Identity threat taxonomy clarifies fraud paths in account takeover

At a glance

What this is: This is Ping Identity's explanation of an identity threat taxonomy for account takeover and new account fraud, with the key finding that attackers keep changing techniques but still rely on identity to gain access.

Why it matters: It matters because IAM, fraud, and identity teams need to map threats across the full identity journey, not treat account takeover as a single control problem.

Context

Account takeover and new account fraud are identity problems because the attacker’s objective is to pass through authentication, enrolment, or account recovery and then use that access to monetise an account or move funds. When fraud tactics change, the control gap is often not the individual safeguard but the lack of a joined-up view of the attack sequence.

A threat taxonomy gives teams a way to organise related fraud behaviours into a logical sequence. In practice, that matters for IAM and fraud programmes because detection, step-up controls, and recovery checks need to be aligned across the journey, not deployed as isolated responses to a single event.

Key questions

Q: How should security teams reduce account takeover risk in digital identity programmes?

A: They should treat takeover as a lifecycle problem, not only an authentication problem. Strengthen proofing, step-up checks, recovery flows, and transaction approval so that a valid session does not automatically equal a trusted action. The strongest programmes align identity assurance with the value of the action being protected.

Q: Why do account takeover and new account fraud need to be managed together?

A: Because both depend on the organisation accepting identity evidence at a decision point, just at different stages of the lifecycle. ATO targets established accounts, while NAF targets the trust granted during creation. Treating them separately hides shared weaknesses in identity proofing and authentication.

Q: What are the signs that a fraud prevention programme is too isolated to work effectively?

A: A weak programme usually shows up when fraud claims stay trapped in one team, when customer service cannot escalate cases cleanly, or when legal and finance only get involved after damage is already visible. Another warning sign is when fraud is discussed as an obscure function instead of a business-wide risk that affects operations and reputation.

Q: How should teams decide where to place stronger identity checks?

A: Place stronger checks at the points where the attacker can change the outcome, especially enrolment, recovery, and high-value transactions. The right choice is where identity trust converts most directly into account control or financial loss.

Technical breakdown

Why identity is the access path in account takeover

Account takeover succeeds when an attacker can present enough identity evidence to cross an authentication or recovery boundary, then operate as the legitimate account holder. In fraud terms, the identity layer is not just a login gate. It is the route into stored value, payment instruments, and account privileges. That is why ATO and new account fraud often share the same underlying control problem: weak trust in identity signals across onboarding, login, and recovery. A programme that only protects the login screen misses the broader identity journey where the attacker actually wins.

Practical implication: Treat the identity journey as the attack surface, not just the login event.

What an identity threat taxonomy does for fraud defence

A threat taxonomy groups related attack behaviours into a logical sequence, which helps security and fraud teams see how one tactic leads to the next. Instead of treating phishing, credential abuse, recovery abuse, and monetisation as separate problems, the taxonomy connects them into a single threat path. That is useful because different teams often own different parts of the path, yet the attacker experiences only one continuous workflow. The practical value is prioritisation: teams can map where identity controls interrupt the sequence and where blind spots remain.

Practical implication: Use the taxonomy to align controls across onboarding, authentication, recovery, and transaction abuse.

Why adaptive fraud breaks control-by-control thinking

Adaptive fraud means the attacker changes methods when one path stops working. That makes static control lists less effective because the real risk is not one technique but the ability to switch techniques without losing momentum. For identity teams, the key design issue is whether a control can detect intent and sequence, not only a single suspicious action. A threat prevention strategy should therefore look for correlated signals across identity events, device context, and account behaviour. That is how teams move from point detection to pattern recognition.

Practical implication: Build detections around sequences and correlation, not single indicators alone.

