Holiday fraud shifts earlier as automation overwhelms retail controls

At a glance

What this is: Kasada says 2025 holiday fraud will start earlier, scale faster and rely more on automation, with pre-built configs, account takeover, gift card abuse and AI-driven bots shaping the threat picture.

Why it matters: IAM, fraud and security teams need to treat holiday traffic as an identity and automation problem, because the attack window now begins before peak shopping days and spans logins, APIs, accounts and payment flows.

By the numbers:

• Kasada says genAI traffic is predicted to grow 520% in the 10 days leading up to Thanksgiving.
• Kasada observed a 92% increase in malicious configurations targeting retail between January and October 2025.
• Kasada observed a 400% increase in malicious configurations targeting accommodation between January and October 2025.

Context

Holiday fraud now behaves like an identity lifecycle problem with a market layer attached. Attackers are preparing configs, accounts and bot infrastructure before peak demand begins, which means traditional event-week monitoring arrives after the attacker has already rehearsed the campaign.

The operational gap is not just detection speed. It is the mismatch between static controls and adaptive fraud operations that can shift between bots, humans and agents in the same shopping journey. Fraud and cyber convergence matters here because the response has to join telemetry, case management and ownership across teams.

Key questions

Q: What breaks when fraud controls are too rules-based during seasonal shopping spikes?

A: Rules-based fraud controls lose accuracy when peak traffic changes the normal behaviour baseline. Legitimate last-minute shoppers can look unusual, while fraudsters blend into the surge. The practical fix is to combine transaction rules with identity-based clustering, account history, device stability and network context so teams can distinguish real seasonal urgency from coordinated abuse.

Q: Why does account takeover risk rise before Black Friday?

A: Because compromised accounts are most valuable before peak shopping days, when they still hold payment methods, loyalty points, carts and gift card value. Criminals also want time to resell or reuse those accounts before victims invalidate them. The fraud is timed for maximum monetisation, not just access.

Q: What are the signs that bot mitigation is failing against agentic AI?

A: The usual markers become less reliable. Traffic may look slower, more variable and more human, while still performing automated account creation, scraping or checkout at scale. If your controls rely mainly on speed thresholds or uniform behaviour, they will miss high-entropy agents that blend into normal customer patterns.

Q: Should fraud, IAM and security teams share holiday traffic signals?

A: Yes. Holiday abuse now crosses login, API, cart, gift card and resale stages, so isolated queues create blind spots. Shared signals let teams connect repeated infrastructure, suspicious devices and post-compromise marketplace activity, which shortens triage and makes it harder for the same actor to move across channels unnoticed.

Technical breakdown

Why pre-built configs change the fraud timeline

Pre-built configs are reusable attack packages that encode settings for credential stuffing, scraping or automated checkout. They let operators scale quickly, test infrastructure ahead of a sale, and then resell working configurations to other actors. That changes the fraud timeline because the meaningful activity starts before the public event, when defenders are still waiting for a visible spike. The control problem is not only volume, but the attacker’s ability to rehearse, tune and distribute automation before the main traffic surge.

Practical implication: Baseline traffic earlier and hunt for preparation activity, not only for peak-day abuse.

How account takeover blends with holiday commerce

Account takeover in this pattern is a monetisation pipeline, not a single login event. Criminals target accounts before high-value shopping windows because those accounts may contain stored payment methods, loyalty points, carts and gift cards. Once access is gained, the account is quickly reused, resold or turned into a fraud primitive for later abuse. This is why credential reuse, repeated incidents from the same infrastructure and rapid resale are all part of the same campaign structure. Read Top 10 Online Fraud Attacks.

Practical implication: Treat repeated login abuse as an ongoing campaign and correlate it with post-compromise market activity.

Why agentic AI makes bot detection harder

Traditional bot controls often depend on speed, repetition and obviously scripted behaviour. Agentic AI can introduce delays, variability and pseudo-human mistakes that defeat those signals while still acting at machine scale. In retail, those agents can also bypass the front end and query backend APIs directly for inventory or pricing, shifting the control point away from browser checks. The result is a higher-entropy interaction model where traffic classification, not just rate limiting, becomes the core challenge. See the Bot Management Guide.

Practical implication: Move detection to behaviour, API access patterns and adaptive scoring rather than simple velocity thresholds.

Threat narrative

Attacker objective: The objective is to monetise high-value holiday traffic by turning accounts, gift cards and automated checkout capacity into rapid fraud revenue.

