Topic starter
01/08/2026 8:55 pm
TL;DR: Fraud rarely appears as a single bad transaction; it emerges as a network pattern, and Sift’s Q2 2026 Digital Trust Index webinar shows how card testing, account takeover, and post-incident response create different control demands across merchants. Small signals like repeated card attempts, email changes, and unusual basket values matter most when seen across a broader fraud network. The governance lesson is that isolated merchant controls cannot see ring behaviour soon enough to stop it.
Editorial analysis by NHI Mgmt Group, based on content published by Sift: “The Connected Threat: Fraud Rings, ATO Patterns, and Payment Fraud Benchmarks”.
Key questions
Q: What breaks when fraud detection only looks at one merchant at a time?
A: Single-site fraud detection misses distributed rings because no one merchant sees enough of the campaign to understand its scale.
Q: Why do account takeover attacks look legitimate in fraud systems?
A: ATO often uses real customer accounts, so the activity can include valid logins, recognised purchase histories, and normal-looking sessions.
Q: What are the warning signs that a fraud ring is moving from testing to takeover?
A: Repeated small authorisations, one identity trying many cards, and later reuse of those cards in higher-value sessions are strong indicators.
Practitioner guidance
- Implement cross-merchant ring detection Correlate repeated card attempts, shared email patterns, and small-value authorisations across merchants so distributed validation does not look benign at any single site.
- Separate card testing from ATO playbooks Use different response rules for validation abuse and account takeover, because card testing can absorb stronger blocking while ATO needs more selective step-up and review.
- Treat account-state changes as fraud signals Watch for loyalty email changes, unusual login behaviour, and receipt redirection as indicators that a real account is being redirected for fraud.
Bottom line: Fraud rings are easier to see across a network than inside one merchant, which is why site-level thresholds miss coordinated abuse.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 9:03 pm
Fraud rings expose a visibility gap, not just a scoring gap: the key failure is assuming one merchant can classify a distributed campaign from local telemetry alone. When the same actor can spread attempts across five businesses or more than 90 businesses, the relevant control is ecosystem visibility, not just tighter thresholds. Practitioners should treat cross-merchant pattern recognition as a governance requirement, not a nice-to-have.
A few things that frame the scale:
- Authorised push payment (APP) fraud is projected to cause global losses of US$331 billion by 2027.
A question worth separating out:
Q: How should fraud teams balance blocking with customer friction?
A: Use aggressive blocking for card testing because the cost of stopping a rare legitimate edge case is usually lower than letting a validation ring succeed. Use step-up checks for ATO so legitimate customers can recover access without unnecessary lockouts. The right balance depends on whether the pattern is instrument validation or account compromise.
👉 Read our full editorial: Fraud rings and ATO patterns expose the limits of single-site fraud