Topic starter
06/07/2026 9:46 am
TL;DR: Retail is facing rising identity theft, account takeover, bot abuse, and payment fraud, with Descope citing 6.2 million retail and hospitality accounts compromised via ATO from 2023 to 2025 and 39% of organisations reporting incidents from lax authentication. The governance problem is that retail security now has to preserve conversion, privacy, and compliance at the same time, which makes CIAM a control plane, not just a login layer.
Editorial analysis by NHI Mgmt Group, based on content published by Descope: “Retail Cybersecurity: Key Threats & Defense Mechanisms”.
By the numbers:
- 6.2M accounts in retail and hospitality were compromised via account takeover between 2023 and 2025.
- 39% of organisations experienced security incidents due to lax authentication.
- 28% lost customer trust after security incidents tied to lax authentication.
Key questions
Q: What breaks when retail authentication is too weak?
A: Weak retail authentication lets attackers automate account takeover, drain stored payment methods, and lock out legitimate customers.
Q: Why do retailers need stronger CIAM instead of relying on fraud tools alone?
A: Fraud tools react to suspicious transactions, but CIAM reduces the chance that an attacker reaches the transaction in the first place.
Q: What are the signs that customer authentication is failing in retail?
A: Common signals include rising account recovery volume, repeated login failures, customers reporting lockouts, unexpected checkout abandonment, and unusual transaction patterns tied to specific accounts.
Practitioner guidance
- Harden customer login against automated abuse Use bot detection, risk scoring, and step-up authentication on sign-in and account recovery flows that show credential-stuffing or phishing patterns.
- Shift eligible journeys to passwordless authentication Prioritise passkeys and other passwordless methods for high-traffic customer journeys where password reuse and lockout rates create the most exposure.
- Map identity controls to checkout risk Apply stronger assurance at checkout, payment changes, and account recovery, where fraud impact is highest and business tolerance for disruption is lowest.
Bottom line: Retail cyber risk is concentrated at the identity boundary because account takeover, bot abuse, and payment fraud usually begin with weak customer authentication.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/07/2026 10:02 am
Retail cyber risk is now an identity governance problem, not a fraud-only problem. The article is right to place customer identity at the centre of retail defence because the same login event now influences fraud loss, privacy exposure, and customer retention. CIAM is therefore a governance layer that has to satisfy both security and conversion outcomes. The practitioner conclusion is that retail security programmes should be measured by identity resilience, not by fraud tooling count.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should retailers balance security and checkout conversion?
A: Retailers should place stronger checks where fraud risk is highest, such as sign-in, payment changes, and checkout, while keeping routine browsing and low-risk actions low friction. Adaptive MFA, passkeys, and guest-friendly flows help preserve conversion without leaving the account boundary exposed. The goal is risk-based friction, not universal friction.
👉 Read our full editorial: Retail cybersecurity depends on stronger CIAM, not just better fraud tools