Fraud shifted across the player journey as controls eased during peak demand

At a glance

What this is: SEON shows that fraud during a peak tournament period shifted from registration to dormant-account reactivation and cash-out, exposing how disconnected controls miss a multi-stage attack path.

Why it matters: It matters because IAM, fraud, and identity verification teams need to govern the full lifecycle together, or they will optimise one checkpoint while attackers exploit the next.

By the numbers:

• Registration volume more than doubled year over year globally, rising 121%.
• Latin America’s registration volume nearly quadrupled year over year, rising 278%.
• Dormant accounts drove 83% more of the identity-mismatch signal than during the baseline.
• Suspicious withdrawal patterns rose 38% versus 2025 after seasonality control.

Context

Peak-event fraud pressure usually exposes the weakest control in a customer journey, not just the busiest one. When registration volume surges, teams often relax friction to protect conversion, but that decision only shifts abuse into later stages such as account takeover, bonus claims, and cash-out.

This article is really about lifecycle governance: when identity checks, behavioural signals, and payment controls are not connected, each team sees only a fragment of the attack. That is a classic gap in fraud and identity programmes, and it is especially visible where account history, device trust, and withdrawal behaviour are reviewed separately.

Key questions

Q: What breaks when fraud controls only cover onboarding and not the rest of the user journey?

A: Stage-limited controls let fraudsters pass a clean entry point and then shift abuse into payments, payouts, or cash-out where governance is weaker. The result is a false sense of safety at onboarding and a late, expensive response later in the lifecycle. Teams need controls that carry identity risk forward, not reset it after approval.

Q: Why do dormant accounts create higher fraud risk than active accounts?

A: Dormant accounts are attractive to fraudsters because long inactive relationships weaken routine oversight and make unauthorized activity less likely to be noticed quickly. When customer transactions stop for extended periods, banks lose behavioural context and must rely more heavily on re verification and monitoring. That combination increases the importance of strong identity proofing before access is restored.

Q: How should security teams prioritise fraud controls when traffic spikes sharply?

A: Prioritise controls that preserve cross-stage correlation, not just low-friction onboarding. High volume often tempts teams to relax checks, but that only moves abuse into later stages such as bonus claims and withdrawals. The right sequence is to keep identity revalidation, anomaly scoring, and payout controls aligned so growth does not outrun governance.

Q: What is the difference between registration fraud and cash-out fraud in practice?

A: Registration fraud is the entry mechanism, but cash-out fraud is where the attack becomes measurable loss. A fabricated or compromised account can pass onboarding, then operate quietly until it attempts withdrawal. Registration metrics may look manageable while payout controls absorb the damage, which is why practitioners need one view of the entire path.

Technical breakdown

Why registration controls fail to stop downstream fraud

Registration controls are designed to screen new identities at onboarding, but they do not govern what happens after an account is accepted. If operators loosen checks during peak demand, synthetic identities, aged accounts, and credential-stuffed accounts can all pass into the live environment. Once inside, later actions inherit the trust of the original verification event. The security problem is not just weak registration logic. It is the assumption that onboarding alone can contain fraud that is actually staged across multiple sessions and multiple teams. See the IAM and IGA Basics.

Practical implication: Treat onboarding as one control point in a lifecycle, not the end of fraud screening.

How dormant accounts become a trust bypass

Dormant accounts are high-risk because they carry prior trust, historical behaviour, and often stronger recovery paths than fresh registrations. When a previously verified account reappears on a new device or from a new country, many systems still treat it as a returning customer unless the risk model explicitly revalidates the identity context. That makes dormant reactivation a practical trust bypass, especially when credential stuffing or purchased credentials are involved. The issue is not only takeover, but the reuse of old assurance in a new context. See the NHI Lifecycle Management Guide.

Practical implication: Re-score dormant logins as high risk and require fresh verification when context changes materially.

Why cash-out is where fraud finally becomes visible

Cash-out often reveals the attack because it is the stage where fraud converts into financial loss. By then, registration, login, and bonus abuse signals may already have fired in different systems, but none looked severe enough to trigger escalation on their own. This is the core limitation of siloed monitoring: velocity rules, identity mismatch rules, and payments rules each see a different symptom of the same operation. A connected view is needed because the attacker is optimising across stages, not within one checkpoint. See the Fraud and Cyber Convergence Guide.

Practical implication: Correlate onboarding, authentication, bonus, and withdrawal signals in one decision path.

Threat narrative

Attacker objective: The attacker wants to move a fabricated or reactivated account through the full journey and extract value at withdrawal before the fraud stack can correlate the pattern.

1. Entry occurs when fraudsters use synthetic identities, credential stuffing, or aged accounts to pass registration or re-enter trusted accounts.
2. Credentialed access or trust abuse follows when dormant accounts are activated on new devices or in new countries while historical trust still suppresses scrutiny.
3. Escalation happens as attackers claim bonuses, exploit low-friction paths, or prepare for a large withdrawal that looks normal in isolation.
4. Impact arrives at cash-out, where the operation converts into blocked or successful financial extraction across the player lifecycle.

