Topic starter
24/06/2026 11:33 pm
TL;DR: New account fraud is harder to detect because fraudsters can combine real and synthetic identity data, bots, emulators, private browsing and fast form navigation to mimic legitimate registrations, according to Transmit Security. The analytical lesson is that registration risk depends on context quality, model tuning, and continuous monitoring, not on any single signal.
Editorial analysis by NHI Mgmt Group, based on content published by Transmit Security: “Machine-Learning Techniques for Detecting New Account Fraud”.
Key questions
Q: How should security teams detect new account fraud when behavioural signals are noisy?
A: Use multiple correlated signals rather than any single behavioural clue.
Q: Why do bots and emulators make account registration harder to secure?
A: Bots and emulators can mimic normal users closely enough to blend into ordinary registration traffic while still creating accounts at scale.
Q: What are the signs that a registration fraud model is not working well?
A: Common signs include rising false positives, missed abuse patterns, unstable precision or recall, and a model that performs well in testing but degrades in production.
Practitioner guidance
- Harden first-touch registration telemetry Capture typing cadence, field timing, input method, mouse movement and browser attributes at account creation so risk scoring can compare each session against population baselines.
- Correlate environment signals across sign-ups Use device type, OS, geolocation and browser fingerprint distributions to detect campaigns that look benign at the individual level but abnormal across the tenant.
- Separate bot, emulator and private-browsing risk Treat bots, emulators and private browsing as distinct contributors to account-opening risk so threshold logic reflects different evasion patterns instead of one blended flag.
Bottom line: New account fraud exploits the fact that registration often provides little reliable history, which makes single-signal detection brittle.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 8:31 am
New account fraud is a context problem before it is a model problem: the attacker wins when the defender has too little identity history to tell normal from malicious. That means registration is the highest-uncertainty point in the customer lifecycle, and the quality of the signal set matters more than any single detection rule. Practitioners should treat first-touch identity telemetry as a governance input, not a binary trust decision.
A few things that frame the scale:
- U.S. fraud losses are projected to reach $40 billion by 2027.
A question worth separating out:
Q: When should organisations retrain a new account fraud model?
A: Retrain when user behaviour shifts, when attackers change tactics, or when analysts see that false positives and false negatives are increasing. Model refresh is also justified when new signals, such as improved device or emulator features, become available and materially improve the quality of the risk decision.
👉 Read our full editorial: New account fraud exposes the limits of behavioral context alone