TL;DR: Holiday fraud starts with scraping and fake account creation on October 1, peaks in the week of November 16 to 23, and extends into refund fraud through January as marketplace churn, account takeover and synthetic identities intensify, according to Kasada's Q3 2026 Threat Intelligence Report. The control problem is no longer event-day defence but sequencing identity, bot and checkout protections ahead of the run-in.
At a glance
What this is: NHI Mgmt Group's analysis, drawing on Kasada's research: Holiday fraud now begins in the run-in to Black Friday, with scraping, fake account creation, bot checkouts, account takeover and refund fraud spread across distinct threat windows.
Why it matters: Fraud and IAM teams need to shift from date-based peak protection to window-based controls that cover onboarding, login, checkout, loyalty and refunds.
By the numbers:
- 924K+ automated checkouts were claimed in monitored communities this quarter, across 710+ retailers.
- KasadaIQ tracked a 3.5x rise in Telegram refund fraud signals in 2026.
Context
Holiday fraud is best understood as a sequence of identity and abuse windows, not a single shopping-day spike. In retail, travel, fintech and digital platforms, attackers pre-position accounts, test protections, exploit checkout flows, and then monetise stored value, refunds or loyalty balances once legitimate demand is at its highest.
Kasada's data points to a governance gap that many teams still miss: fraud controls are often timed to sales events rather than the earlier lifecycle stages where the attacker builds advantage. That makes account creation, recovery and session trust just as important as the checkout page.
This pattern is typical of modern fraud operations, which move early, adapt quickly and exploit weakly governed customer identity journeys.
Key questions
Q: How should security teams prepare for holiday fraud before the sale period starts?
A: Start before the sale window opens. The strongest approach is to harden account creation, login, recovery and checkout controls in the run-in phase, then increase friction again when demand peaks. That sequence stops attackers from aging accounts, testing resets and building trust before the highest-value days arrive.
Q: Why does a clean KYC check not stop synthetic identity fraud?
A: Because KYC confirms evidence, not intent. A synthetic identity can be assembled from low-cost data, documents and marketplace-sourced signals, so a valid check may still correspond to a fake or compromised customer. Teams need behaviour, device and transaction context to distinguish real customers from manufactured trust.
Q: What are the signs that seasonal bot abuse is moving earlier in the cycle?
A: Watch for rising account creation, scraping, password reset activity, abnormal checkout volume and marketplace chatter before the main shopping dates. Those signals usually mean attackers are positioning infrastructure and accounts for later monetisation, rather than waiting for the peak sale day itself.
Q: Should fraud teams treat marketplace takedowns as a control or as a signal?
A: Treat them primarily as a signal. A takedown may disrupt one venue, but seller migration to successor platforms shows that the underlying capability persists. The better response is to track reappearance patterns, map trader continuity and use that intelligence to tune fraud and identity controls.
Technical breakdown
Why holiday fraud starts in the run-in window
The run-in is the build phase for seasonal abuse. Bot operators scrape sites, create fake accounts, age profiles and test defences before peak traffic arrives. That matters because the attacker does not need to win on the sale day if they can establish account credibility, inventory visibility or session familiarity beforehand. For fraud and identity teams, the control boundary sits earlier than many monitoring stacks assume: registration, login, password reset and device trust are all part of the attack surface. When those steps are weak, downstream controls face a mature adversary, not a fresh one. See the Dark Web Monitoring Guide.
Practical implication: Move monitoring and throttling upstream to registration, login and recovery flows before seasonal demand surges.
How marketplace churn changes fraud response
Criminal marketplaces now behave like a resilient supply chain. When one platform collapses, sellers reappear on a successor platform quickly, sometimes under the same name, and the ecosystem keeps trading credentials, synthetic identity components and access tooling. That means defenders should not treat marketplace disruption as a durable fix. The relevant risk is continuity of supply, not the fate of one venue. Intelligence teams need to track seller migration, not just takedowns, because the asset being traded is identity material that can be reused across onboarding, account takeover and refund abuse.
Practical implication: Track seller migration paths and treat marketplace takedowns as temporary friction, not closure of the threat source.
Why account lifecycle controls now sit beside fraud controls
Holiday fraud now links customer identity, payment abuse and loyalty theft in one chain. A clean KYC match may verify a document, but it does not prove a legitimate customer, and a signed-in account may still be an attacker-controlled session. That is the identity bridge practitioners need to internalise: fraud prevention and IAM cannot remain separate operating models when account recovery, stored cards, loyalty balances and gift funds are all monetisation points. The strongest control points are therefore issuance, recovery and step-up decisions, not only final transaction checks.
Practical implication: Coordinate IAM, fraud and customer-risk policies so identity proofing, recovery and step-up checks share the same risk model.
Threat narrative
Attacker objective: The objective is to monetise seasonal demand by turning manufactured account trust into checkout abuse, account takeover, refunds and loyalty or stored-value theft.
- Entry begins with scraping, fake account creation and the reuse of marketplace-sourced identity material during the run-in window.
- Credential and session advantage builds as attackers age accounts, test recovery paths and prepare bot configurations before the peak sale period.
- Escalation occurs when bots automate checkout abuse, account takeover and loyalty draining across retail, travel and financial journeys.
- Impact lands later through refund fraud, cash-out of stored value and the monetisation of loyalty points and full carts after purchases settle.
Breaches seen in the wild
- JetBrains Marketplace AI Plugin Campaign: 15 malicious JetBrains Marketplace plugins steal AI API keys from 70,000+ developers via supply chain attack.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Holiday fraud is a lifecycle problem, not an event-day problem. The article's timing data shows that abuse starts weeks before Black Friday and continues well after purchase settlement. That pattern matters because the attacker is building account credibility and operational scale before defenders concentrate their controls. Practitioners should treat registration, recovery and pre-sale monitoring as first-class fraud control points.
