Fraud concentration is rising even as attack volumes fall

At a glance

What this is: Sift’s Q1 2026 benchmarking shows fewer fraud attempts and less manual review, but higher chargeback and fraudulent chargeback rates, indicating that fraud losses are concentrating rather than disappearing.

Why it matters: IAM, fraud, and platform security teams need to treat account takeover, trusted-account abuse, and payment-path governance as loss-concentration problems, not just volume problems.

By the numbers:

• The payment fraud attack rate decreased from 3.3% in Q1 2025 to 2.8% in Q1 2026.
• The manual review rate decreased from 3% to 2.5% year over year.
• The overall chargeback rate increased from 0.2% to 0.3% over the same period.
• The fraudulent chargeback rate increased from 0.098% to 0.102%.

Context

Fraud teams often focus on attack volume because it is the most visible signal, but that can hide where real loss is concentrating. In this case, the operating problem is not just fewer attempts, but that successful abuse is moving toward trusted accounts, stored payment methods, and paths with weaker oversight.

For IAM and fraud practitioners, the useful question is whether identity and transaction controls are tuned to stop low-volume, high-consequence abuse. Account takeover, behavioural trust building, and payment-path monetisation all sit at the boundary between identity governance and fraud prevention, which means the control model has to follow the account lifecycle, not just the transaction event.

Key questions

Q: What breaks when fraud controls focus only on attack volume?

A: Controls that focus only on volume can miss the smaller set of cases that create the most financial damage. Attackers increasingly target trusted accounts, stored credentials, and payment paths with existing value, so the real issue is where losses concentrate. Teams need risk models that prioritise downstream loss potential, not just how many attempts were blocked.

Q: Why does account takeover often create more long-term damage than a single fraudulent transaction?

A: Account takeover is damaging because it turns one compromised login into an ongoing trust problem. Fraudsters can reuse saved payment methods, change account settings, and abuse loyalty value, which increases recovery costs and erodes customer confidence. Merchants also absorb support burdens, chargebacks, and churn risk. The impact extends beyond a one-time loss into repeated abuse and brand damage.

Q: What are the signs that fraud is becoming concentrated even when overall payment fraud rates improve?

A: A key sign is when the top-line fraud rate improves but merchant-level anomalies cluster around a narrow pattern, such as repeated BIN attacks, card testing across countries, or sustained anomalies over many days. Teams should look for repeated transactions that seem ordinary in isolation but align across instruments, accounts, order values, geography, and time. That is where hidden campaigns surface.

Q: How should teams balance conversion, review friction, and fraud loss?

A: Use differentiated controls by account type, transaction value, and monetisation path rather than a single global threshold. Low-friction journeys can remain in place for low-risk cases, while recovery, stored-value use, and payment changes get tighter checks. The right balance protects conversion without leaving high-loss workflows under-governed.

Technical breakdown

Why lower attack volume can still mean higher fraud loss

Fraud programmes often optimise for detection rate or review volume, but those measures can diverge from business loss. When attackers stop spraying broadly and instead focus on trusted accounts, stored credentials, or payment methods with accumulated value, fewer incidents can produce more chargebacks. That changes the control problem from broad filtering to loss concentration management. In practice, the same authentication success can be harmless in one context and damaging in another if the account has already built trust, transaction history, or redeemable value.

Practical implication: align fraud controls to expected loss per account, not only to transaction count or attack rate.

How account takeover becomes downstream payment fraud

Account takeover is often the enabling event, not the final crime. Once an attacker controls a legitimate account, they can lock out the user, add stolen payment instruments, redeem balances, or sell the access to another fraudster. This is why ATO is so tightly connected to payment fraud and brand trust. The compromise is not just identity abuse at login. It is the conversion of a trusted relationship into a monetisation channel, often across multiple sessions and business functions.

Practical implication: treat account recovery, payment changes, and stored-value actions as high-risk identity events requiring stronger step-up controls.

What behavioural trust building changes for detection and governance

A growing fraud pattern is the deliberate aging of accounts before monetisation. Attackers allow an account to look normal, accumulate history, and establish behavioural credibility before executing a high-value action weeks or months later. That breaks short-window monitoring because the harmful action is separated from the preparatory activity. Governance has to cover the full lifecycle of trust, including how accounts earn, retain, and lose that trust. Otherwise, a model that looks effective at the transaction layer can still miss the fraud path that matters most.

