Fraud is shifting to high-value accounts as chargeback losses rise

At a glance

What this is: Sift’s Q2 2026 benchmark data shows fraud is becoming more selective, with fewer attacks landing but higher chargeback losses and clearer concentration in high-value accounts.

Why it matters: Fraud, IAM, and trust teams need to measure loss timing and account value, not just block rates, because targeted account abuse can look healthy in the short term while downstream disputes rise.

By the numbers:

• Payment fraud bypass rate held steady at 2.8% in Q2 2026, down 14% year-over-year from Q2 2025.
• Account takeover attempts declined to 0.88% in Q2 2026 from 0.95% in Q1, a 7% quarterly improvement.
• Overall chargeback rate rose 19% to 0.31% in Q2 2026 from 0.26% in Q1.
• Fraudulent chargebacks climbed 75.6% to 0.18% in Q2 2026 from 0.10% in Q1.

Context

Fraud controls often optimise for immediate block rates, but that metric can miss delayed loss patterns when attackers target established accounts with normal-looking behaviour. In this benchmark, the primary issue is not more fraud volume, but better targeting that turns fewer compromises into higher downstream costs.

The identity and access angle sits in how trusted account state, stored payment methods, and behavioural familiarity reduce friction for attackers once they get in. That makes fraud governance overlap with account security, authentication strength, and dispute visibility, especially where transactions settle before the victim notices.

This is typical of mature fraud campaigns that have moved beyond broad spray-and-pray tactics. The pattern is increasingly familiar across consumer platforms, subscription environments, and financial services.

Key questions

Q: What breaks when fraud controls are optimised only for block rate?

A: Block-rate-only tuning can make fraud operations look efficient while letting higher-value compromises through. The control fails because it measures the first decision, not the downstream loss. Teams need loss per attack, dispute timing, and account value to understand whether the fraud programme is actually reducing damage.

Q: Why do chargebacks rise even when fraud attempts fall?

A: Chargebacks can rise because attackers are becoming more selective, focusing on trusted accounts that are harder to flag at transaction time. Fewer attempts can still create more loss if each successful compromise yields more value and disputes surface after settlement rather than during the initial review.

Q: What are the signs that a fraud programme is missing targeted account abuse?

A: Look for declining review volumes, flat or improving block rates, and rising chargebacks or customer complaints. That combination usually means the system is approving more ambiguous but riskier transactions, especially in accounts with stored payment methods or repeat purchase history.

Q: How should teams balance authentication and fraud decisioning for high-value accounts?

A: High-value accounts should face tighter authentication because the fraud impact is larger and the attacker payoff is better. The practical approach is to combine stronger step-up checks with account-specific risk scoring so that legitimate customers are not over-fricted while trusted access is not over-relied upon.

Technical breakdown

Why targeted account fraud bypasses volume-based controls

Targeted fraud succeeds because the account, payment method, and behaviour already look legitimate. Traditional rules are built to catch obvious anomalies such as new devices, unusual geographies, or repeated card testing, but they are weaker when the attacker uses a trusted identity path and makes a small number of high-confidence attempts. In practice, the attacker is not trying to maximize volume. They are trying to maximize conversion on accounts that can absorb repeated or delayed losses before the fraud team sees a signal.

Practical implication: fraud models need to score account value and trust context, not just transaction anomaly.

Why chargebacks lag behind the underlying compromise

Chargebacks are often a delayed signal, not an immediate one. A compromise can complete, settle, and sit undetected until the account holder notices the transaction, disputes it, and the payment network processes the case weeks later. That delay breaks the simple assumption that lower attack volume should produce lower loss. It also means transaction-level dashboards can look clean while the true cost is still accumulating in the dispute queue and customer churn.

Practical implication: monitor dispute lag alongside approval and block metrics to understand real loss timing.

