out because the channel has different verification expectations, faster settlement dynamics, and fewer conventional chargeback guardrails. Practical implication: segment fraud monitoring by payment rail, not just by overall rate.

Practical implication: Split controls and monitoring by payment method so emerging channels do not inherit assumptions built for card fraud.

Why lower manual review changes the identity problem

Manual review is not just an operations metric. It is a signal of how much uncertainty the fraud programme is pushing to human decisioning versus automated scoring, device intelligence, and behavioural risk signals. When review volume falls, teams have usually tightened decisioning thresholds, improved model precision, or accepted more straight-through processing. That changes the identity burden: the system must be better at recognizing trusted users, synthetic behaviour, and risky outliers before an analyst ever sees the case. Practical implication: make sure automated decisions are validated against false-negative drift, not only analyst throughput.

Practical implication: Test whether automation is reducing noise without creating blind spots in high-risk user journeys.

Why 2FA is reducing ATO but not eliminating account abuse

Two-factor authentication raises the cost of simple credential stuffing and password reuse attacks, which is why ATO rates can fall as adoption rises. But authentication alone does not eliminate account abuse, especially when attackers shift to social engineering, session theft, device compromise, or recovery-path abuse. The article’s signal is that layered authentication matters, but it is only one part of account defence. Identity teams need to think in terms of assurance level, not just presence of a second factor. Practical implication: map high-risk journeys to stronger authentication and recovery controls, not just broader 2FA coverage.

Practical implication: Strengthen recovery and step-up controls for sensitive actions, not only initial login.

NHI Mgmt Group analysis

Fraud benchmarks now function as identity governance telemetry: the main value of this update is not the headline rate, but the way it separates channel risk from control effectiveness. A stable overall payment fraud rate can coexist with sharply different outcomes across cards, crypto, and account takeover because the attack surface is governed differently in each path. For practitioners, that means control design must follow the journey, not the aggregate metric.

Cryptocurrency fraud is a control-gap indicator, not just a sector trend: the 110% rise is important because it shows attackers prefer environments where verification, dispute handling, and downstream accountability are weaker. In practice, that usually means thinner trust signals and fewer mature abuse controls around emerging payment methods. Fraud teams should treat new rails as governance exceptions until they prove otherwise.

The ATO decline shows that layered authentication is finally moving the needle: a 55% drop alongside higher 2FA adoption suggests that account security programmes are working where they raise the cost of reuse and stuffing. But that success is bounded. If recovery, device, and session controls remain weak, attackers will simply re-route through the easiest residual path. The lesson for identity teams is to measure assurance across the full account lifecycle, not just at login.

Manual review reduction creates a sharper, not simpler, fraud programme: fewer cases sent to analysts means scoring, behavioural signals, and trust models carry more decision weight. That raises the cost of false negatives and makes governance of automation more important than pure throughput. For identity and fraud leaders, the right question is whether automated decisions remain explainable and resilient as volumes shift.

Fraud now exposes a verification trust gap: the article shows that trust is not a binary property of users, but a context-specific judgment that changes by payment method, authentication strength, and transaction type. That is the real governance challenge for fraud and IAM teams. They need controls that distinguish known-good behaviour from synthetic or opportunistic activity before the transaction is finalised.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

Emerging payment rails should be treated as provisional trust environments: cryptocurrency and other newer methods often lack the mature guardrails that make card fraud easier to contain. For practitioners, that means new payment methods need tighter behavioural thresholds, not inherited policy settings from established channels.

The real governance shift is from broad review to targeted assurance: as automation improves and manual review falls, fraud programmes have to prove that decision quality is still improving, not just that analyst workload is declining. That is where identity and behavioural telemetry become more valuable than volume-based triage.

2FA adoption is a useful signal, but it is not a complete account defence strategy. Teams should watch the recovery flow, the session layer, and high-risk account actions as the next places attackers will test once simple takeover paths get harder.

For practitioners

• Segment fraud controls by payment rail Separate monitoring, thresholds, and escalation rules for cards, crypto, and other payment methods so high-risk channels are not hidden inside blended averages.
• Recalibrate manual review thresholds Use the drop in review volume to test whether automation is absorbing too much uncertainty or simply removing low-value cases from analyst queues.
• Strengthen step-up authentication on sensitive actions Apply stronger authentication and recovery checks to payout changes, account recovery, and other high-risk account events instead of relying on login 2FA alone.
• Measure fraud by journey, not just by portfolio Track account takeover, payment fraud, and chargebacks separately across each product flow so control changes can be tied to the specific abuse pattern they affect.
• Treat emerging payment methods as provisional trust zones Define tighter approval rules, richer behavioural signals, and lower trust defaults for channels with limited dispute history or weaker guardrails.

Key takeaways

• The benchmark data shows that fraud risk is changing shape rather than disappearing, with stable payment fraud masking sharp movement across channels and attack types.
• The strongest evidence in this update is the contrast between a 110% rise in cryptocurrency fraud and a 55% decline in account takeovers as 2FA adoption increased.
• Fraud teams should respond by segmenting controls, tightening authentication on high-risk actions, and measuring automation quality by outcome, not only by reduced manual workload.

Key terms

• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Manual Review: Manual review is the human escalation path for cases that automated identity checks cannot resolve cleanly. It matters because edge cases often reveal whether the programme can explain exceptions, preserve evidence, and maintain consistent decision quality under fraud pressure.
• Chargeback: Chargeback is the allocation of technology costs back to the business unit, product, or service that incurred them. For AI workloads, it becomes a governance control when pricing and attribution are reliable enough that cost responsibility can influence design, usage, and prioritisation.
• Second-Factor Authentication: Second-factor authentication adds an additional verification step beyond a primary credential. In mobile identity workflows, it often confirms possession of a phone during a digital transaction, which can reduce spoofing and account takeover risk. The control is strongest when paired with context-aware risk signals rather than used as a standalone gate.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the NHI Foundation Level course, the industry's only accredited NHI security programme, to strengthen governance across identity and access programmes.