Notifications
Clear all
Topic starter
19/08/2026 3:27 pm
TL;DR: ATO volumes fell 7% last quarter, according to Sift, but successful breaches drove downstream chargebacks up 75.6% as attackers shifted from noisy credential stuffing to slower post-login abuse. The real control gap is continuous session risk management, because authentication alone does not govern what happens after an account is already trusted.
NHIMG editorial — based on content published by Sift: Account Takeover: How to Stop Account Takeover and Post-Login Abuse
By the numbers:
- Successful breaches caused downstream fraudulent chargebacks to explode by 75.6% quarter-over-quarter.
- Account takeover attack volumes actually dropped 7% last quarter.
- Sift’s Q2 2026 Digital Trust Index found that ATO attempts climbed 7% quarter over quarter.
Questions worth separating out
Q: What breaks when account takeover controls focus only on login security?
A: Controls break after authentication, when a fraudster inherits an already trusted account and starts changing device, IP, contact details, and transaction patterns.
Q: Why do trusted sessions create more risk than failed logins?
A: Because failed logins are noisy and visible, while trusted sessions let attackers operate inside normal workflows.
Q: How should security teams decide when to step up a trusted session?
A: Step up when the user moves into a high-risk action such as adding a payee, changing payout details, resetting a password, inviting an admin, or exporting data.
Practitioner guidance
- Map high-risk post-login actions by account type Identify the actions that create loss in each journey, including payout changes, password resets, new payee setup, bonus claims, admin invites, and data exports.
- Unify session telemetry into a single risk decision Combine device reputation, behavioural patterns, velocity, and account history so the risk score can change after authentication.
- Harden account recovery and payout-change flows Treat password resets, shipping address updates, payout destination edits, and user invitations as privilege-bearing events.
What's in the full article
Sift's full blog post covers the operational detail this post intentionally leaves for the source:
- Workflow logic for scoring and routing suspicious sessions across different account states and fraud thresholds
- Segment-specific abuse patterns for e-commerce, marketplaces, iGaming, and SaaS that help teams tune controls by business model
- Examples of how Dynamic Friction and analyst queues are used to balance customer experience with intervention
- A closer look at the signals behind the Sift Score and how they update as a session changes
👉 Read Sift's analysis of account takeover and post-login abuse →
Account takeover and post-login abuse: where should teams focus?
Explore further
19/08/2026 4:11 pm
Post-login abuse is the real account takeover control gap: authentication checks can succeed while the account is still fully compromised. The article shows that attackers no longer need to win at login if they can simply wait inside a trusted session and act later. For identity and fraud programmes, the governance boundary has moved from sign-in to every high-risk action that follows, which means session-aware controls now matter as much as credential checks.
A question worth separating out:
Q: Who should own account takeover response when identity and fraud signals overlap?
A: Ownership should be defined before an incident, because ATO sits between identity, fraud, and customer support workflows. IAM teams usually own assurance and policy, while fraud teams own investigation and monetary impact. The key is a documented escalation path that connects the two so suspicious sessions are triaged consistently and quickly.
👉 Read our full editorial: Account takeover is a post-login abuse problem, not a login problem
