Topic starter
10/07/2026 9:16 pm
TL;DR: Payment fraud attack rate fell from 3.3% to 2.8% and manual review dropped from 3% to 2.5%, while chargeback rate rose from 0.2% to 0.3% and fraudulent chargebacks edged up to 0.102%, according to Sift’s Q1 2026 benchmarking. The governance problem is no longer only volume reduction, but where losses concentrate when trusted accounts and payment flows are abused.
Editorial analysis by NHI Mgmt Group, based on content published by Sift: “Are You Benchmarking Against the Right Threats? Q1 2026 Insights from Sift’s FIBR”.
By the numbers:
- The payment fraud attack rate decreased from 3.3% in Q1 2025 to 2.8% in Q1 2026.
- The manual review rate decreased from 3% to 2.5% year over year.
- The overall chargeback rate increased from 0.2% to 0.3% over the same period.
Key questions
Q: What breaks when fraud controls focus only on attack volume?
A: Controls that focus only on volume can miss the smaller set of cases that create the most financial damage.
Q: Why does account takeover often create more long-term damage than a single fraudulent transaction?
A: Account takeover is damaging because it turns one compromised login into an ongoing trust problem.
A: A key sign is when the top-line fraud rate improves but merchant-level anomalies cluster around a narrow pattern, such as repeated BIN attacks, card testing across countries, or sustained anomalies over many days.
Practitioner guidance
- Harden high-risk account transitions Require stronger step-up checks for password resets, payment instrument changes, balance redemption, and any action that converts trust into monetisable access.
- Re-score accounts by loss potential Move beyond attack-rate dashboards and rank accounts by expected downstream loss, including stored value, payment method access, and historical trust signals.
- Separate review thresholds by business model Calibrate manual review and automation thresholds to the fraud economics of each product line, especially subscriptions, wallets, and high-value transactions.
Bottom line: Fraud is concentrating into the accounts and payment flows that matter most, so volume metrics alone no longer describe the risk.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/07/2026 9:39 pm
Fraud concentration is the more important signal than fraud volume. A falling attack rate can coexist with rising loss if attackers are selecting accounts and payment paths that are already trusted. That means the security question is not only how many attacks are blocked, but where the remaining successful attacks land. Practitioners should measure control performance by expected loss concentration, not by raw attack suppression.
A question worth separating out:
Q: How should teams balance conversion, review friction, and fraud loss?
A: Use differentiated controls by account type, transaction value, and monetisation path rather than a single global threshold. Low-friction journeys can remain in place for low-risk cases, while recovery, stored-value use, and payment changes get tighter checks. The right balance protects conversion without leaving high-loss workflows under-governed.
👉 Read our full editorial: Fraud concentration is rising even as attack volumes fall