Topic starter
05/07/2026 10:44 pm
TL;DR: E-commerce traffic that comes from bad bots is 65%, login attack rates at e-commerce sites jumped 216% in 2025, and annual e-commerce losses to online payment fraud reached $48B, according to Arkose Labs and LexisNexis. That combination shows fraud controls now have to govern machine-driven abuse, not just human attackers.
Editorial analysis by NHI Mgmt Group, based on content published by Arkose Labs: “E-commerce & Retail”.
By the numbers:
- 65% of e-commerce traffic comes from bad bots.
- Login attack rates at e-commerce sites jumped 216% in 2025.
- Annual e-commerce losses to online payment fraud reached $48B.
Key questions
Q: What breaks when bad bots dominate e-commerce traffic?
A: Fraud controls lose signal quality when machine traffic overwhelms normal customer behaviour.
A: Automated fraud increases risk because it raises attack speed, scale, and sophistication faster than manual or store-centric controls can respond.
Q: What are the signs that bot mitigation is failing in a live environment?
A: Bot mitigation is failing when malicious traffic looks normal enough to evade basic filters, suspicious activity keeps recurring, and teams only see the problem after impact.
Practitioner guidance
- Instrument pre-authentication risk scoring Score traffic before login and registration so bot-heavy sessions can be challenged before they reach account creation or payment flows.
- Separate customer and automation signals Combine device, behavioural and session features so scripted traffic is not evaluated with the same thresholds as trusted customer activity.
- Correlate account and checkout telemetry Tie login abuse, fake account creation and payment events into one investigation path so a single abuse campaign cannot be treated as isolated incidents.
Bottom line: Bad bots and AI-driven automation are no longer background noise in retail. They now shape the trust conditions under which fraud, account takeover and payment abuse succeed.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
05/07/2026 10:47 pm
Retail fraud is now an identity governance problem, not just a bot management problem. When bad bots account for most of the traffic and login attacks are rising sharply, the practical boundary has moved from perimeter filtering to trust governance. E-commerce teams must treat account creation, login and checkout as one identity journey with one fraud decision model. The implication is clear: fraud, IAM and application security can no longer operate as separate control planes.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What do teams get wrong about balancing fraud prevention with customer experience?
A: A common mistake is overcorrecting with controls that stop fraud but also block legitimate buyers. That approach can protect a narrow risk metric while damaging conversion, revenue, and trust. Better programs tune controls to the actual fraud profile, use risk-based decisions where possible, and continuously test whether the experience remains streamlined and secure.
👉 Read our full editorial: AI agents and bad bots are widening retail fraud exposure