Topic starter
06/11/2026 6:38 pm
TL;DR: Kasada's Q3 2026 threat intelligence report shows holiday fraud now starts in the run-in, with scraping, fake account creation, checkout abuse and refund fraud all shifting earlier, while synthetic identities can be assembled for less than $100. The operational lesson is that identity, checkout and recovery controls must move before the sale window, not after it opens.
Editorial analysis by NHI Mgmt Group, based on content published by Kasada: “Threat Intelligence Report T h r e a t I n t e l l i g e n c e R e p o r t”.
By the numbers:
- 924K+ automated checkouts were claimed in monitored communities this quarter, across 710+ retailers.
- Tracked marketplace listings rose 52% by September after a cluster of marketplaces collapsed in August.
- It costs less than $100 to build a synthetic identity that can pass onboarding checks.
Key questions
Q: What should teams do first when seasonal bot fraud starts to rise?
A: Start by tightening step-up verification and bot detection at the points where automation is entering the journey, such as login, account creation and checkout.
Q: What fails when synthetic identity fraud gets past onboarding?
A: The core failure is that the system has already accepted a fabricated person as real, so every downstream control starts from a false identity.
Q: How can fraud teams connect checkout abuse to later refund claims?
A: Connect the two by correlating shared identity signals such as device fingerprint, IP range, account age, payment instrument, shipping address and session behaviour across the purchase and refund lifecycle.
Practitioner guidance
- Bring peak-season monitoring forward Move checkout, login, registration and account recovery monitoring into the run-in period, before the obvious sale dates, so bot build-up is visible while it is still low-value.
- Tighten customer journey controls Apply step-up checks, rate limits and behavioural anomaly detection to checkout and account pages that signed-in customers can reach, especially where stored cards, points or carts are in scope.
- Link onboarding to downstream abuse signals Feed account recovery, refund, chargeback and loyalty abuse signals back into identity verification decisions so a clean onboarding result does not stay trusted forever.
Bottom line: Holiday fraud now starts before the sales peak, with bots and fake accounts used to prepare trusted access paths in advance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Seasonal fraud is a control-timing problem, not just a volume problem. The critical failure is assuming that abuse begins at the sale moment rather than in the run-in window when bots age accounts, map flows and seed trust. That shifts the governance question from peak-day detection to pre-peak control placement. Practitioners should treat seasonal readiness as an access and identity lifecycle issue, not a holiday traffic issue.
A question worth separating out:
Q: How should security teams govern agentic AI in fraud detection?
A: Start by separating detection support from decision authority. Agentic AI can correlate signals quickly, but any action that changes customer treatment, case priority, or compliance status needs explicit policy, traceability, and a human escalation path. Governance should define what the system may recommend, what it may execute, and what always requires review.
👉 Read our full editorial: Holiday fraud starts in the run-in, not on black Friday