Topic starter
24/06/2026 11:33 pm
TL;DR: Bots, emulators and private browsing can distort sign-up signals enough to make new account fraud difficult to separate from normal registrations, according to Transmit Security. Registration telemetry has to be combined and monitored over time if it is going to stay aligned with attacker behavior.
Editorial analysis by NHI Mgmt Group, based on content published by Transmit Security: “Machine-Learning Techniques for Detecting New Account Fraud”.
Key questions
Q: Why do bots and emulators make account registration harder to secure?
A: Bots and emulators can mimic normal users closely enough to blend into ordinary registration traffic while still creating accounts at scale.
Q: What are the signs that a registration fraud model is not working well?
A: Common signs include rising false positives, missed abuse patterns, unstable precision or recall, and a model that performs well in testing but degrades in production.
Q: How should security teams detect new account fraud when behavioural signals are noisy?
A: Use multiple correlated signals rather than any single behavioural clue.
Practitioner guidance
- Harden first-touch registration telemetry Capture typing cadence, field timing, input method, mouse movement and browser attributes at account creation so risk scoring can compare each session against population baselines.
- Correlate environment signals across sign-ups Use device type, OS, geolocation and browser fingerprint distributions to detect campaigns that look benign at the individual level but abnormal across the tenant.
- Separate bot, emulator and private-browsing risk Treat bots, emulators and private browsing as distinct contributors to account-opening risk so threshold logic reflects different evasion patterns instead of one blended flag.
Bottom line: New account fraud exploits the fact that registration often provides little reliable history, which makes single-signal detection brittle.
Glossary terms: New Account Fraud, Feature Engineering, Behavioral context, Model Drift
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 17 hours ago by NHI Mgmt Group
25/06/2026 8:31 am
New account fraud is a context problem before it is a model problem: the attacker wins when the defender has too little identity history to tell normal from malicious. That means registration is the highest-uncertainty point in the customer lifecycle, and the quality of the signal set matters more than any single detection rule. Practitioners should treat first-touch identity telemetry as a governance input, not a binary trust decision.
A few things that frame the scale:
- U.S. fraud losses are projected to reach $40 billion by 2027.
A question worth separating out:
Q: When should organisations retrain a new account fraud model?
A: Retrain when user behaviour shifts, when attackers change tactics, or when analysts see that false positives and false negatives are increasing. Model refresh is also justified when new signals, such as improved device or emulator features, become available and materially improve the quality of the risk decision.
👉 Read our full editorial: New account fraud exposes the limits of behavioral context alone