Fraud prevention software now hinges on identity signals and scale

At a glance

What this is: Sift argues that modern fraud prevention depends on identity signals, real-time decisioning, and scale because static rule sets cannot keep pace with automated fraud tactics.

Why it matters: For IAM, fraud, and identity teams, the article reinforces that fraud controls now sit at the boundary of identity governance, customer friction, and decision transparency.

By the numbers:

• In 2024, American businesses lost more than $12.5 billion to fraud.
• Global fraud losses hit nearly $50 billion per year.
• Around 80% of global fraud losses came from attempted payment fraud.
• Nearly 60% of companies report that fraud losses continue to increase in 2025.

Context

Fraud prevention now functions as an identity and decisioning problem, not just a rules-engine problem. Static controls struggle when attackers can reuse stolen identities, automate attempts across channels, and adapt tactics faster than manual tuning can keep up.

That matters for IAM-adjacent teams because fraud platforms increasingly depend on device signals, behavioural patterns, and account context to make risk decisions. The boundary between customer identity assurance and fraud detection is now operational, not theoretical, and teams that treat them separately are likely to miss the control gap.

For security and fraud leaders, the real issue is not whether a platform can detect suspicious activity in principle, but whether it can do so with enough transparency and scale to preserve trust and business throughput.

Key questions

Q: How should payments teams reduce fraud without creating unnecessary customer friction across the full account lifecycle?

A: Payments teams should treat identity proofing and authentication as continuous infrastructure, not a one-time login step. The strongest approach combines persistent identity signals, cryptographic possession, and risk-based checks so higher risk interactions get more scrutiny while routine activity stays smooth. That balance helps prevent account takeover, supports customer trust, and keeps verification aligned to transaction context.

Q: Why do identity signals matter in fraud prevention models?

A: Identity signals matter because fraud rarely appears as a single event. It shows up across accounts, devices, payment methods, and behavioural changes, so a model that cannot correlate those relationships will miss serial abuse or overreact to legitimate customer variance. Identity context makes decisions more accurate and more defensible.

Q: What breaks when fraud systems cannot explain their decisions?

A: When fraud systems cannot explain decisions, teams lose the ability to distinguish genuine fraud from legitimate customer behaviour, tune thresholds responsibly or defend outcomes to customers and regulators. The result is usually more false declines, slower dispute handling and weaker accountability. In practice, opaque decisioning shifts risk from the model to the business.

Q: Should fraud, IAM, and platform security teams use the same trust signals?

A: They should use a shared trust model, but not necessarily identical thresholds. IAM, fraud, and security teams need a common view of account ownership, device context, and behavioural legitimacy so that policy, detection, and escalation stay aligned when abuse crosses team boundaries.

Technical breakdown

Why identity signals now sit at the centre of fraud decisioning

Fraud platforms increasingly rely on identity signals because transaction data alone rarely explains intent. Device attributes, IP reputation, purchase frequency, location patterns, and account history create a behavioural picture that can distinguish legitimate activity from abuse. This works because fraud is often probabilistic rather than deterministic, so risk scoring has to combine multiple weak signals into a stronger decision. The more diverse the signal set, the better the model can separate abnormal activity from normal variation across customers, geographies, and channels.

Practical implication: treat identity and device telemetry as core fraud inputs, not optional enrichment.

How real-time decisioning reduces fraud without freezing good users

Real-time decisioning matters because fraud losses compound quickly once a risky transaction clears or an account takeover succeeds. Static rules cannot adapt fast enough when attackers change IPs, rotate devices, or alter transaction patterns at scale. Decision engines therefore have to evaluate context at the moment of checkout, login, or account change, then approve, decline, or step up based on risk. That architecture reduces manual review load and shortens the time between suspicious behaviour and enforcement.

Practical implication: move high-value fraud controls into the decision path, not after the event.

Why transparency is a governance control in fraud platforms

Transparent risk scoring is not just a usability feature. It is what allows fraud, security, and operations teams to understand why a decision was made, tune thresholds, and defend outcomes when legitimate customers are challenged. Without explanation, teams can neither calibrate friction for different business models nor learn whether a model is over-blocking, under-blocking, or simply noisy. In governance terms, explainability turns fraud scoring into a controllable process rather than a black box.

Practical implication: require decision transparency before allowing fraud tooling to shape customer friction.

Threat narrative

Attacker objective: The attacker’s objective is to monetise identity compromise through fraudulent transactions, account takeover, or abuse that looks legitimate long enough to clear.

