Topic starter
16/01/2026 5:29 pm
TL;DR: Fraudsters adapt their methods to exploit identity as the access path to stored payments or financial transfers, according to Ping Identity, and a holistic identity threat taxonomy helps teams visualise the sequence of related attack parts rather than isolating controls. The lesson is that account takeover and new account fraud need journey-level threat protection, not piecemeal detection.
Editorial analysis by NHI Mgmt Group, based on content published by Ping Identity: “Stop Identity Fraud with an Identity Threat Prevention Taxonomy”.
Key questions
Q: How should security teams reduce account takeover risk in digital identity programmes?
A: They should treat takeover as a lifecycle problem, not only an authentication problem.
Q: Why do account takeover and new account fraud need to be managed together?
A: Because both depend on the organisation accepting identity evidence at a decision point, just at different stages of the lifecycle.
Q: What are the signs that a fraud prevention programme is too isolated to work effectively?
A: A weak programme usually shows up when fraud claims stay trapped in one team, when customer service cannot escalate cases cleanly, or when legal and finance only get involved after damage is already visible.
Practitioner guidance
- Map fraud paths across the identity journey Document how account takeover and new account fraud move through onboarding, authentication, recovery, and monetisation so each control point is visible in one sequence.
- Correlate identity and behaviour signals Combine login, device, recovery, and transaction indicators so one suspicious event is evaluated in the context of a broader attack path.
- Separate trust decisions by journey stage Use different trust thresholds for enrolment, authentication, and account recovery because the evidence available at each stage is not the same.
Bottom line: Fraud defence weakens when account takeover and new account fraud are treated as separate problems instead of connected identity journeys.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
10/10/2026 6:46 pm
Identity threat taxonomies are a governance tool, not just a fraud diagram. The value of a taxonomy is that it forces teams to describe how identity abuse progresses across onboarding, authentication, recovery, and monetisation. That creates a shared language between IAM, fraud operations, and security architecture. Without that shared model, controls are usually deployed in silos and the attacker simply routes around them. The implication is that identity programmes need threat sequencing as a planning input, not an after-the-fact reporting aid.
A few things that frame the scale:
- Sumsub's Identity Fraud Report 2025-2026 recorded an overall fraud rate of 2.2% across verified accounts in 2025, and multi-step identity fraud rose from 10% of attacks in 2024 to 28% in 2025.
A question worth separating out:
Q: How should teams decide where to place stronger identity checks?
A: Place stronger checks at the points where the attacker can change the outcome, especially enrolment, recovery, and high-value transactions. The right choice is where identity trust converts most directly into account control or financial loss.
👉 Read our full editorial: Identity threat taxonomy clarifies fraud paths in account takeover