Topic starter
30/07/2026 10:47 pm
TL;DR: Telco fraud losses reached $41.82B globally in 2025, mobile messaging fraud hit $80.5B, and 76% more telecom account takeovers were reported as attack volumes and tooling complexity outpaced internal expertise, according to Arkose Labs and CFCA 2025. The governance gap is no longer just detection quality; it is whether identity and access controls can keep pace with bot, fraud, and AI-driven abuse.
Editorial analysis by NHI Mgmt Group, based on content published by Arkose Labs: “Telco”.
By the numbers:
- Telecom account takeovers increased 76%.
- 67% of telcos have insufficient personnel with AI and cybersecurity expertise.
Key questions
Q: What breaks when bot defence is treated as a separate fraud tool instead of part of IAM?
A: The control model breaks because suspicious behaviour is discovered too late to influence access decisions.
Q: Why do telecom account takeovers create governance risk beyond the immediate fraud case?
A: Because takeover turns identity trust into a recurring operational problem.
Q: What are the signs that telco bot controls are not keeping up?
A: Rising takeover rates, repeated suspicious sessions, and growing reliance on manual review are the clearest indicators.
Practitioner guidance
- Tie fraud signals to access decisions Feed bot scores, takeover indicators, and device anomalies into live authorization logic so suspicious sessions can be constrained before they reach customer actions or message flows.
- Treat account takeover as a governance metric Track takeover rates, challenge success, and repeated abuse patterns together so IAM and fraud teams share the same view of control effectiveness.
- Separate trusted enrollment from runtime trust Reassess customer sessions after authentication, because an initially valid identity can still become hostile once automation or credential abuse takes over.
Bottom line: Telco fraud is no longer just a fraud operations issue because bots, takeovers, and messaging abuse now sit inside the identity control problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
30/07/2026 10:54 pm
Bot defence has become an identity governance function, not a narrow fraud control. Telco fraud now depends on distinguishing legitimate access from machine-driven abuse across login, messaging, and account workflows. That makes trust evaluation a governance decision about who or what is allowed to proceed, not just a detection signal. The implication is that fraud teams and IAM teams can no longer operate as separate control planes.
A few things that frame the scale:
- 53% of security leaders expect AI to run major portions of their infrastructure autonomously within the next three years, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should security teams handle AI-powered bots that target identity and account controls?
A: Security teams should treat AI-powered bots as adaptive identity threats, not just traffic noise. The right response combines stronger account assurance, step-up checks where risk is high, and fraud controls that can change as attacker methods evolve. If the controls only block known scripts, attackers will simply retrain around them.
👉 Read our full editorial: Telco fraud losses show why bot defense is now identity governance