Payment fraud detection is becoming an identity problem

At a glance

What this is: Fingerprint argues that payment fraud has become an identity problem because fraudsters now blend stolen, synthetic, and hijacked identities into normal transaction flows.

Why it matters: That matters to IAM and fraud teams because effective controls now depend on proving identity continuity at transaction time without creating false declines or checkout friction.

By the numbers:

• E-commerce businesses alone lose an estimated $48 billion annually to fraudulent transactions, according to Fingerprint.
• Online merchants are projected to face cumulative losses of more than $340 billion between 2023 and 2027, according to Fingerprint.
• Banks and payment providers may see annual fraud losses exceed $40 billion by 2027, according to Fingerprint.
• Fingerprint says its platform uses more than 100 device and browser signals to detect suspicious behaviour.

Context

Payment fraud is no longer just a transaction-quality problem. It is an identity governance problem because the attacker model now includes stolen, synthetic, and hijacked identities that can look operationally legitimate at the point of payment.

That shift matters to IAM, fraud, and checkout teams because controls built around static account checks or single-event scoring struggle when the same person, device, or session can be made to look trustworthy long enough to clear the payment flow.

Key questions

Q: What breaks when payment fraud controls rely only on the transaction itself?

A: Controls fail when they treat the payment as isolated from the actor behind it. Fraudsters can reuse stolen, synthetic, or hijacked identities, making a transaction look normal while the surrounding identity context remains adversarial. Strong programmes connect device, behaviour, and account history so approval decisions reflect continuity, not just a momentary score.

Q: Why do stolen and synthetic identities increase false confidence in payment approval flows?

A: Because they preserve enough familiar attributes to pass shallow checks. A valid address, a reused device pattern, or a hijacked account can look trustworthy even when the underlying identity is fabricated or abused. Teams need layered identity signals so one believable attribute does not carry the whole approval decision.

Q: How do security teams know whether fraud controls are too strict or too loose?

A: Measure both fraud loss and false-decline impact together. If chargebacks fall but conversion and customer complaints rise sharply, the control is overcorrecting. If approvals stay high while ATO, card testing, or promotion abuse continues, the threshold is too permissive. The right setting is the one that matches business risk appetite.

Q: What should organisations do when payment fraud and IAM overlap in the same journey?

A: Assign shared ownership for identity signals used in checkout, account recovery, and payment approval. IAM teams should govern identity assurance, while fraud teams tune risk response, but both need the same telemetry and review criteria. Otherwise the programme will split responsibility and miss the moment when identity abuse becomes payment loss.

Technical breakdown

Why identity signals matter more than transaction signals

Payment fraud detection works best when it can connect a transaction to a stable visitor or account pattern, not just to a card number or order value. Device intelligence, behavioural analytics, and global data networks create that continuity by linking sessions, browser traits, velocity, and risk history. The practical problem is that fraudsters now reuse real addresses, residential proxies, and hijacked accounts, so a clean-looking transaction can still be adversarial. In IAM terms, the question is whether the system can tell who or what is acting, not only whether the payment itself looks plausible.

Practical implication: Treat identity continuity as a required input to payment risk scoring, not as a separate fraud-team concern.

How stolen, synthetic, and hijacked identities bypass controls

Stolen credentials, synthetic identities, and account takeover all exploit different weak points, but they converge on the same outcome: a transaction that appears to come from a legitimate actor. Card testing can validate stolen payment details at scale, while ATO uses an already trusted account to bypass friction and trigger stored-payment abuse. Synthetic identity blends real and fake attributes so traditional pattern checks see enough consistency to pass. This is why purely rules-based systems degrade over time. The adversary is not trying to beat every control at once; they only need one path that preserves enough normality to clear checkout.

Practical implication: Map fraud controls to identity abuse modes, then test whether any single trusted attribute can still carry an attacker through approval.

The friction and false-decline problem is now a governance issue

Fraud controls sit inside a business trade-off, not outside it. Overly aggressive rules create false declines, customer frustration, and lost revenue, while looser rules invite chargebacks and account abuse. That makes policy design a governance question as much as a detection question, because the organisation must decide where to absorb risk, where to step up verification, and how much uncertainty to tolerate. In practice, the control failure is often not absence of tooling but misalignment between risk appetite and customer experience. The strongest programmes are the ones that calibrate intervention to risk context rather than applying the same threshold everywhere.

Practical implication: Set explicit friction thresholds by transaction type and customer risk profile so fraud prevention does not become indiscriminate denial.

Threat narrative

Attacker objective: The attacker wants to convert identity ambiguity into approved transactions, monetising fraud while avoiding detection long enough to cash out.

