Fraud detection is improving while networked attacks are harder to see

At a glance

What this is: This is Sift's analysis of a fraud economy where headline rates improve even as coordinated rings, account takeover, and method-specific fraud become harder to detect in isolated views.

Why it matters: It matters because fraud and identity teams need network-aware detection, not just transaction-level rules, or they will miss coordinated abuse that crosses accounts, devices, merchants, and payment methods.

Context

Fraud detection often fails when it treats each transaction or account as an isolated event. Once attackers coordinate across multiple merchants, devices, payment instruments, and customer accounts, the signal can disappear inside averages even while the underlying abuse grows more sophisticated.

For IAM, fraud, and trust teams, the governance issue is not simply whether fraud rates are rising or falling. It is whether the control model can see linked behavior across identities, sessions, and downstream transactions, which is where account takeover and payment fraud begin to converge.

Key questions

Q: Why do fraud rings evade transaction-level detection so often?

A: Fraud rings spread activity across accounts, devices, merchants, and payment methods so no single transaction looks decisive. Transaction-level rules can catch obvious anomalies, but they miss the connected pattern that reveals coordination. Teams need relationship-based analytics because the abuse is in the linkage, not just the isolated event.

Q: When should teams prioritise network analytics over stricter transaction rules?

A: Teams should prioritise network analytics when fraud is moving across merchants, channels, or payment methods, or when false positives rise after tightening local rules. In those conditions, stricter thresholds often reduce visibility and increase friction without addressing the underlying ring behavior. Network views show what isolated controls cannot.

Q: What are the signs that account takeover controls are too weak or too disruptive?

A: Weak controls usually show up as repeated login anomalies, suspicious password reset activity, sudden changes in device or location patterns, and account abuse that slips through unchanged. Overly disruptive controls show the opposite pattern, with rising abandonment, repeated challenge failures, and complaints from legitimate users. The practical test is whether risk signals are reducing fraud without creating excessive friction.

Q: How should fraud teams respond when the same ring spans multiple businesses?

A: They should shift from merchant-specific case handling to coordinated investigation across the affected network. Shared identifiers, common devices, and reused payment instruments need to be reviewed together so the ring can be contained as one pattern. Otherwise each business sees only a fragment and the operation persists.

Technical breakdown

Why network linkage outperforms isolated fraud rules

Fraud rings are built to evade controls that only inspect a single event, user, or merchant at a time. Network linkage looks for shared devices, repeated payment instruments, reused accounts, and cross-merchant transaction patterns that are individually low risk but collectively reveal coordination. That is why a user associated with fraudulent chargebacks can score far above a clean user even when any one transaction appears ordinary. In practice, linkage analytics are the difference between seeing an isolated anomaly and seeing a fraud operation.

Practical implication: tune fraud controls to evaluate relationships across accounts, devices, and payment instruments, not only per-transaction thresholds.

Why account takeover still matters when block rates fall

Lower ATO block rates do not mean the attack class is solved. Attackers keep targeting accounts because they preserve value across banking, social, gaming, subscriptions, and commerce, and because login controls alone do not stop downstream misuse after access is gained. The article's point is that authentication is only one layer. Behavioural signals, account-change monitoring, and transaction analysis are needed to catch the post-login actions that reveal abuse after compromise.

Practical implication: extend ATO detection beyond sign-in controls to monitor account changes and subsequent transaction behavior.

How false positives and narrow rules distort fraud governance

Blunt rules fail in two directions at once. A broad block can create unnecessary friction and drive false positives, while a narrow rule aimed at one merchant or one payment method misses coordinated activity spreading across the network. Fraud rings exploit thresholds by keeping values low, splitting activity, or shifting methods and merchants. That means tuning is not just a model issue, it is a governance issue because the wrong control boundary changes both customer experience and loss exposure.

Practical implication: review fraud thresholds by channel and method so controls reflect actual loss patterns instead of one-size-fits-all policy.

Threat narrative

Attacker objective: The objective is to monetize stolen or compromised identity signals at scale while staying below isolated detection thresholds.

