Topic starter
10/07/2026 9:22 pm
TL;DR: Payment fraud attempt rates held around 3.25% in 2025 while transaction volume across the Sift Global Data Network grew 18%, but account takeover incidents rose, with 21% of consumers reporting one and login block rates peaking at 1.8% in Q1, according to Sift. The control problem has shifted upstream: account access now drives the fraud blast radius, not checkout monitoring alone.
Editorial analysis by NHI Mgmt Group, based on content published by Sift: “The Fraud Landscape Has Shifted—But Not Where You’d Expect”.
Key questions
Q: What breaks when account takeover is not controlled before payment activity starts?
A: Payment controls lose much of their value because the attacker is no longer arriving as an obvious outsider.
Q: Why does stronger account authentication reduce fraud losses?
A: Stronger authentication reduces fraud because it blocks or slows the attacker before they inherit a trusted customer context.
Q: What do finance teams get wrong about fraud monitoring?
A: They often rely too heavily on reconciliation and post-payment review, which means the money has already moved before anomalies are challenged.
Practitioner guidance
- Instrument account takeover and payment fraud together Track login anomalies, recovery events, device changes, and downstream purchase behaviour in a single fraud view so compromise is visible before monetisation.
- Increase step-up checks on risky account events Require additional verification for new devices, password resets, profile edits, payout changes, and high-risk logins rather than waiting for checkout controls.
- Review account recovery as a fraud control Audit password reset, email change, and SIM-swap-adjacent recovery paths for weaknesses that let attackers seize a trusted account without raising a transaction alert.
Bottom line: Account takeover has become the key fraud surface because it lets attackers operate from inside a trusted customer relationship rather than from an obvious external payment event.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:44 pm
Account takeover is now the more important fraud governance problem because it converts identity trust into payment abuse. The article’s central signal is not that payment fraud disappeared, but that the attack surface moved earlier in the journey. Once an account is compromised, the attacker inherits behavioural trust, stored value, and a legitimate session context, which makes downstream fraud harder to distinguish and harder to stop.
A few things that frame the scale:
- Nearly 60% of companies reported that fraud losses were still increasing in 2025.
A question worth separating out:
Q: What is the difference between card testing and account takeover fraud in e-commerce?
A: Card testing is when fraudsters probe stolen payment card details with small transactions to confirm the card is active. Account takeover fraud is when an attacker gains access to a customer account and uses stored payment methods or pre-approved credit. Both enable fraudulent purchases, but the first validates payment data while the second hijacks an existing account.
👉 Read our full editorial: Account takeover is now the key fraud attack surface in 2025