Notifications
Clear all
Topic starter
10/07/2026 9:26 pm
TL;DR: Account takeover fraud is rising sharply in digital marketplaces, with 21% growth from H1 2024 to H1 2025, 90% year-over-year attack growth on marketplaces, and more than 26 billion credential-stuffing attempts per month across the web, according to Prove Identity. Identity confidence, not just transaction rules, is becoming the control plane for fraud prevention.
NHIMG editorial — based on content published by Prove Identity: Account Takeovers: The Silent Revenue Killer in Digital Marketplaces
By the numbers:
- Global ATO volume grew 21% from H1 2024 to H1 2025.
- Attack rates on marketplaces surged 90% year-over-year, roughly four times the cross-industry average of 24%.
- There are more than 26 billion credential-stuffing attempts per month across the web.
Questions worth separating out
Q: What breaks when account takeover controls stop at login?
A: When controls stop at login, attackers can still exploit the account through recovery flows, payout changes, refund abuse, and trusted-device reuse.
Q: Why do marketplace accounts create a higher fraud risk than ordinary consumer logins?
A: Marketplace accounts often hold payment methods, loyalty balances, fulfilment permissions, or payout authority, so one compromise can affect both revenue and operational trust.
Q: How do security teams know whether identity-based fraud controls are working?
A: Look for reduced takeover success at login, fewer high-risk account changes, lower refund abuse, and fewer chargebacks linked to suspicious sessions.
Practitioner guidance
- Implement continuous account risk scoring Score login, recovery, payout changes, and device substitution with the same identity telemetry so risk is evaluated at each trust boundary, not just at authentication.
- Protect account recovery as a privileged path Treat reset, recovery, and support workflows as higher-risk than ordinary sign-in.
- Use breached-credential and device intelligence together Block known compromised credentials and correlate them with device reputation, IP intelligence, and behavioural consistency.
What's in the full article
Prove Identity's full blog covers the operational detail this post intentionally leaves for the source:
- How Prove models identity confidence across login, recovery, and payout-change events for high-volume marketplaces
- Examples of continuous authentication signals such as device binding, SIM changes, and number portability events
- The specific way Prove ties verified identity signals to frictionless user journeys in marketplace and gig workflows
- What the vendor says about identity continuity across the entire customer lifecycle and why it matters for fraud loss attribution
👉 Read Prove Identity's analysis of account takeover fraud in digital marketplaces →
Account takeover in marketplaces: what IAM and fraud teams need to know?
Explore further
10/07/2026 9:48 pm
Account takeover in marketplaces is an identity assurance problem before it is a fraud problem. Once an attacker controls a live account, transaction monitoring is already operating downstream of the real failure. The governance gap is weak identity continuity across login, recovery, payout changes, and session reuse. Practitioners should treat account integrity as a lifecycle control, not a one-time authentication event.
A question worth separating out:
Q: Who is accountable when account takeover drives chargebacks and churn?
A: Account takeover accountability should sit across IAM, fraud operations, trust and safety, and finance because the impact is cross-functional. IAM owns the trust signals, fraud teams own decisioning, and finance tracks downstream loss. When those functions are separated, the organisation underestimates the true cost and responds too late.
👉 Read our full editorial: Account takeover fraud in marketplaces is now a revenue problem
