Valentine’s Day fraud spikes expose identity signals retailers miss

At a glance

What this is: Riskified shows that Valentine’s Day creates a fraud spike because holiday traffic, gift cards and unfamiliar customer profiles make identity signals harder to interpret.

Why it matters: Retail and fraud teams need to tune controls for seasonal identity ambiguity, or they risk missing account takeover, gift card abuse and false positives on legitimate shoppers.

By the numbers:

• The National Retail Federation predicts Valentine’s Day spending will reach a record $29.1 billion in 2026.
• Daily fraudulent order volume reaches its monthly high on February 14, 35 percent above the monthly average.
• Risk levels for new customers on February 14 are 8 percent higher than the average observed in the prior two weeks.

Context

Valentine’s Day fraud is a seasonal identity problem as much as a payments problem. When order volumes rise quickly, the signal that helps teams distinguish a legitimate last-minute shopper from a fraudster becomes noisier, especially for new customers, gift cards and account takeovers.

Rules that work in calmer periods often struggle when urgency, novelty and promotional traffic compress the decision window. That makes behavioural clustering, device and network context, and account-history interpretation more valuable than static policy thresholds for fraud teams and identity-adjacent controls.

Key questions

Q: What breaks when fraud controls are too rules-based during seasonal shopping spikes?

A: Rules-based fraud controls lose accuracy when peak traffic changes the normal behaviour baseline. Legitimate last-minute shoppers can look unusual, while fraudsters blend into the surge. The practical fix is to combine transaction rules with identity-based clustering, account history, device stability and network context so teams can distinguish real seasonal urgency from coordinated abuse.

Q: Why are gift cards a higher fraud risk than many physical goods?

A: Gift cards are easier to monetise quickly, require less fulfilment data, and often bypass shipping-based verification. That removes several of the strongest fraud signals, so teams need stronger account, device, and payment correlation before approving digital value purchases.

Q: How can retailers tell legitimate holiday shoppers from account takeover activity?

A: The strongest approach is to compare the transaction against the customer’s usual identity pattern, not just the item being bought. Stable device history, familiar payment behaviour, consistent recipient domains and low proxy use all support legitimacy. Sudden changes across several of those signals are more useful than any single red flag on its own.

Q: Should fraud teams prioritise approval rates or tighter declines during holiday peaks?

A: They should optimise for both, but not with a single blunt threshold. Seasonal commerce creates a short window where overblocking damages revenue and customer trust, while underblocking invites abuse. The best balance comes from targeted controls that focus scrutiny on risky identity patterns and keep low-risk holiday shoppers moving through checkout.

Technical breakdown

Why seasonal traffic weakens fraud decisioning

Seasonal peaks compress the time available to assess trust. In fraud operations, a last-minute holiday order may look similar to a stolen-account purchase because both can involve urgency, unfamiliar shipping or recipient details, and atypical behaviour. Traditional rules work by matching known patterns, but peak events change the baseline so quickly that false positives and false negatives both rise. Identity-based clustering uses linked behaviour across accounts, devices, payment instruments and network signals to infer whether activity belongs to the same real-world actor. That is especially useful when customer profiles are sparse or when attackers deliberately blend into a high-volume retail event.

Practical implication: Treat peak-season fraud review as a context problem and enrich scoring with cross-account behavioural linkage, not only static rules.

Gift card abuse and account takeover in holiday commerce

Gift cards are attractive to fraud rings because they convert stolen value into instantly usable funds with little fulfilment friction. They also remove some of the data points defenders usually rely on, such as shipping address checks or delivery anomaly signals. When attackers hijack older customer accounts to buy gift cards, they inherit trust from account history while introducing subtle anomalies such as proxy use, unfamiliar recipient domains, or odd messaging patterns. That combination is difficult for rules to catch unless the fraud stack joins identity history with transaction intent and channel telemetry. The control challenge is not just blocking gift cards, but recognising when they are being used as cash-out instruments.

Practical implication: Add specific takeover and cash-out detection logic for gift cards, including account history checks and proxy or domain anomaly review.

Identity signals matter more than order content

The article’s central operational lesson is that what a shopper buys is less important than how the buying pattern fits the broader identity graph. A genuine customer may purchase flowers, chocolate or a gift card, but fraud becomes more visible when behaviour diverges from the customer’s established network of devices, payment methods, recipients and session traits. This is where identity verification and fraud prevention intersect: the point is not to prove a person’s name, but to judge whether the transaction behaviour is consistent with the claimed customer identity. That distinction matters most during holiday surges, when volume alone can hide suspicious activity.

Practical implication: Score holiday transactions against identity consistency signals, not just item type, basket size or checkout speed.

Threat narrative

Attacker objective: Convert stolen payment details or hijacked accounts into quickly monetised value during a period when abnormal activity is easier to hide.

1. Entry begins with account takeover or a payment compromise that gives attackers a foothold in a retail customer account.
2. Credentialed access is then used to place rapid gift card orders or otherwise exploit holiday checkout patterns while hiding inside normal seasonal traffic.
3. The impact is cash-out through resold or spent gift cards, plus revenue loss and customer trust erosion for the retailer.

