Topic starter
19/08/2026 3:24 pm
TL;DR: Credential theft appears in 39% of breaches and accounts for 52% of data compromised in basic web attacks, according to Verizon's 2026 DBIR, which is why Descope argues that fraud detection must move to authentication rather than waiting for transaction-time review. The governance issue is not just fraud volume, but whether identity teams can make login an enforceable risk decision instead of a pass-or-fail checkpoint.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “Fraud Detection in Authentication: Using Identity Signals to Stop Fraud at Login”.
Key questions
Q: What breaks when login fraud is treated as a post-transaction problem?
A: Teams lose the chance to stop account takeover before access is granted.
Q: Why do breached credentials and credential stuffing remain such a high-risk login pattern?
A: Because reusable secrets are easy to test at scale and many users reuse them across sites.
Q: What are the signs that login fraud controls are too narrow?
A: A narrow control set usually shows up as repeated bot traffic, rising account takeover attempts, or many legitimate users being challenged for the same reason while attackers still slip through.
Practitioner guidance
- Define login as a risk decision point Map authentication into your fraud and IAM operating model so login attempts can be allowed, challenged, or blocked based on context instead of passwords alone.
- Layer behavioral and device signals Correlate geo-velocity, IP reputation, device recognition, and breached-credential checks so no single signal carries the entire fraud decision.
- Move high-risk flows to phishing-resistant methods Use passkeys or similar phishing-resistant methods for default login and sensitive account actions where credential replay is the dominant attack path.
Bottom line: Login fraud is increasingly an authentication-layer problem, not only a transaction-time fraud problem.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
19/08/2026 4:09 pm
Authentication is becoming the fraud decision point, not just the access gate. That shift matters because the old model assumed fraud could be handled after a transaction or after account access was already established. Here, the article shows the control boundary moving upstream into login, where identity signals can still change the outcome. Practitioners should treat login as a policy checkpoint with enforcement authority.
A few things that frame the scale:
- U.S. fraud losses are projected to reach $40 billion by 2027.
A question worth separating out:
Q: Should fraud and IAM teams manage authentication policy together?
A: Yes. Fraud controls and IAM controls intersect at enrollment, recovery, and step-up decisions, so split ownership creates blind spots. Shared policy governance helps teams tune friction, monitor trust signals, and respond faster when identity abuse moves from one workflow to another.
👉 Read our full editorial: Fraud detection at login is shifting identity risk to the front door