1. Attackers begin with stolen identities, compromised accounts, or synthetic identities that can blend into normal customer behaviour.
2. They then exploit device, network, and behavioural ambiguity to pass automated checks, submit fraudulent payments, or take over accounts at scale.
3. The impact is financial loss, chargebacks, operational drag, and reduced trust in the customer journey.

Breaches seen in the wild

• Zacks breach claim 2025: A hacker leaked 12 million Zacks accounts in 2025, claiming domain admin access in 2024; HIBP verified the data, Zacks has not confirmed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity signals are now a governance layer, not a feature set. Fraud controls increasingly make decisions from device, behavioural, and account context, which means identity telemetry has become part of the control plane. That shifts responsibility from simple detection accuracy to decision governance, threshold setting, and explainability. Practitioners should treat fraud decisioning as an identity policy problem with direct business impact.

Scale exposes the weakness of rule-led fraud programmes. Once attack volume rises and tactics diversify, static rules produce either excessive false positives or obvious blind spots. The article’s emphasis on scalable monitoring and machine learning reflects a broader market reality: fraud operations now need adaptive controls that can absorb volume without collapsing under review fatigue. Practitioners should design for continuous tuning rather than one-time rule authoring.

Decision transparency is the named control gap this market is trying to close. Teams do not just need to know that a transaction is suspicious, they need to understand why the platform reached that conclusion. Without that context, friction cannot be calibrated to business risk, and customer trust becomes collateral damage. Practitioners should demand explanation as part of fraud governance, not as a post-hoc reporting layer.

Fraud prevention is converging with identity assurance because attackers exploit the boundary between them. Payment fraud, account takeover, and fake account creation increasingly reuse the same stolen or synthetic identity material. That means IAM, fraud, and customer identity teams need shared visibility into signals and escalation paths. Practitioners should align fraud operations with identity governance instead of running them as separate silos.

From our research library:

• U.S. fraud losses are projected to reach $40 billion by 2027.

What this signals

Identity-led fraud detection is becoming a control-plane issue. The practical question is no longer whether a platform can detect bad activity, but whether identity, behaviour, and device signals are governed well enough to support consistent decisions across channels. For practitioners, that means fraud tooling now has to be evaluated alongside IAM and customer identity governance, not in isolation.

Risk transparency will become a selection criterion, not a nice-to-have. As fraud teams try to balance chargeback reduction with low-friction customer journeys, black-box scoring will be harder to justify. The programmes that will hold up best are the ones that can explain decisions, tune thresholds by business line, and prove that customer friction is proportionate to risk.

For practitioners

• Strengthen identity signal ingestion Ingest device, network, behavioural, and account history signals into fraud decisioning so suspicious activity is evaluated in context rather than by static rules alone.
• Tune thresholds by business model Set different friction levels for high-value, low-volume flows versus low-value, high-volume flows so customer experience matches fraud tolerance.
• Require explainable risk scoring Use fraud tooling that can explain why a transaction or account was flagged, then review those explanations during model and rule tuning.
• Unify fraud and identity governance Create shared escalation paths between fraud, IAM, and customer identity teams so account takeover and synthetic identity patterns are handled consistently.
• Measure false positives against conversion impact Track legitimate customer drop-off alongside blocked fraud to see whether controls are protecting revenue or simply shifting loss into abandoned journeys.

Key takeaways

• Fraud prevention is moving toward identity-rich decisioning because static rules cannot keep pace with automated abuse and account takeover.
• The scale of the problem is material, with U.S. losses above $12.5 billion in 2024 and global losses nearing $50 billion.
• Practitioners need transparent, adaptive controls that reduce fraud without turning customer friction into a hidden cost centre.

Key terms

• Fraud Decisioning Platform: A fraud decisioning platform is a system that turns risk signals into an action such as approve, challenge, or block. It combines scoring, workflow, and analyst review so teams can respond in real time across payments, accounts, and content instead of managing separate point solutions.
• Identity Signals: Identity signals are the data points used to assess whether a user, device, or account is behaving legitimately. They can include IP reputation, device fingerprinting, location, transaction cadence, and account history, and they are most useful when interpreted together rather than in isolation.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• False Positive: A false positive is a scanner result that looks like a secret but is not actually sensitive. In secret governance, false positives matter because they consume analyst time, weaken trust in alerts, and can delay response to the findings that truly change exposure and access risk.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It is a practical foundation for practitioners who need to connect identity controls to broader security and risk programmes.