Topic starter
24/06/2026 10:43 pm
TL;DR: 1.2 million accounts show the scale of fraud risk when valid credentials and sessions are abused, Imprivata argues from case work and evidence that login checks alone miss blended-in activity. Identity monitoring has to extend past authentication so risky sessions and cross-system abuse can be cut off quickly.
Editorial analysis by NHI Mgmt Group, based on content published by Imprivata: “Tapping into the power of account fraud detection in the age of identity-based attacks”.
By the numbers:
- Between 80% and 90% of cyberattacks are phishing attacks, according to Imprivata.
- 67% of data breaches start when someone unknowingly clicks a malicious link, according to Imprivata.
- In 2023, a dark web data recapture found 1.87 billion malware cookie records tied to Fortune 1000 employees, according to Imprivata.
Key questions
Q: Why do valid sessions create such a large fraud risk?
A: Valid sessions are dangerous because they let attackers inherit an authenticated state without repeating the password or MFA challenge.
Q: How do you know if account fraud detection is actually working?
A: Look for fewer linked rings operating over time, faster detection of new evasion tactics, and a stable false-positive rate for legitimate users.
Q: What breaks when fraud detection relies on login success alone?
A: Login success proves only that a credential or factor was accepted, not that the caller is trustworthy.
Practitioner guidance
- Expand detection beyond login success Monitor device posture, access path, location, and action sequence after authentication so a valid sign-in does not end the risk review.
- Correlate identity signals across systems Join identity provider, application, VPN, endpoint, and SIEM telemetry to detect blended-in abuse that is invisible in a single control plane.
- Add session revocation triggers Define conditions that revoke an active session when device, location, or behaviour deviates from the expected user pattern.
Bottom line: Account fraud increasingly succeeds by reusing legitimate credentials and sessions, which makes simple authentication checks an incomplete control boundary.
Glossary terms: Account Takeover, Session Hijacking, Behavior Baseline, Identity correlation
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 7:30 am
Account fraud detection now fails at the point where identity stops being a login event and becomes a runtime behaviour problem: A correct password or valid session token no longer proves legitimate use, because attackers can blend into normal workflows after access is granted. That makes static authentication insufficient as a primary fraud control, and it forces identity teams to evaluate behaviour, device context, and action sequence as first-class signals.
A few things that frame the scale:
- Only 5.7% of organisations have full visibility into their service accounts, according to the Ultimate Guide to NHIs.
- Nearly 60% of companies reported that fraud losses were still increasing in 2025.
A question worth separating out:
Q: What should teams do when one account breach could expose many downstream records?
A: Treat high-value accounts as blast-radius problems and add targeted monitoring, tighter response thresholds, and preplanned suspension paths. When one identity can unlock large datasets or financial systems, containment has to be faster than the attacker’s ability to pivot.
👉 Read our full editorial: Account fraud detection is failing where identity becomes the attack path