Breaches seen in the wild

• Gitloker GitHub extortion campaign: Phishing via GitHub notifications tricked developers into authorising malicious OAuth apps; Gitloker then wiped repos and demanded contact.
• 23andMe credential stuffing 2023: Credential stuffing into 18,000 accounts exposed nearly 7 million people through the DNA Relatives feature.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity threat taxonomies are a governance tool, not just a fraud diagram. The value of a taxonomy is that it forces teams to describe how identity abuse progresses across onboarding, authentication, recovery, and monetisation. That creates a shared language between IAM, fraud operations, and security architecture. Without that shared model, controls are usually deployed in silos and the attacker simply routes around them. The implication is that identity programmes need threat sequencing as a planning input, not an after-the-fact reporting aid.

Account takeover and new account fraud are usually the same identity failure seen at different points in the journey. ATO exploits established accounts, while NAF exploits the trust placed in newly created ones. Both depend on the organisation accepting weak or incomplete identity evidence at a decision point. That means fraud strategy should not over-separate authentication risk from enrolment risk. Practitioners should treat them as linked governance problems across the same identity trust model.

Identity threat protection has to follow attacker adaptation, not fixed control categories. The article’s core point is that fraudsters move when one method fails. That means programmes that measure only individual control coverage can miss the bigger problem: the attacker’s ability to change paths without changing objective. A useful taxonomy makes that adaptation visible and keeps priority on the parts of the journey where identity trust is being traded for convenience.

Stored value and financial movement turn identity compromise into business loss. When the account contains a payment method or is connected to a financial institution, the fraud outcome is no longer just unauthorised access. It becomes direct monetisation. That raises the importance of identity signals that can distinguish legitimate user behaviour from account abuse before funds or stored payment value are exposed. Practitioners should tune protection to the value behind the identity, not only the identity event itself.

From our research library:

• Sumsub's Identity Fraud Report 2025-2026 recorded an overall fraud rate of 2.2% across verified accounts in 2025, and multi-step identity fraud rose from 10% of attacks in 2024 to 28% in 2025.

What this signals

Identity threat sequencing is the missing layer in many fraud programmes. Teams that only track isolated events tend to miss how an attacker moves from initial access to monetisation. A sequence-based model makes the control gaps visible across authentication, recovery, and payment abuse.

Stored-value accounts deserve higher identity scrutiny than ordinary sessions. When an account can be monetised directly, compromise turns into immediate loss rather than abstract exposure. That shifts the programme from passive detection to proactive protection at the trust boundaries that matter most.

For practitioners

• Map fraud paths across the identity journey Document how account takeover and new account fraud move through onboarding, authentication, recovery, and monetisation so each control point is visible in one sequence.
• Correlate identity and behaviour signals Combine login, device, recovery, and transaction indicators so one suspicious event is evaluated in the context of a broader attack path.
• Separate trust decisions by journey stage Use different trust thresholds for enrolment, authentication, and account recovery because the evidence available at each stage is not the same.
• Review controls for stored-value accounts Prioritise accounts that can be monetised directly, such as those with stored payment methods or financial transfer capability, because the impact of takeover is immediate.

Key takeaways

• Fraud defence weakens when account takeover and new account fraud are treated as separate problems instead of connected identity journeys.
• The article’s central message is that attackers adapt their methods, so a single control rarely stops the full path to monetisation.
• Teams need correlated identity signals and stage-specific trust decisions to interrupt fraud before access turns into financial loss.

Key terms

• Identity Threat Taxonomy: A structured way to group identity-related attack behaviours into related stages and patterns. It helps defenders understand how fraud unfolds across enrolment, authentication, recovery, and monetisation, so controls can be assigned to the right part of the identity lifecycle.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• New Account Fraud: New account fraud is the creation or takeover of a fresh identity during enrolment so an attacker can establish trust and later abuse it. It often exploits weak identity proofing, poor anti-abuse controls, or gaps between registration, verification, and first use.
• Identity Journey: An Identity Journey is the full sequence of authentication and authorization steps a person or machine follows to gain access to a service. It can include signup, login, MFA, recovery, step-up verification, and policy checks, all of which should be designed and governed as one control flow.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.