Topic starter
01/08/2026 8:55 pm
TL;DR: Fraud rings are easier to see across a network than inside one merchant, Sift reports, which is why site-level thresholds miss coordinated abuse. Fraud controls need shared signal visibility and faster escalation when card testing or account takeover moves from one site to another.
Editorial analysis by NHI Mgmt Group, based on content published by Sift: “The Connected Threat: Fraud Rings, ATO Patterns, and Payment Fraud Benchmarks”.
Key questions
Q: Why do account takeover attacks look legitimate in fraud systems?
A: ATO often uses real customer accounts, so the activity can include valid logins, recognised purchase histories, and normal-looking sessions.
Q: What are the warning signs that a fraud ring is moving from testing to takeover?
A: Repeated small authorisations, one identity trying many cards, and later reuse of those cards in higher-value sessions are strong indicators.
Q: What breaks when fraud detection only looks at one merchant at a time?
A: Single-site fraud detection misses distributed rings because no one merchant sees enough of the campaign to understand its scale.
Practitioner guidance
- Implement cross-merchant ring detection Correlate repeated card attempts, shared email patterns, and small-value authorisations across merchants so distributed validation does not look benign at any single site.
- Separate card testing from ATO playbooks Use different response rules for validation abuse and account takeover, because card testing can absorb stronger blocking while ATO needs more selective step-up and review.
- Treat account-state changes as fraud signals Watch for loyalty email changes, unusual login behaviour, and receipt redirection as indicators that a real account is being redirected for fraud.
Bottom line: Fraud rings are easier to see across a network than inside one merchant, which is why site-level thresholds miss coordinated abuse.
Glossary terms: Card Testing, Account Takeover, Fraud Ring, Step-up Authentication
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 9 hours ago by NHI Mgmt Group
01/08/2026 9:03 pm
Fraud rings expose a visibility gap, not just a scoring gap: the key failure is assuming one merchant can classify a distributed campaign from local telemetry alone. When the same actor can spread attempts across five businesses or more than 90 businesses, the relevant control is ecosystem visibility, not just tighter thresholds. Practitioners should treat cross-merchant pattern recognition as a governance requirement, not a nice-to-have.
A few things that frame the scale:
- Authorised push payment (APP) fraud is projected to cause global losses of US$331 billion by 2027.
A question worth separating out:
Q: How should fraud teams balance blocking with customer friction?
A: Use aggressive blocking for card testing because the cost of stopping a rare legitimate edge case is usually lower than letting a validation ring succeed. Use step-up checks for ATO so legitimate customers can recover access without unnecessary lockouts. The right balance depends on whether the pattern is instrument validation or account compromise.
👉 Read our full editorial: Fraud rings and ATO patterns expose the limits of single-site fraud