Practical implication: add lifecycle-based fraud scoring and review triggers for accounts that shift from routine behaviour to sudden monetisation.

NHI Mgmt Group analysis

Fraud concentration is the more important signal than fraud volume. A falling attack rate can coexist with rising loss if attackers are selecting accounts and payment paths that are already trusted. That means the security question is not only how many attacks are blocked, but where the remaining successful attacks land. Practitioners should measure control performance by expected loss concentration, not by raw attack suppression.

Account takeover is an identity problem that quickly becomes a payment problem. Once a legitimate account is captured, the attacker can operate inside the trust envelope of the business, which makes downstream monetisation easier and more convincing. That is why IAM, fraud operations, and payment risk can no longer be managed as separate functions. Practitioners need shared visibility across authentication, recovery, stored payment instruments, and high-risk actions.

Behavioural trust is becoming a governance asset that attackers can game. The article’s most important signal is the “good user gone bad” pattern, where fraudsters intentionally age accounts before striking. That creates a verification trust gap between initial identity confidence and later monetisation risk. Teams should treat trust as something that degrades, not something that once earned can be assumed indefinitely.

Loss-concentration fraud changes the control model from friction to lifecycle governance. The right response is not blanket tightening that blocks legitimate customers. It is sharper control over the moments when a trusted account changes state, especially recovery, payment updates, stored-value use, and unusually delayed monetisation. Practitioners should govern those transitions as identity-sensitive events.

What this signals

Loss concentration is now the operational challenge. Fraud teams should stop treating declining attack volume as proof that controls are keeping pace. A smaller number of successful events can still drive a larger share of chargebacks when attackers target trusted accounts and payment paths that already carry value.

Account takeover governance belongs in the same conversation as payment risk. When a legitimate account is compromised, the control failure is not limited to login. Practitioners need to govern recovery, stored value, and payment updates as identity-sensitive transitions, because that is where monetisation usually occurs.

Behavioural trust is a control surface, not a comfort metric. Accounts that age into credibility before being abused show why lifecycle monitoring matters. Security teams should watch for delayed monetisation patterns and route them into higher-scrutiny workflows before the account is used to extract value.

For practitioners

• Harden high-risk account transitions Require stronger step-up checks for password resets, payment instrument changes, balance redemption, and any action that converts trust into monetisable access.
• Re-score accounts by loss potential Move beyond attack-rate dashboards and rank accounts by expected downstream loss, including stored value, payment method access, and historical trust signals.
• Separate review thresholds by business model Calibrate manual review and automation thresholds to the fraud economics of each product line, especially subscriptions, wallets, and high-value transactions.
• Track trust decay over the account lifecycle Watch for accounts that become active, idle, then suddenly monetise after a long period of normal behaviour, and route those cases for heightened scrutiny.

Key takeaways

• Fraud is concentrating into the accounts and payment flows that matter most, so volume metrics alone no longer describe the risk.
• The combination of lower attack rates, lower review volume, and higher chargebacks shows that successful fraud is becoming more expensive when it lands.
• Teams should govern trusted-account transitions, stored-value actions, and account recovery as the points where fraud prevention and IAM overlap.

Key terms

• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Loss Concentration: Loss concentration is the pattern where fewer attacks produce a larger share of financial harm because attackers focus on high-value accounts or workflows. It matters when control performance looks stable by volume, but downstream chargebacks, disputes, or recovery costs increase.
• High-Trust Account: A high-trust account is an identity that can reach sensitive data, privileged functions, or broad operational controls. In financial and government systems, these accounts carry outsized risk because a single compromise can unlock large amounts of information or enable fraud. They require stricter monitoring, validation, and review than ordinary user accounts.
• Manual Review: Manual review is the human escalation path for cases that automated identity checks cannot resolve cleanly. It matters because edge cases often reveal whether the programme can explain exceptions, preserve evidence, and maintain consistent decision quality under fraud pressure.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity, machine identity security, IAM, human identity, identity lifecycle, and secrets management. It helps security practitioners connect identity control to the operational decisions that shape risk across modern programmes.