1. Entry occurs through stolen card details, synthetic identity construction, or account takeover that makes the first transaction look legitimate.
2. Credential or identity abuse then allows card testing, stored-payment misuse, or promotion exploitation to proceed through normal payment flows.
3. Impact comes in the form of chargebacks, fee leakage, operational overhead, and customer trust erosion as fraud scales across channels.

Breaches seen in the wild

• Arup deepfake fraud 2024: Deepfakes of Arup's CFO and colleagues on a video call led a Hong Kong employee to transfer HK$200 million (about US$25.6m) to fraudsters.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Payment fraud is increasingly an identity continuity problem. The article shows that the decisive question is no longer whether a transaction looks unusual in isolation, but whether the actor behind it can sustain a believable identity across sessions, devices, and payment steps. That shifts the control discussion from point-in-time scoring to continuity validation. For practitioners, the takeaway is that fraud and identity teams now share the same failure surface.

Persistent identity signals are becoming the operational boundary between legitimate reuse and attacker reuse. When fraudsters can carry the same behavioural and device characteristics across many attempts, static account checks lose value quickly. Persistent visitor identification, device intelligence, and cross-session risk history create a higher-friction environment for attackers without requiring every checkout to become a manual review event. Practitioners should treat signal persistence as a governance control, not only a detection feature.

The core governance failure is assuming customer behaviour is stable enough to score once. Payment fraud adapts faster than any single rule set, so controls that only inspect the current transaction miss the surrounding identity context. That is why the balance between false declines and missed fraud is now a policy design issue, not just a tooling issue. Teams should align fraud thresholds to business risk appetite and identity assurance requirements together.

Identity-based fraud controls need to be evaluated like access controls. If a system cannot explain why one returning visitor is treated as trusted and another as risky, the programme lacks governance discipline. The right question is not whether fraud stops entirely, but whether the approval path is defensible, consistent, and resilient when adversaries reuse legitimate-looking identity attributes. Practitioners should tie fraud policy to accountable control ownership.

Named concept: identity continuity at checkout. This article sharpens the idea that payment security now depends on proving the same actor remains the same actor across the whole transaction journey. That concept matters because it bridges IAM, fraud prevention, and customer experience in one control problem. Practitioners should design for continuity, not only for anomaly detection.

From our research library:

• Authorised push payment (APP) fraud is projected to cause global losses of US$331 billion by 2027.

What this signals

Identity continuity is becoming the deciding control in payment flows. Organisations that still treat fraud as a purely transactional problem will miss the point where account takeover, device reuse, and behavioural mimicry converge. The control question is whether a merchant can prove the same actor is still present across the session, not whether the current order looks plausible.

Payment fraud teams now need IAM-grade governance thinking. Risk scoring alone does not solve the underlying issue when attackers can borrow legitimate-looking identity attributes. Practitioners should align fraud policy, step-up logic, and account recovery controls so the payment path and the identity path are governed together.

For practitioners

• Define identity continuity thresholds Set explicit criteria for when a returning visitor, device, or account is considered continuous enough to approve without extra friction. Use those thresholds to separate low-risk reuse from suspicious reuse across checkout, refunds, and account changes.
• Correlate device and behaviour signals Combine device intelligence, velocity, browser traits, and session behaviour so that suspicious reuse is visible even when the payment instrument looks valid. Avoid relying on any single signal, especially one that can be copied or proxied.
• Tighten controls around high-risk transaction paths Apply stronger review or step-up logic to card testing, account takeover, promotion abuse, and high-value refund flows because those are the points where identity deception most often converts into loss.
• Calibrate friction to customer risk Document where false declines are acceptable, where they are not, and which customer segments warrant heavier scrutiny. Review those thresholds against chargeback rates and conversion impact on a regular basis.

Key takeaways

• Payment fraud now exploits identity ambiguity, not just payment weaknesses, which makes continuity across device, session, and account more important than one-off scoring.
• The scale of the problem is large enough to affect revenue, operations, and customer trust, so false declines and missed fraud must be managed as a single governance trade-off.
• The strongest controls combine identity signals with transaction analysis so approval decisions reflect who is acting, not only what the order looks like.

Key terms

• Identity Continuity: Identity continuity is the ability to preserve a workload’s verified identity across proxies, services, and other infrastructure boundaries. It matters because zero trust breaks down when a request loses its original proof of identity and falls back to network trust or header-based assumptions.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Synthetic Identity: A synthetic identity is a software-based actor that can authenticate, request access, and execute actions without being a human user. In practice, this includes AI agents, bots, service accounts, tokens, and other machine identities that need clear ownership, scope, and revocation.
• False decline: A false decline is a legitimate transaction that is rejected because the fraud controls interpret it as risky. It matters because the operational cost is not limited to one lost sale. It can also damage customer trust, reduce retention, and distort fraud programme metrics.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, human identity, and secrets management in practical terms. It gives security and IAM practitioners a shared language for governing identity risk across modern programmes.