How can organisations reduce fraud without creating excessive user friction?

Why This Matters for Security Teams

Fraud controls that rely on a single strong check often fail because attackers do not follow the same path as legitimate users. Security teams need to reduce fraud without turning every login, payment, or account change into a high-friction event. The practical challenge is separating routine activity from actions that deserve more scrutiny, especially when non-human identities, automation, and API-driven journeys can move faster than human review.

This is where layered evidence matters. Behavioural signals, device context, transaction history, and identity assurance can be combined so low-risk users move quickly while high-risk actions are challenged. That approach aligns with the NIST Cybersecurity Framework 2.0 emphasis on risk-informed protection and with NHIMG guidance on credential hygiene and NHI exposure in the Ultimate Guide to NHIs. The key is to apply friction where the fraud payoff is highest, not everywhere.

NHIMG research shows that 80% of identity breaches involved compromised non-human identities such as service accounts and API keys, which is a reminder that fraud and identity abuse now extend beyond human login flows. In practice, many security teams encounter fraud only after excessive trust has already been exploited, rather than through intentional risk-based design.

How It Works in Practice

The most effective pattern is step-up control based on risk scoring, not blanket authentication. Start by defining the journeys that matter most: account recovery, payment changes, payout initiation, device enrollment, privilege escalation, and API actions that can move money or data. Then assign a risk signal set to each journey and decide what extra evidence is needed when thresholds are crossed.

Typical signals include device reputation, geolocation anomalies, velocity, failed attempts, session age, behavioural drift, and whether the request is coming from a human user or a workload identity. For automated flows, workload identity and short-lived credentials matter because they let systems prove what they are without forcing repeated manual checks. For human flows, the same logic can trigger passwordless verification, one-time approvals, document checks, or temporary holds only when the action is unusual.

• Keep low-risk paths fast with baseline checks and continuous monitoring.
• Use stronger proof only when the request crosses a risk threshold.
• Prefer short-lived credentials and scoped tokens over reusable secrets.
• Log the reason for every step-up decision so analysts can tune friction later.
• Reassess controls after fraud attempts, not just on a fixed schedule.

That model is consistent with risk-based identity guidance in NIST Cybersecurity Framework 2.0 and with the NHIMG view that broad secrets exposure and weak rotation create unnecessary trust in the wrong places, as detailed in the Ultimate Guide to NHIs. These controls tend to break down in high-volume, low-latency environments such as checkout, call centre, and machine-to-machine API chains because the decision window is too small for manual review.

Common Variations and Edge Cases

Tighter fraud controls often increase abandonment and support costs, so organisations must balance loss prevention against conversion, service speed, and customer trust. There is no universal standard for the exact threshold, because the right answer depends on transaction value, user segment, channel, and regulatory exposure.

For low-value retail actions, best practice is evolving toward invisible controls that rely on monitoring and selective challenge rather than repeated prompts. For high-value payouts, account recovery, or sensitive admin actions, stronger proof is justified even if it adds delay. In regulated environments, especially where payment data or identity proofing is involved, teams often need to layer policy, auditability, and exception handling rather than chase a single frictionless control.

Another edge case is automation. If an organisation treats every API caller like a human, it creates needless friction and weakens security by encouraging shared credentials. A better pattern is to distinguish human identity from workload identity and apply risk rules accordingly. That separation is central to the NHI governance approach described by NHIMG, and it is also consistent with risk-based protection in the NIST Cybersecurity Framework 2.0.

Fraud controls work best when they are tuned continuously. In practice, many organisations discover that the real tradeoff is not between security and friction, but between targeted friction and user-unfriendly blanket controls.

Related resources from NHI Mgmt Group

• How should security teams reduce phishing risk in MFA without creating more user friction?
• How should organisations replace SMS OTP without creating user friction?
• How should crypto platforms implement Travel Rule compliance without creating excessive operational overhead?
• How can organisations reduce manual review without losing control?