Topic starter
24/10/2026 8:54 pm
TL;DR: Modern fraud can still succeed after a valid login, Feedzai says, because attackers can manipulate legitimate users during an active session. Correlating behavioural anomalies, non-monetary actions and transaction data gives fraud teams a better way to spot coercion before cash-out.
Editorial analysis by NHI Mgmt Group, based on content published by Feedzai: “Why the Future of Fraud Prevention Belongs to Connected Data Layers”.
By the numbers:
- Annual identity fraud losses reached $27 billion, according to data from Javelin Strategy & Research.
Key questions
Q: Why do disconnected fraud tools miss account takeover scams?
A: Because each tool sees only a slice of the journey.
Q: What are the signs that a logged-in customer may be under social engineering pressure?
A: Look for hesitation while completing fields, unusual copy and paste behaviour, screen-sharing software, background phone calls and activity that does not match the customer’s normal rhythm.
Q: How should financial institutions detect fraud after a user has already passed MFA?
A: They should treat MFA as only one checkpoint and continue monitoring the session for behavioural change, risky non-monetary actions and transaction anomalies.
Practitioner guidance
- Build continuous session monitoring Correlate behavioural signals, device telemetry, non-monetary events and transaction data during the full customer session, not just at login.
- Use non-monetary events as early risk markers Flag actions such as new beneficiary creation, repeated balance checks and profile changes as risk-bearing events that can trigger step-up or blocking.
- Tune decisioning for coerced-user patterns Look for hesitation, unusual copy and paste use, screen-sharing activity and concurrent phone calls when the session appears authenticated but unusual.
Bottom line: Modern fraud can succeed after a valid login, which means MFA alone no longer establishes enough trust for the full session.
Glossary terms: Behavioral Biometrics, Continuous authentication, Non-Monetary Events, Context Gap
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 7 days ago by NHI Mgmt Group
25/10/2026 11:12 am
Continuous authentication is now a governance requirement, not a UX enhancement. The article makes a clear case that modern fraud happens after successful sign-in, not before it. That changes the control conversation for IAM and fraud teams, because the trust decision must extend through the session rather than stop at MFA. The practical implication is that identity assurance should be measured at runtime, not only at authentication.
A few things that frame the scale:
- Nearly 60% of companies reported that fraud losses were still increasing in 2025.
A question worth separating out:
Q: What should teams do when a session is authenticated but the user behaviour looks abnormal?
A: Escalate the session for step-up review or intervention before the next high-risk action, because the attack may already be in progress. The aim is to interrupt the sequence early enough that the fraudster cannot reach beneficiary setup, transfer confirmation or other cash-out steps.
👉 Read our full editorial: Behavioral biometrics alone cannot stop modern account takeover fraud
This post was modified 7 days ago by NHI Mgmt Group