1. Entry begins with compromised or created accounts that join a broader fraud ring and blend with ordinary customer activity.
2. Credential or identity abuse continues as the ring reuses cards, accounts, and device patterns across multiple businesses to evade single-merchant detection.
3. Escalation occurs when low-value or distributed transactions stay below thresholds while the ring scales across merchants and methods.
4. Impact is chargeback loss, payment fraud, and account takeover that remain partially hidden unless analysts correlate the full network pattern.

Breaches seen in the wild

• 23andMe credential stuffing 2023: Credential stuffing into 18,000 accounts exposed nearly 7 million people through the DNA Relatives feature.
• Meta AI Instagram Account Takeover: 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Fraud governance is shifting from event detection to relationship detection. The article shows that average block rates can improve while the actual abuse pattern becomes harder to see. That matters because modern fraud rings operate across merchants, devices, accounts, and payment methods, which means the control boundary has moved from the transaction to the network. For practitioners, the decisive question is whether the programme can correlate identity behavior across the full customer journey.

Account takeover and payment fraud are no longer separate operational problems. Login controls may reduce one part of the risk, but the article makes clear that post-login behavior, account changes, and payment behavior now define the real loss surface. That creates a trust gap between authentication success and safe account usage. Teams should treat ATO as a lifecycle issue, not a sign-in issue.

Networked fraud creates governance debt when controls are tuned to a single channel. A rule that works for one merchant, one industry, or one payment method can fail when the same ring shifts venues or transaction size. The named concept here is fraud linkage blindness: the control gap that appears when organisations measure loss per event instead of per connected pattern. Practitioners should design detection and review processes around connected identity behavior, not isolated thresholds.

Post-incident response is now part of fraud control, not an afterthought. The article links fraud outcomes to customer trust and retention, which means remediation quality affects the control environment as much as detection speed does. Quick resolution, transparent communication, and clear recovery paths are now governance requirements. For teams, that means the fraud programme must own the customer impact of every incident, not just the alert.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

Fraud linkage blindness: the real governance gap is not whether a model can score a transaction, but whether the programme can see connected behavior across identities, devices, and payment paths. Teams that keep tuning single-event rules will keep missing rings that move just far enough to stay below threshold.

The implication for practitioners is that fraud and identity operations need shared investigative views, not siloed dashboards. Detection, review, and customer communication have to work together because the post-incident experience now influences whether a fraud victim stays, churns, or loses trust permanently.

For practitioners

• Build network linkage into fraud review Correlate accounts, devices, payment instruments, merchants, and transaction histories so suspicious relationships are visible even when single events look normal.
• Extend ATO monitoring beyond login events Track post-authentication changes such as profile edits, payout destination updates, device changes, and unusual purchase behavior after access is granted.
• Tune thresholds by channel and payment method Separate rules for high-loss and low-loss flows, because the article shows that uniform controls underperform when order values and fraud rates vary widely.
• Treat incident handling as a trust control Define response paths that prioritise transparent customer communication, fast containment, and consistent remediation when fraud is confirmed.

Key takeaways

• Fraud can look healthier in aggregate while the real attack pattern becomes harder to detect across connected accounts and merchants.
• The article shows that coordinated rings, account takeover, and payment fraud are increasingly visible only when teams analyze relationships, not just individual events.
• Fraud programmes now need network linkage, post-login monitoring, and strong incident handling to reduce loss and preserve customer trust.

Key terms

• Fraud Linkage: Fraud linkage is the practice of connecting accounts, devices, payment instruments, and transaction histories to reveal coordinated abuse that looks normal in isolation. It shifts detection from single-event scoring to pattern recognition across a network of related behaviors.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• False Positive: A false positive is a scanner result that looks like a secret but is not actually sensitive. In secret governance, false positives matter because they consume analyst time, weaken trust in alerts, and can delay response to the findings that truly change exposure and access risk.
• Payment Fraud Detection: Payment fraud detection is the set of controls used to identify and stop unauthorised or abusive transactions before they complete. It typically combines device intelligence, behavioural analytics, identity data, and transaction context to separate genuine customers from attackers with similar-looking activity.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, IAM, and secrets management. It helps practitioners connect identity controls to the broader security and fraud programmes they run.