Synthetic identity has become a low-cost operating input. Kasada's finding that a synthetic identity can be assembled for less than $100 shows how cheaply attackers can buy enough trust signals to pass onboarding checks. The important governance implication is that identity verification alone does not establish customer authenticity. Fraud teams need to combine verification, behavioural analysis and downstream transaction risk to close the gap.
Marketplace churn is now part of fraud continuity. The report shows that when one marketplace collapses, sellers reappear quickly on successor platforms. That means takedowns reduce friction but rarely remove capability. Dark web monitoring becomes most useful when it tracks migration, seller reappearance and offer persistence rather than one-off platform shutdowns.
Customer identity governance must now sit inside fraud operations. The report connects onboarding, account takeover, loyalty abuse and refund fraud in one commercial chain. That is why IAM, customer security and fraud teams need a shared view of identity confidence, session trust and recovery risk. A clean KYC outcome is not enough if the same account can later be converted into a fraud instrument.
Named concept: holiday fraud windowing. The article points to a predictable sequence of abuse windows, each with different control needs. The field should stop treating seasonal fraud as a single peak and instead manage a staged threat calendar that maps controls to run-in, peak sale and refund phases. Practitioners should align control ownership to the window, not the calendar date.
What this signals
Fraud programmes need a staged control model. The article shows that seasonal abuse is spread across run-in, peak sale and refund windows, so the right programme response is not one burst of hardening but a calendar of controls that changes by phase. Teams should align fraud operations, customer identity and checkout policy to those windows rather than to a single date.
Identity confidence has become the common currency across abuse types. Scraping, fake accounts, account takeover and refund fraud all depend on the same upstream problem: weak confidence in who or what is acting. That creates a direct governance requirement for fraud and IAM leaders to share risk signals and decision thresholds.
Refund fraud is where seasonal abuse often lands after the headline event. Claims can arrive weeks after purchases, which means security teams need post-sale monitoring, inventory on loyalty exposure and recovery workflows that survive the holiday backlog.
For practitioners
- Move monitoring into the run-in window Raise bot and account-creation controls before November 1 so the environment is hardened before aged accounts and fake registrations accumulate.
- Gate checkout and recovery by account confidence Apply stronger friction to checkout, password reset and account recovery when the session, device or identity history suggests bot-assisted behaviour.
- Coordinate IAM and fraud policy for onboarding Use shared decision rules for KYC, step-up verification and account trust so a clean document match does not automatically grant full account confidence.
- Stage refund and loyalty freezes early Pre-authorise refund, points and stored-value holds so teams can trigger them quickly when seasonal abuse begins to show.
Key takeaways
- Holiday fraud now unfolds in phases, with attackers building account trust before the main shopping dates and cashing out after purchases settle.
- Kasada's data shows both scale and speed, including 924K+ automated checkouts in monitored communities and a 3.5x rise in refund fraud signals.
- The practical response is to move controls earlier, share identity risk decisions across teams and prepare for post-sale refund abuse as part of the same campaign.
Related NHI Mgmt Group resources: Dark Web Monitoring Guide · Intelligence Requirements Template · Threat Intelligence Guide
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP API Security Top 10 and MITRE ATT&CK address the attack surface, NIST SP 800-63 and NIST CSF 2.0 set the technical controls, and GDPR defines the regulatory obligations.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP API Security Top 10 | API2 — Broken Authentication | Account takeover and weak session trust are central to the abuse pattern described. |
| Recommendation — Harden authentication and recovery flows where seasonal attackers can hijack sessions or reset access. | ||
| NIST SP 800-63 | SP 800-63A — Enrollment and Identity Proofing | Synthetic identity and KYC bypass are core themes in the report. |
| Recommendation — Strengthen proofing thresholds for accounts that later feed payment, loyalty or refund abuse. | ||
| GDPR | Art.32 — Security of Processing | The article concerns identity and fraud controls around personal accounts and customer data. |
| Recommendation — Apply appropriate technical and organisational measures to protect customer identity and account data. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | Fraud abuse depends on excessive trust in customer accounts and recovery paths. |
| Recommendation — Review entitlement and access decisions across customer-facing journeys before peak demand. | ||
| MITRE ATT&CK | TA0006;TA0010 — Credential Access; Exfiltration | The seasonal abuse chain uses credential access and later monetisation through account abuse and refunds. |
| Recommendation — Map seasonal abuse indicators to credential access and exfiltration patterns in your detections. | ||
Key terms
- Holiday Fraud Window: A staged period in which attackers prepare, execute and cash out seasonal abuse across multiple dates rather than on a single shopping day. The term covers the run-in, peak sale and refund phases that fraud teams must manage as one continuous campaign.
- Synthetic Identity: A synthetic identity is a software-based actor that can authenticate, request access, and execute actions without being a human user. In practice, this includes AI agents, bots, service accounts, tokens, and other machine identities that need clear ownership, scope, and revocation.
- Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
- Refund Fraud: Refund fraud is the misuse of return or reimbursement processes to obtain money, product, or service without a valid basis. It can involve repeated claims, false delivery disputes, partial return manipulation, or fabricated tracking evidence. Effective controls rely on claim history, pattern analysis, and coordination between fraud and customer service teams.
Deepen your knowledge
NHI Mgmt Group's NHI Foundation Level course covers NHI governance, machine identity security, IAM and secrets management in a practitioner-focused format. It helps security and identity teams connect governance decisions to the broader programmes they run.
Published by the NHIMG editorial team on October 27, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org