Breaches seen in the wild

• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.
• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Fraud is now a lifecycle problem, not a point-in-time screening problem. The strongest signal in this article is not any single metric but the way each stage feeds the next. Registration, login, bonus abuse, and withdrawal controls all observed a different fragment of the same operation. That means governance has to move from isolated thresholds to shared decisioning across the full journey. Practitioners should judge fraud controls by whether they can connect identity, behaviour, and payout events in real time.

Dormant accounts are a governance blind spot because they preserve yesterday’s trust in today’s context. A reactivated account with a clean history can look legitimate even when the device, geography, or usage pattern has changed materially. That makes dormant-account handling a direct identity governance issue, not just a fraud operations issue. Joiner-Mover-Leaver thinking is relevant here because leaver logic and stale trust state are the same governance failure in different forms. Teams should treat reactivation as a reauthorisation event, not a resume event.

Cash-out is the control boundary where fraud and identity governance meet. The article shows why payments teams cannot own the final stage alone: by the time withdrawal pressure appears, the trust compromise has already moved through earlier queues. That is where fraud and IAM programmes should converge on shared risk scoring, step-up verification, and stage-to-stage correlation. The practitioner lesson is simple: if the payout layer is the first place your controls see the attack, the organisation is already late.

Industrial-scale identity fabrication becomes more dangerous when volume growth outruns policy discipline. Latin America’s surge shows that attackers adapt where onboarding pressure is highest and review friction is loosest. The point is not only that more fraud arrives with more traffic. It is that operational growth often creates room for fabricated identities to enter quietly and persist until extraction. Practitioners should align policy thresholds with growth conditions, not with calm-period baselines.

Connected fraud operations need a shared operating model across fraud, IAM, and AML-style signals. Siloed queues are the reason the attack looked harmless at each stage. This is where fraud and cyber convergence is not an abstract operating-model debate but a practical governance requirement. The organisation that can see one attack path across multiple teams will stop tuning each team in isolation and start governing the whole path as a single risk.

What this signals

Connected fraud governance is becoming the differentiator. Teams that can correlate identity changes, behavioural anomalies, and payment activity across one path will have a more defensible operating model than teams that optimise each queue separately. The practical shift is from point controls to pathway controls, where the question is not whether one event looks suspicious, but whether the sequence does.

Dormancy management is now a core trust control. The article shows that old trust is often the easiest trust to exploit because it survives long after the account context has changed. Practitioners should expect reactivation, not registration, to remain a high-value abuse point wherever account history is treated as evidence of legitimacy.

Fraud programmes will need closer alignment with identity governance and AML-style payout oversight. The attack path in this article crosses organisational boundaries, which means the control model has to cross them too. Where a fraud and cyber convergence model is absent, the organisation is left with excellent local signals and weak global defence.

For practitioners

• Tighten reauthentication for dormant accounts Require fresh device, location, and behavioural checks when an account returns after extended inactivity, especially if the previous assurance state is stale.
• Correlate registration, login, bonus, and withdrawal signals Build one decision layer that can score the same user across onboarding, authentication, and cash-out rather than leaving each team to decide separately.
• Reassess friction settings during peak demand Review where registration controls were relaxed to protect conversion and measure whether those changes created a downstream opening for synthetic identities or credential stuffing.
• Escalate dormant-account reactivation as a lifecycle event Treat a previously verified account returning on a new device or from a new geography as a governance event that requires revalidation before trust is restored.

Key takeaways

• The article shows that peak-event fraud succeeds when attackers move across the full lifecycle while individual controls only see fragments.
• The strongest evidence is the combination of doubled or tripled volume, dormant-account reactivation, and rising suspicious withdrawals.
• Practitioners need shared decisioning across onboarding, authentication, bonus abuse, and payout because the final loss often appears long after the first trust decision.

Related NHI Mgmt Group resources: NHI Lifecycle Management Guide · Joiner-Mover-Leaver (JML) Guide · Fraud and Cyber Convergence Guide · IAM and IGA Basics

Key terms

• Dormant account: A dormant account is an identity that has not been used within a defined period but still retains active access. The risk is not only wasted licensing. Dormant access often becomes stale standing privilege, which makes offboarding, certification, and incident response harder to execute cleanly.
• Lifecycle fraud control: A fraud governance model that treats onboarding, policy issuance, servicing, and claims as linked stages rather than isolated review points. It uses shared identity context and decision continuity to reduce the chance that fraud can progress unnoticed from one stage to the next.
• Synthetic Identity: A synthetic identity is a software-based actor that can authenticate, request access, and execute actions without being a human user. In practice, this includes AI agents, bots, service accounts, tokens, and other machine identities that need clear ownership, scope, and revocation.
• Cross-Stage Correlation: Cross-stage correlation is the act of linking signals from different phases of an attack into a single investigative story. In AI agent escapes, that means connecting malicious input, tool misuse, privilege escalation, breakout, and exfiltration. The value is faster triage, fewer false positives, and clearer root cause analysis.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore nhimg.org for resources that connect identity governance to the broader security disciplines your programme depends on.