Identity Beyond IAM - NHIMG Forum https://nhimg.org/community/identity-beyond-iam/ NHIMG Discussion Board en-US Thu, 09 Jul 2026 18:33:52 +0000 wpForo 60 Loyalty fraud detection: are identity controls keeping up? https://nhimg.org/community/identity-beyond-iam/loyalty-fraud-detection-are-identity-controls-keeping-up/ Thu, 09 Jul 2026 15:32:56 +0000

TL;DR: Loyalty accounts are being hacked, traded, and exploited because points now behave like transferable digital currency, while weak passwords, low customer vigilance, and delayed detection let fraud persist for weeks, according to Comarch. The real governance issue is that loyalty programmes were built for engagement, not identity assurance, so fraud controls now have to operate without destroying the user experience.

NHIMG editorial — based on content published by Comarch: LLMjacking and AI-powered fraud detection in loyalty programmes

Questions worth separating out

Q: How should loyalty programmes reduce account takeover risk without hurting the customer experience?

A: Use a risk-based model that adds friction only when behaviour changes.

Q: Why do loyalty accounts need stronger controls than most consumer profiles?

A: Because they hold transferable value, not just personal data.

Q: What do security teams get wrong about loyalty fraud detection?

A: They often assume the customer will notice the problem first.

Practitioner guidance

  • Apply risk-based step-up to redemption flows Require additional authentication for point transfers, high-value redemptions, profile changes, and account recovery so attackers cannot monetise a compromised login in a single session.
  • Segment loyalty accounts by fraud value Prioritise stronger controls for accounts with high balances, frequent transfers, or premium reward access, because those are the profiles most likely to attract abuse.
  • Tune detection around abnormal redemption patterns Monitor for rapid point depletion, login geography shifts, device changes, and repeated failed access attempts, then route those cases to manual review before payout.

What's in the full article

Comarch's full article covers the operational detail this post intentionally leaves for the source:

  • Specific examples of loyalty fraud patterns that MAIA is designed to detect in live programme data.
  • The decision flow for blocking an account, storing transactions, or escalating a case to the Contact Center.
  • How contextual signals and historical behaviour reduce false positives in day-to-day fraud operations.
  • The practical role of AI in supporting fraud teams without replacing human approval.

👉 Read Comarch's analysis of AI-driven loyalty fraud detection and account abuse →

Loyalty fraud detection: are identity controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →

]]> Identity Beyond IAM Mr NHI https://nhimg.org/community/identity-beyond-iam/loyalty-fraud-detection-are-identity-controls-keeping-up/ Email security guidance and password managers: what teams should do https://nhimg.org/community/identity-beyond-iam/email-security-guidance-and-password-managers-what-teams-should-do/ Thu, 09 Jul 2026 15:24:38 +0000

TL;DR: ACSC’s email security guidance stresses MFA, domain protection, email authentication, and limiting exposed personal information, but Bitwarden argues the advice should more directly emphasise strong, unique passwords and password managers to reduce compromise impact. The real governance gap is not awareness alone, but making password hygiene operational and easy to follow.

NHIMG editorial — based on content published by Bitwarden on ACSC email security guidance and password recommendations

Questions worth separating out

Q: How should security teams reduce email account takeover risk?

A: Security teams should combine MFA with strong, unique passwords, password managers, and recovery-path monitoring.

Q: Why do email accounts need stronger controls than ordinary user accounts?

A: Email accounts often sit inside password reset flows, business communications, and identity verification processes.

Q: What do organisations get wrong about password guidance?

A: They often bury the most important advice behind multiple pages or present it as secondary to other controls.

Practitioner guidance

  • Make email accounts high-value identity assets Apply stronger monitoring, recovery protections, and access review to business email accounts because they are commonly used to reset other identities and authorize trust decisions.
  • Standardise unique password use with managers Deploy password managers for staff and contractors, then enforce unique credentials for every service so a single leak does not spread across the account estate.
  • Simplify MFA and password guidance Put MFA, strong passphrases, and password manager guidance on the same primary security page so users do not need to follow a chain of links to find the basics.

What's in the full article

Bitwarden's full blog post covers the operational detail this post intentionally leaves for the source:

  • Bitwarden’s comparison of agency advice versus current NIST-aligned password guidance for everyday users and SMBs
  • The specific reasoning behind its ranking of the ACSC email security guidance
  • The additional resources it points readers to on password security and account protection
  • The broader State of Password Security context it uses to compare security-agency recommendations

👉 Read Bitwarden’s analysis of ACSC email security guidance and password advice →

Email security guidance and password managers: what teams should do?