Breaches seen in the wild

• Malwarebytes breach 2021: SolarWinds attackers added a certificate to a dormant email security app's service principal at Malwarebytes and read internal email via Microsoft Graph.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Seasonal fraud is an identity ambiguity problem, not just a rules problem. Holiday spikes change the behavioural baseline so quickly that static thresholds lose fidelity. When fraud teams rely too heavily on order-level rules, they miss the broader identity context that separates genuine seasonal urgency from coordinated abuse. The practical conclusion is that detection has to move from isolated transaction review to relationship-aware identity analysis.

Gift cards expose a control gap because they collapse fulfilment signals. Physical goods create shipping and delivery friction that can help fraud teams spot anomalies. Digital gift cards remove much of that friction, which makes account trust, recipient domains and network patterns more important than the basket itself. That creates a specific governance issue for identity and fraud programmes: controls built around post-order verification are weaker when the asset is instantly liquid.

Holiday fraud detection needs to absorb identity verification and fraud prevention into one operating model. Retailers cannot treat customer verification and transaction risk as separate disciplines when attackers use account takeover to reach payment conversion. This is where the identity graph becomes operational, because it connects login history, device stability and behavioural consistency across journeys. The practitioner takeaway is to align fraud scoring with identity assurance signals, not just checkout anomalies.

Identity-based clustering is the right named concept for this problem space. The article describes a situation where no single field is decisive, but linked behaviour across accounts, devices and recipients reveals the pattern. That is a governance shift as well as a technical one, because teams need to decide which identity signals are strong enough to override holiday noise. The programme implication is to design controls around relationship strength, not just one-off transaction anomalies.

Retailers should expect fraudsters to exploit legitimate seasonal behaviour more than novel attack mechanics. The strongest abuse patterns are often ordinary actions placed in an abnormal context, which makes them harder to distinguish with blunt policy. That means the most useful improvement is not harsher denial, but better differentiation between genuine and synthetic identity behaviour. Teams that can do that will preserve approval rates while narrowing the fraud window.

From our research library:

• Nearly 60% of companies reported that fraud losses were still increasing in 2025.

What this signals

Seasonal commerce changes the control objective. Retailers do not just need to stop more fraud in February, they need to preserve trust when the customer population becomes noisier and more mixed. That shifts the programme from transaction filtering to identity-aware decisioning, where account age, behavioural continuity and channel context carry more weight.

Identity ambiguity is the central operating risk in holiday fraud. When new customers, gift cards and rush purchases all spike together, the transaction itself becomes a weak indicator of legitimacy. Fraud teams that can link behaviour across sessions and accounts will have a clearer path to reducing both unnecessary declines and missed attacks.

Retail fraud and identity verification are converging operationally. The practical boundary is no longer between checkout and authentication, but between trustworthy behaviour and behaviour that only looks normal in a crowded seasonal market. Teams should expect more value from linked identity signals than from isolated rule tuning.

For practitioners

• Strengthen holiday identity scoring Blend device history, payment continuity, recipient-domain checks and prior account behaviour into seasonal risk scoring so that legitimate late buyers are not treated the same as synthetic or hijacked identities.
• Add gift card abuse controls Treat digital gift card purchases as a distinct cash-out path, with tighter review on newly changed recipient domains, proxy-linked sessions and account takeover indicators.
• Separate genuine surge traffic from takeover patterns Create holiday-specific rules that look for account age, session consistency and unusual recipient patterns rather than relying on basket size or speed alone.
• Review false-positive tolerance before peak season Test how often legitimate Valentine’s shoppers are declined by current thresholds, then adjust decisioning so approval preservation and fraud containment are balanced during short-lived traffic bursts.

Key takeaways

• Valentine’s Day commerce creates a predictable fraud window because urgency, gift cards and new-customer traffic make identity signals harder to interpret.
• Riskified’s analysis shows that fraudulent order volume peaks on February 14 and that new-customer risk rises during the holiday period, reinforcing the need for contextual scoring.
• Retailers should respond with identity-based clustering, account history checks and targeted controls for gift card abuse rather than relying on blunt rule tightening.

Key terms

• Identity-based clustering: Identity-based clustering is a fraud detection approach that links accounts, devices, payment instruments, and behavioural signals to identify related activity. It helps security and fraud teams see patterns that are invisible when each transaction is scored in isolation, especially during high-volume periods.
• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Cash-Out Path: A cash-out path is the route by which stolen value is converted into usable money or liquid assets. Gift cards are a common example because they can be purchased quickly, reused easily and resold with limited friction, making them attractive after compromise or fraud.
• Ownership Ambiguity: Ownership ambiguity occurs when no accountable person or team is clearly responsible for an identity. In machine identity governance, it blocks attestation, delays revocation, and weakens incident response. If nobody can answer who owns the account, the account effectively owns itself, which is a control failure.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. Explore the NHI Foundation Level course, the industry's only accredited NHI security programme, to connect identity governance concepts to the programmes you run.