Topic starter
12/07/2026 12:25 pm
TL;DR: Account takeover is accelerating, with 83% of organisations seeing at least one incident in 2025 and projected losses reaching $17 billion, according to Sift. Static authentication and periodic tuning are no longer enough when attackers can continuously optimise behaviour, while agentic AI is helping fraudsters imitate users and adapt in real time.
Editorial analysis by NHI Mgmt Group, based on content published by Sift: “Inside the Rise of ATO: How Agentic AI Is Rewriting the Rules of Digital Trust”.
By the numbers:
- 83% of organizations experienced at least one account takeover incident in 2025, according to Sift.
- Projected account takeover losses are climbing to $17 billion, up from $13 billion last year, according to Sift.
Key questions
Q: What fails when account takeover defence relies on static login controls?
A: Static login controls fail when attackers can vary devices, timing, and request patterns faster than the policy can react.
Q: Why do AI tools make account takeover harder to stop?
A: AI helps attackers vary timing, language, and transaction patterns at scale, which weakens controls that depend on predictable fraud signatures.
Q: What are the signs that account takeover detection is failing in practice?
A: Warning signs include login activity that still looks normal to legacy tools, repeated access from compromised accounts with a positive customer history, and fraud that appears only after unauthorized transactions or profile changes.
Practitioner guidance
- Separate login assurance from session assurance Use different decision points for initial access, ongoing session trust, and high-risk actions such as account recovery or payment changes.
- Instrument behavioural trust signals Correlate device movement, timing patterns, and action sequencing so that the system can detect users whose behaviour shifts away from normal.
- Add intent checks before sensitive actions Require stronger verification before loyalty redemptions, payout changes, password resets, and other actions that convert access into loss.
Bottom line: Account takeover is no longer limited to credential theft, because attackers can use AI-assisted mimicry to keep fraud looking legitimate after login.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:38 pm
Account takeover is now a trust orchestration problem, not just an authentication problem. The article shows that attackers are moving from one-time login compromise to continuous adaptation across the full user journey. That means the control plane must track identity confidence after authentication, not just before it. Practitioners should treat account trust as a lifecycle state that can rise and fall during the session.
A few things that frame the scale:
- 67% of organisations still rely heavily on static credentials despite the risks they pose to agentic AI deployments, according to the 2026 Infrastructure Identity Survey.
- Only 13% of organisations feel extremely prepared for the reality of agentic AI despite the majority racing toward autonomous adoption, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should teams respond when account compromise leads to payment abuse or loyalty theft?
A: Teams should treat the compromise as a lifecycle event, not a single incident. Contain the active session, block further high-risk actions, review linked recovery paths, and assess whether the same behavioural pattern is moving across other accounts. The goal is to stop monetisation, not just reset the password.
👉 Read our full editorial: Account takeover is being reshaped by agentic AI and adaptive fraud