Fraud prevention is becoming a revenue control problem

At a glance

What this is: Sift argues that fraud prevention has shifted from a pure loss-prevention function to a revenue control problem because fraud and false positives both erode revenue.

Why it matters: For identity and fraud practitioners, the implication is that controls must reduce attack success while preserving legitimate access, approvals, and customer journeys.

By the numbers:

• U.S. companies lost an average of 3.3% of annual revenue to fraud in 2025.
• 84% of those losses affected revenue directly or indirectly.

Context

Fraud prevention sits at the point where security controls, customer experience, and revenue protection collide. When detection logic is too loose, fraud drains revenue through chargebacks, account abuse, and manual work; when it is too strict, legitimate users are blocked or delayed and the business still loses money.

The identity governance angle is that fraud controls now have to make decisions on trust, behaviour, and session risk in real time. That makes the boundary between customer authentication, access control, and revenue protection much tighter than older fraud programmes assumed.

Sift’s framing is typical for modern commerce and platform businesses rather than exceptional, because most high-volume digital journeys now have to balance attack suppression with low-friction approval paths.

Key questions

Q: What breaks when fraud controls are too rigid?

A: Rigid fraud controls block legitimate customers, raise abandonment, and increase manual review even when they reduce some fraud. The failure is not only operational. It changes the revenue equation by making protection itself a source of loss. Strong programmes measure both fraud prevented and good transactions preserved, then tune policy to minimise total business damage.

Q: Why do fraud and customer experience need to be governed together?

A: Because fraud decisions affect trust, conversion, and customer retention at the same time. If a control stops attackers but also frustrates legitimate users, the business still loses revenue. Governance has to balance approval rates, false positives, and chargebacks as a single outcome set rather than treating security and growth as separate objectives.

Q: How should payments teams measure whether fraud prevention is actually working?

A: Payments teams should measure fraud prevention with a small set of KPIs tied to both risk reduction and business impact. The goal is to show whether controls are catching fraud, protecting revenue, and avoiding unnecessary friction. Benchmark the metrics over time, compare them to peer or industry standards where possible, and translate the results into language leadership can act on.

Q: When should organisations prioritise automated fraud decisioning over manual review?

A: Organisations should prioritise automation when transaction volume is rising faster than review capacity, or when manual queues are causing inconsistent decisions and delayed fulfillment. Manual review still has value for edge cases, but it does not scale well in high-growth channels like travel and mobile commerce. Automation should absorb the routine cases so analysts focus on the highest-risk exceptions.

Technical breakdown

Why fraud prevention now behaves like a revenue control

Fraud programmes no longer operate only as detection filters at the edge of a transaction flow. They shape approval rates, chargeback exposure, manual review volume, and customer abandonment, which means every decision has a business consequence. In practice, the control plane is moving closer to identity and session risk, because a blocked legitimate user and a passed fraudster both affect revenue. That changes the design goal from simply catching fraud to optimising trust decisions across the customer lifecycle.

Practical implication: Treat fraud policy as a revenue-bearing control surface, not a back-office review function.

How continuous risk scoring changes identity and access decisions

Continuous scoring evaluates behaviour across signup, login, transaction, and post-transaction stages instead of judging each event in isolation. That matters because fraud often unfolds as a sequence, such as fake account creation, credential stuffing, account takeover, and payment abuse. When scoring happens in real time, the system can tighten or loosen controls before the next step in the chain completes. This is also where identity governance and fraud management converge, because the decision is about whether a user session should continue to be trusted.

Practical implication: Move from single-point checks to journey-wide risk decisions tied to identity and session state.

Why analyst tuning and thresholds matter as much as models

A fraud model can be technically strong and still create poor business outcomes if thresholds are rigid or review workflows are poorly tuned. Analysts need enough control to adjust policy when attack patterns shift, because fraud tactics evolve faster than quarterly governance cycles. The practical problem is not just false positives. It is the operational drag created when human review becomes the default for cases that could have been decided automatically. In mature programmes, model performance and workflow design have to be governed together.