How authentication strength changes the fraud surface

Where accounts control direct fund access or stored payment methods, authentication quality becomes part of fraud containment. Stronger step-up checks and broader 2FA adoption reduce the attacker’s ability to turn a stolen or hijacked account into repeated loss. Weak or inconsistent authentication leaves the trust relationship intact after initial compromise, which lets attackers behave like legitimate users long enough to extract value. This is where fraud prevention and identity governance overlap most clearly.

Practical implication: align authentication requirements to account value and downstream payment risk.

NHI Mgmt Group analysis

Targeted fraud has become a trust exploitation problem, not a volume problem. The article shows that attackers are now choosing established accounts because trust reduces friction and increases conversion. That shifts the governance question from how many attempts are blocked to how much loss a trusted account can absorb before detection.

Chargeback growth is a delayed-control failure, not just a loss metric. When disputes rise after settlement, the organisation has already lost the first control round. That means fraud teams need to treat dispute latency as a governance signal, because apparent approval efficiency can hide deteriorating risk quality.

Account value now determines fraud priority. High-value accounts, stored payment methods, and subscription models create a different risk surface from low-value checkout flows. The practical lesson is that fraud programmes must segment controls by account economics, not apply uniform thresholds across the entire customer base.

Identity assurance and fraud prevention are converging. Once a trusted account is compromised, the fraud decision becomes an identity assurance failure as much as a transaction decision. Organisations that separate those domains too cleanly will miss the point where stronger authentication, session risk, and account history should influence fraud treatment.

Dispute-lag visibility is now a core governance concept. The named concept here is dispute-lag opacity: the gap between a successful fraud action and the moment it appears in reporting. That gap distorts programme performance unless teams measure downstream disputes alongside real-time approvals and blocks.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

Dispute-lag opacity is now one of the clearest blind spots in fraud governance. A programme can look healthier on approval and block metrics while losses quietly accumulate in the dispute process, so teams should inspect downstream timing as closely as front-end detection.

Identity assurance is becoming a fraud control variable in its own right. When a trusted account, stored method, or recurring billing relationship is abused, the fraud team is no longer only evaluating a transaction, it is evaluating the durability of account trust.

Fraud teams should expect more selective targeting in high-value environments and adapt controls accordingly. The most resilient programmes will segment by account economics, not assume that lower attack volume automatically means lower risk.

For practitioners

• Segment controls by account value Create distinct fraud thresholds for high-value accounts, subscription accounts, and stored-payment profiles so that controls reflect the actual loss potential of each account class.
• Track dispute lag as a control signal Measure the delay between transaction approval and chargeback discovery, then compare that lag to your review and block rates to spot hidden deterioration.
• Tie authentication strength to loss exposure Require stronger step-up checks or 2FA for accounts with direct fund access, repeat billing authority, or unusually high expected lifetime value.
• Separate approval efficiency from loss quality Report transaction approval performance alongside chargeback cost, fraud loss per account, and customer churn so that faster decisioning does not mask higher downstream losses.

Key takeaways

• The core problem is not rising attack volume, but more selective fraud that extracts greater value from trusted accounts before detection.
• Sift’s benchmark data shows flat payment fraud bypass, lower account takeover attempts, and sharply higher chargebacks, which is the wrong combination for teams relying on block-rate comfort.
• The practical response is to measure dispute lag, segment high-value accounts, and align authentication strength with expected loss exposure.

Key terms

• Chargeback Lag: Chargeback lag is the delay between a fraudulent transaction and the moment the dispute is recorded. That delay matters because it weakens real-time feedback loops, makes dashboards look healthier than they are, and allows attackers to keep exploiting the same weaknesses before the organisation understands the true loss pattern.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Trusted Account Abuse: The use of a legitimate, compromised identity to send malicious messages or perform unauthorized actions. Because the account already has reputation and context, defenders often miss it until the abuse spreads beyond the first target.
• Dispute-Lag Opacity: Dispute-lag opacity is the visibility gap created when fraud is detected only after chargebacks or customer complaints surface. It weakens programme steering because frontline approval metrics can look stable while true losses are still building in delayed channels.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It is designed for practitioners who need to connect identity controls to broader security and risk decisions.