Topic starter
10/06/2026 12:06 am
TL;DR: Human fraud farms defeat bot-focused fraud controls by using real people, real devices, residential IPs, and low-volume coordinated activity that looks legitimate in each session, according to Arkose Labs. The failure is structural: detection models built to separate humans from machines break down when the attacker is human by design, not a bot.
Editorial analysis by NHI Mgmt Group, based on content published by Arkose Labs: “Why Your Fraud Defenses Were Never Built for This”.
Key questions
Q: What breaks when fraud detection is built only for bots?
A: Fraud controls that assume suspicious sessions are machine-generated fail when attackers use real people to create natural mouse movement, typing cadence, and dwell time.
Q: Why do human fraud farms drive losses even when sessions look clean?
A: Because the abuse is distributed.
Q: How do you know if fraud detection is missing coordinated abuse?
A: Look for many clean-looking sessions that cluster across accounts, devices, or payment flows without a single obvious trigger.
Practitioner guidance
- Correlate sessions across accounts and devices Join login, registration, payment, and account-change events so one worker or device reused across many accounts becomes visible as a campaign rather than isolated clean sessions.
- Tune controls for aggregate abuse patterns Use campaign-level thresholds for repeated flows, shared infrastructure, and clustered behaviour instead of relying only on per-session velocity or single-event scoring.
- Measure promo and SMS loss as fraud indicators Track promotional burn, fake-account inflation, and SMS-trigger anomalies as operational fraud signals, not just marketing or communications variance.
Bottom line: Human fraud farms exploit the fact that many fraud controls were built to spot machines, not coordinated human abuse.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
11/06/2026 1:44 am
Human fraud farms expose a control assumption that fraud teams still over-trust single-session distinctiveness: the prevailing model assumes suspicious activity will look different from legitimate activity inside the session boundary. That assumption was designed for bots and scripted abuse, not for real humans operating at scale. The implication is that fraud governance has to be judged on campaign-level correlation, not on whether one session looks clean.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to The State of Secrets in AppSec.
A question worth separating out:
Q: What should security and fraud teams do when human fraud farms switch between flows?
A: They should review registration, sign-in, payment, OTP, and account-management paths as one abuse surface. Fraud farms often route around friction by moving to whichever flow has the least resistance, so containment depends on seeing the operation across the whole journey.
👉 Read our full editorial: Human fraud farms expose the limits of bot-focused fraud defenses
12/06/2026 3:18 am
Bot-centric fraud detection has a broken premise: it assumes malicious activity will look machine-like, and that premise fails when the adversary is human by design. Human fraud farms do not evade controls by being more sophisticated bots. They evade them by being ordinary enough to pass as legitimate consumers. The implication is that fraud governance must stop treating human-likeness as a signal of safety.
A few things that frame the scale:
- Nearly 60% of companies reported that fraud losses were still increasing in 2025.
A question worth separating out:
Q: How should teams respond when fraud shifts from bots to human-run operations?
A: They should move from session-only blocking to campaign correlation. That means linking identity, device, and flow data so the operation is visible as coordinated abuse rather than many harmless-looking events.
👉 Read our full editorial: Human fraud farms expose the limits of bot-focused fraud defenses
This post was modified 1 day ago by NHI Mgmt Group