Practical implication: Govern thresholds, manual review, and escalation logic as one operating model rather than separate functions.

NHI Mgmt Group analysis

Fraud prevention has become a trust-governance problem, not only a loss-detection problem. Once fraud decisions affect approval rates, friction, and review load, they become part of the identity and access control plane. That means fraud, IAM, and customer experience teams are now managing the same trust boundary from different angles. Practitioners should treat policy governance as a revenue control discipline.

Continuous decisioning is the real shift, because fraud rarely happens in one step. Fake accounts, suspicious logins, account takeover, and payment abuse form a sequence that static rules cannot govern well enough. This is the named concept that matters here: journey-wide trust scoring, meaning trust must be re-evaluated at each stage rather than assumed after initial authentication. Practitioners should design controls that move with the customer journey.

Manual review fatigue is a control failure, not just an efficiency issue. When analysts spend their time on preventable noise, the organisation loses both money and response capacity. The governance lesson is that false positives have the same strategic importance as missed fraud when they block good customers. Practitioners should measure fraud controls by net revenue protection, not only by case closure volume.

The strongest fraud programmes now behave like adaptive access systems. They use behavioural signals, network context, and policy tuning to decide when trust should tighten, when it should relax, and when a human should intervene. That aligns with broader identity governance thinking: access is not a binary grant, but a controlled sequence of trust decisions. Practitioners should align fraud policy with identity assurance and customer-risk governance.

The scale of digital fraud makes isolated merchant logic insufficient. Attackers reuse patterns, identities, and infrastructure across properties, so local-only detection will always be reactive. Fraud operations now need shared intelligence, faster policy iteration, and tighter linkage between risk, revenue, and identity signals. Practitioners should plan for fraud as a cross-programme governance issue, not a single-team function.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

Journey-wide trust scoring: fraud programmes increasingly need to make trust decisions across the full customer lifecycle, not only at login or checkout. That pushes identity, payments, and fraud teams into a shared governance model where policy, friction, and approval rate must be evaluated together.

The programme implication is simple: if fraud controls are tuned only to block attacks, they will eventually suppress legitimate revenue too. Practitioners should define success as net revenue protection, which includes attack suppression, conversion preservation, and lower manual workload.

For practitioners

• Separate fraud loss from friction loss Track blocked legitimate conversions, abandoned sessions, manual review rates, and chargebacks in one business view so the programme can see total revenue impact.
• Score risk across the full journey Apply signup, login, transaction, and post-transaction signals in a single policy model so an attacker cannot move from one weak point to the next unchecked.
• Tune thresholds with business input Review policy thresholds with fraud, payments, customer experience, and identity teams so the response matches current attack patterns and acceptable customer friction.
• Automate the low-value reviews Use automation for cases that repeat known patterns and reserve human review for edge cases that require context, analyst judgment, or escalation.
• Measure net revenue protection Evaluate fraud controls against approval rate, chargeback reduction, false positives, and analyst capacity rather than only against blocked transactions.

Key takeaways

• Fraud prevention is no longer just about stopping bad actors because the control itself can now damage revenue when it creates avoidable friction.
• The article’s central evidence is that fraud losses and indirect revenue effects are large enough to justify treating fraud governance as a board-level business control.
• Teams should measure fraud policy by net revenue protection, combining chargebacks, approval rates, false positives, and manual review load.

Key terms

• False Positive: A false positive is a scanner result that looks like a secret but is not actually sensitive. In secret governance, false positives matter because they consume analyst time, weaken trust in alerts, and can delay response to the findings that truly change exposure and access risk.
• Chargeback: Chargeback is the allocation of technology costs back to the business unit, product, or service that incurred them. For AI workloads, it becomes a governance control when pricing and attribution are reliable enough that cost responsibility can influence design, usage, and prioritisation.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Risk Scoring Model: A risk scoring model is the method used to rank third parties by inherent and residual risk so reviews and remediation can be prioritised. The score should reflect evidence, control gaps, exposure, and criticality, not just a questionnaire tally or a static trust label.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It gives practitioners a practical way to connect identity controls to broader security and business outcomes.