1. Entry begins with credential stuffing, bot-assisted account creation or scraped configurations that prepare access before the sale period.
2. Credential access turns into account takeover, gift card checks or marketplace resale once stolen credentials or valid sessions are obtained.
3. Escalation happens when attackers reuse infrastructure, adapt scripts and push automation into APIs and checkout flows at scale.
4. Impact is measured in fraudulent purchases, resale of compromised accounts, gift card abuse and higher operating costs from serving malicious traffic.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
• CISA Private-CISA GitHub leak 2026: A CISA contractor's public GitHub repo exposed AWS GovCloud admin keys, Artifactory credentials and plaintext passwords for six months.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Holiday fraud is now an identity-and-automation supply chain, not a point-in-time event. The article shows attackers preparing configs, accounts and bot infrastructure before the peak shopping window, then monetising those assets as the event begins. That means the real control boundary sits earlier than most teams plan for, in inventorying automation, validating login behaviour and coordinating fraud with security operations. Practitioners should treat the pre-event phase as part of the attack surface.

Adaptive automation is the named concept shaping this threat cycle. The article describes attackers using AI to add variance, delay and human-like error into bot activity, which undermines controls built around obvious machine speed. This is not just a retail nuisance, it is a governance problem because detection thresholds, queueing logic and customer protection workflows all assume stable behaviour. Practitioners should expect the control gap to widen where teams still classify traffic by pattern simplicity alone.

Retail fraud teams need a shared control model for accounts, APIs and marketplace intelligence. The article makes clear that account takeover, gift card abuse and bot traffic are linked stages in one monetisation chain. Fraud and cyber convergence is therefore not optional, because the same actor can move from login abuse to API abuse to resale in one campaign. Practitioners should align telemetry, triage and ownership across those stages rather than handling them as separate queues.

API exposure is now part of the fraud path, not only the application path. The article notes that agents and bots bypass the front end to query backend services for inventory and pricing, which shifts abuse away from human-facing controls. That means rate limiting alone will not hold if authentication, entitlement checks and anomaly scoring are weak at the API layer. Practitioners should govern API access as a fraud control surface, not just a technical integration layer.

From our research library:

• Sophisticated multi-step fraud rose 180%, according to Sumsub's Identity Fraud Report 2025-2026.

What this signals

Adaptive automation will keep eroding simple bot rules. The more attackers can vary timing, device signals and request shape, the less value there is in controls that only look for consistency. The programme implication is that holiday readiness has to shift toward behavioural scoring, API scrutiny and faster cross-team escalation.

Holiday fraud is becoming a governance problem as much as a detection problem. Teams that own accounts, fraud, apps and infrastructure often measure success separately, but the article shows the threat chain crossing all three. The practical response is to set shared thresholds for suspicious login activity, resale patterns and API abuse before the seasonal peak arrives.

For practitioners

• Start fraud monitoring two weeks earlier Baseline legitimate traffic before mid-November so you can spot pre-event validation, scraping and login anomalies before the holiday surge begins.
• Harden account login controls for high-risk sessions Use adaptive MFA and device-aware anomaly detection for logins tied to new devices, automation or repeated credential abuse.
• Defend checkout and inventory APIs directly Apply authentication, rate controls and anomaly scoring at the API layer because many bots will bypass the browser entirely.
• Unify fraud and security case handling Merge bot telemetry, ATO signals and fraud complaints into one triage view so repeated incidents from the same infrastructure are easier to correlate.
• Track criminal marketplace activity Watch for config sales, stolen account listings and brand mentions to identify campaigns before they peak on sales days.

Key takeaways

• Holiday fraud now starts before the peak sales window, so teams that wait for event-week spikes will miss the preparation phase.
• The article ties account takeover, gift card abuse and bot traffic to one monetisation chain, which means the same actor can move across channels quickly.
• Defence has to shift toward earlier baselining, API-layer controls and shared fraud-security operations if organisations want to keep pace with adaptive automation.

Related NHI Mgmt Group resources: Fraud and Cyber Convergence Guide · Top 10 Online Fraud Attacks · Top 10 Cloud Security Risks · Bot Management Guide

Key terms

• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Credential Stuffing: Credential stuffing is an attack that uses stolen username and password pairs from previous breaches to try logging into other services. It works because many people reuse credentials, and because the login attempt uses valid information, it can look ordinary until the surrounding behavior gives it away.
• Bot Traffic: Automated requests generated by software rather than a human operator. Bot traffic can mimic user behaviour closely enough to abuse login, registration, booking, scraping, or transaction workflows while avoiding traditional human-centric detections.
• Gift Card Fraud: Gift card fraud is the use of stolen payment data, manipulated identities, or social engineering to buy gift cards online for quick resale or spending. Because gift cards are instantly redeemable and difficult to reverse, the fraud window is short and the financial loss often materializes before a merchant can intervene.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity and secrets management. It helps practitioners connect identity controls to the broader security and fraud pressures their programmes already face.