Explore further

View Full Forum →  |  NHI Foundation Course →

]]> Identity Beyond IAM NHI Mgmt Group https://nhimg.org/community/identity-beyond-iam/email-security-guidance-and-password-managers-what-teams-should-do/ Credential stuffing and password reuse: what do teams need to change? https://nhimg.org/community/identity-beyond-iam/credential-stuffing-and-password-reuse-what-do-teams-need-to-change/ Thu, 09 Jul 2026 15:21:52 +0000

TL;DR: Credential stuffing remains effective because attackers can automate millions of login attempts against reused credentials, and New York’s attorney general found more than one million accounts compromised across 17 well-known companies, according to Bitwarden. Password policy alone is not enough when account takeover can scale faster than user behaviour changes.

NHIMG editorial — based on content published by Bitwarden: State of Password Security and the New York Attorney General's credential stuffing alert

Questions worth separating out

Q: How should security teams reduce credential stuffing risk across user accounts?

A: Teams should reduce credential stuffing risk by combining unique-password enforcement, phishing-resistant MFA, rate limiting, bot detection, and alerting on abnormal sign-in patterns.

Q: Why does password reuse still matter if MFA is enabled?

A: Password reuse still matters because MFA coverage is rarely universal, and some sessions, device flows, or helpdesk processes can be abused around it.

Q: What do security teams get wrong about credential stuffing?

A: Many teams treat credential stuffing as a consumer behaviour problem when it is also an identity control problem.

Practitioner guidance

  • Eliminate password reuse at the identity source Require unique passwords through approved password managers and remove exceptions that allow memorised reuse for privileged or high-risk accounts.
  • Enforce MFA where credential stuffing is most profitable Prioritise phishing-resistant MFA for remote access, administrative accounts, and any account that can initiate payments, data export, or policy changes.
  • Instrument sign-in telemetry for automation patterns Detect rapid retry bursts, distributed login attempts, impossible travel, and repeated failures followed by success.

What's in the full article

Bitwarden's full article covers the practical password security advice and report context this post intentionally leaves at the source:

  • Agency-by-agency scoring and the criteria used to rank federal password guidance
  • The full set of consumer recommendations, including password managers, 2FA, and breach alerts
  • The detailed assessment of where federal advice aligns with NIST guidance and where it falls short
  • Practical examples of how to interpret the New York Attorney General's alert in day-to-day account security

👉 Read Bitwarden's assessment of password security guidance and credential stuffing →

Credential stuffing and password reuse: what do teams need to change?

Explore further

View Full Forum →  |  NHI Foundation Course →

]]> Identity Beyond IAM NHI Mgmt Group https://nhimg.org/community/identity-beyond-iam/credential-stuffing-and-password-reuse-what-do-teams-need-to-change/ AI-resistant challenge design: are your challenge controls keeping up? https://nhimg.org/community/identity-beyond-iam/ai-resistant-challenge-design-are-your-challenge-controls-keeping-up/ Thu, 09 Jul 2026 15:20:50 +0000

TL;DR: Challenge-response systems built around photographic recognition are structurally fragile because modern AI and agentic AI can learn, iterate, and generalise across narrow solving spaces at scale, according to Arkose Labs. The security issue is not just stronger bots, but challenge architecture that still assumes attackers will stay human-speed and human-shaped.

NHIMG editorial — based on content published by Arkose Labs: AI-resistant challenge design and the MatchKey analysis

Questions worth separating out

Q: How should security teams design challenge-response controls against agentic AI automation?

A: They should design for diversity, not just difficulty.

Q: Why do photographic CAPTCHAs fail against modern AI-driven abuse?

A: They fail because image-recognition tasks sit inside the capability range of widely available vision models.

Q: How do teams know whether an anti-bot control is actually working?

A: They should look beyond pass or fail rates and examine campaign adaptation, retry patterns, and how quickly attackers improve after feedback.

Practitioner guidance

  • Audit challenge solving space breadth Test whether your current challenge design relies on a narrow set of photographic or classification tasks that a pretrained model can learn cheaply.
  • Measure resilience against adaptive automation Run red-team simulations where an autonomous solver receives feedback across multiple sessions and adjusts strategy without human intervention.
  • Treat interaction behaviour as an identity signal Correlate challenge outcomes with behavioural texture inside the session, especially when device fingerprint, IP reputation, or token context already appear trustworthy.

What's in the full article

Arkose Labs' full analysis covers the operational detail this post intentionally leaves for the source:

  • The session telemetry and attacker-behaviour patterns behind MatchKey's design choices.
  • The specific reasoning tasks and challenge formats used to widen the solving space.
  • The adversarial testing approach used to evaluate current multimodal model performance.
  • The implementation detail behind attacker-cost modelling and control tuning.

👉 Read Arkose Labs' analysis of AI-resistant challenge design and agentic AI abuse →

AI-resistant challenge design: are your challenge controls keeping up?

Explore further

View Full Forum →  |  NHI Foundation Course →

]]> Identity Beyond IAM NHI Mgmt Group https://nhimg.org/community/identity-beyond-iam/ai-resistant-challenge-design-are-your-challenge-controls-keeping-up/