Topic starter
12/06/2026 9:37 pm
TL;DR: Account takeover attacks now hide inside normal-looking behaviour, with fraudsters changing device, IP, address, and transaction patterns after phishing or social engineering to defeat verification controls, according to Sumsub’s podcast discussion with Monavate. Traditional controls increasingly fail because the account itself remains trusted even when the user is not.
Editorial analysis by NHI Mgmt Group, based on content published by SumSub: “Account Takeover: When Trust Gets Hijacked | "What The Fraud?" Podcast”.
Key questions
Q: What breaks when an account still looks trusted but the user has changed?
A: The main failure is that controls continue to trust the account’s history instead of the current actor.
Q: Why do account takeovers evade fraud controls even when the account looks normal?
A: Because attackers often change only enough information to operate while keeping the account inside normal behavioural thresholds.
Q: How can fraud teams spot dormant accounts that have been hijacked?
A: Look for reactivation followed by profile edits, unfamiliar merchants, unusually high transaction values, or small but repeated changes to identity signals.
Practitioner guidance
- Strengthen behaviour-based drift detection Correlate device ID, IP address, address changes, email changes, spending patterns, and merchant behaviour so subtle takeover patterns are visible across the full account record.
- Add separate risk logic for dormant reactivation Treat accounts that go quiet and then become active again as a distinct control case, especially when the reactivation is followed by higher-value or unfamiliar transactions.
- Connect customer scam signals to account controls Feed phishing, spam, and social-engineering indicators into step-up verification and monitoring so relationship abuse is not handled after the account is already compromised.
Bottom line: Account takeover is no longer just a credential problem because attackers can preserve the outward signs of legitimacy while hijacking the relationship behind the account.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 3 days ago by NHI Mgmt Group
12/06/2026 11:50 pm
Account takeover is now a trust governance problem, not just a fraud pattern. The episode is useful because it shows that the account can remain technically valid while the human relationship behind it has broken down. That distinction matters for identity programmes: authentication success no longer proves customer legitimacy once the session is active. The practical conclusion is that trust has to be continuously re-earned, not assumed from onboarding history.
A few things that frame the scale:
- U.S. fraud losses are projected to reach $40 billion by 2027.
A question worth separating out:
Q: What should organisations do when an account takeover has already been detected?
A: Once takeover is confirmed, organisations should move quickly to contain the account, stop fraudulent use, and recover control of the session and credentials. The article implies that delayed remediation narrows options, so response should include disabling or restricting the account, re authenticating the user, and reviewing linked payment and shipping data for abuse.
👉 Read our full editorial: Account takeovers are becoming a trust problem, not just fraud
This post was modified 3 days ago by NHI Mgmt Group