Topic starter
12/06/2026 12:04 am
TL;DR: Account sign-up remains the most abused entry point, with Storm-1152 creating 750 million fake Microsoft accounts and attackers also concentrating on sign-in and password reset flows, according to Arkose Labs' analysis of 12 months of fraud data. The pattern matters because identity and fraud controls fail first where onboarding, recovery, and scale collide.
Editorial analysis by NHI Mgmt Group, based on content published by Arkose Labs: “Inside the Scammer’s Mind: Attack Data Revealed”.
By the numbers:
- Storm-1152 created 750 million fake Microsoft accounts and sold them on the dark web.
- Arkose Labs analysed 12 months of data from heavily targeted businesses across industries.
Key questions
Q: What breaks when account sign-up is the easiest place to create fake users?
A: When sign-up is weak, the rest of the identity stack inherits bad trust decisions.
Q: Why do password reset flows attract fraud and account takeover attempts?
A: Password reset flows restore access when identity is weakest, so attackers target them to convert a fresh foothold into durable control.
Q: What are the signs that fake-account creation is becoming a campaign?
A: Look for rapid registration spikes, repeated device or network attributes, concentrated activity during promotion windows, and clusters of accounts that behave similarly after creation.
Practitioner guidance
- Tighten account issuance controls Apply step-up verification, device and reputation checks, and adaptive friction before the account is created, not only after suspicious activity appears.
- Separate recovery from sign-in risk Instrument password reset, one-time code delivery, and help-desk recovery as distinct abuse paths with their own thresholds, telemetry, and escalation rules.
- Detect campaign-level registration abuse Correlate velocity, IP reuse, device fingerprinting, and signup clustering so that fake-account creation is detected as a coordinated campaign rather than individual noise.
Bottom line: The article shows that account sign-up remains the most attractive entry point for fraud because attackers can create identity at scale before defenders have much evidence.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
12/06/2026 9:04 am
Account creation is now a fraud-control boundary, not a routine onboarding step. The article shows that attackers prize sign-up because it is where identity confidence is lowest and scale is highest. That means customer onboarding must be governed as an abuse surface, not just a conversion funnel. The practitioner implication is that identity assurance has to start before account issuance, not after fraud has already spread.
A question worth separating out:
Q: How should teams reduce account sign-up abuse without breaking customer onboarding?
A: Use adaptive friction instead of one-size-fits-all blocking. Apply stronger checks only where risk is elevated, and reserve the most intrusive verification for high-risk geographies, devices, or behavioural patterns. That approach preserves conversion for legitimate users while making mass account creation materially more expensive for attackers.
👉 Read our full editorial: Fraudsters still abuse account sign-up as the highest-value entry point
This post was modified 1 day ago by NHI Mgmt Group