Topic starter
12/07/2026 12:20 pm
TL;DR: Black Friday and Cyber Monday 2025 drove a 13.6% jump in account takeover attack rates across Sift's Global Data Network, with digital commerce seeing ATO rise from 1.35% to 1.67% and e-commerce fraudulent attempt values surging 93% to $250, according to Sift. Peak-season fraud now behaves like a scaled identity abuse problem, not a holiday nuisance.
Editorial analysis by NHI Mgmt Group, based on content published by Sift: “Black Friday 2025 Fraud Trends: ATO Surges, High-Value Attacks, and What to Expect in 2026”.
By the numbers:
- Black Friday and Cyber Monday 2025 drove a 13.6% rise in account takeover attack rates across Sift's Global Data Network.
- Digital commerce account takeover rose from 1.35% to 1.67% during BFCM 2025.
- E-commerce fraudulent attempt values surged 93% to $250 during BFCM 2025.
Key questions
Q: What breaks when account takeover controls are too focused on checkout fraud?
A: Teams lose visibility into the earlier stages of abuse, where attackers use legitimate login access to reach stored payment methods, recovery options, and loyalty value.
Q: Why does high holiday volume make fraud harder to spot?
A: High volume gives attackers cover because legitimate browsing, checkout, and account activity all increase at the same time.
Q: What do security teams get wrong about ATO prevention during seasonal spikes?
A: The common mistake is treating login protection as the whole problem.
Practitioner guidance
- Tighten seasonal fraud baselines Recalibrate account takeover thresholds before peak shopping periods so holiday traffic does not look anomalous only after losses start.
- Unify login and transaction risk decisions Tie authentication, step-up, and payment approval to the same risk engine so an account flagged at login does not pass unchallenged at checkout.
- Segment fraud analytics by channel and value Track low-value testing separately from high-value purchase attempts so average metrics do not hide concentrated abuse in e-commerce.
Bottom line: Black Friday fraud is scaling with legitimate demand, which turns holiday traffic into a cover mechanism for account takeover and payment abuse.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
12/07/2026 12:34 pm
Peak-season fraud is now an identity governance problem, not just a payments problem. The article shows that attack growth tracks holiday demand, which means the abuse path is built on account trust, transaction trust, and customer trust at the same time. Identity and fraud teams should treat login, step-up, and checkout as one control surface rather than three separate workflows.
A few things that frame the scale:
- Sophisticated multi-step fraud rose 180%, according to Sumsub's Identity Fraud Report 2025-2026.
A question worth separating out:
Q: Should organisations use the same controls for authentication and checkout risk?
A: Yes, when the same identity is being trusted across both steps. Authentication may confirm access, but checkout determines monetisation, so separated controls create a gap attackers can exploit. The better model is shared risk scoring, step-up where needed, and consistent policy enforcement across the full account lifecycle.
👉 Read our full editorial: Black Friday ATO surges show fraud is scaling with peak traffic