Victim flow is the path a target follows from first contact to the harmful action the attacker wants, such as entering credentials, payment details, or one-time codes. Mapping the flow helps teams remove the right assets in parallel instead of treating a scam as a single page problem.
What a victim flow represents
Victim flow is not just the final phishing page or checkout screen. It is the full sequence of steps, prompts, redirects, and trust cues that move a target from first contact to the attacker’s desired action.
That path matters because a scam often succeeds by shaping behaviour across multiple touchpoints, not by relying on one compromised page alone. The flow may begin with a message, ad, search result, or call, then continue through a convincing landing page, login prompt, payment form, or one-time code request.
Why mapping the flow improves defence
Mapping victim flow helps teams see the attack as a chain of user decisions and infrastructure choices. That makes it easier to identify where a lure is introduced, where trust is established, and which step actually converts attention into loss.
It also changes the defensive question from “is this page bad?” to “which assets must be removed or disrupted in parallel to break the entire path?” That usually means coordinating takedown, blocking, domain monitoring, email and web filtering, and user-facing warnings rather than treating each element as an isolated incident.
Common stages in a victim flow
A typical flow includes initial contact, credibility building, credential or payment capture, and a completion step that confirms success to the attacker. Some flows add branching behaviour, such as redirecting different victims to different forms, requests, or payment rails.
- Initial contact can arrive through email, SMS, social media, search, ads, or voice.
- Credibility building often uses branding, urgency, impersonation, or a familiar interface.
- Capture steps ask for credentials, one-time codes, card data, or other sensitive information.
- Finalisation may include account takeover, payment submission, or session hijack.
Understanding those stages helps defenders distinguish the lure from the conversion point and identify where a control failure is actually occurring.
Why the concept matters for incident response
Victim flow analysis is especially useful when one scam uses several connected assets, because removing only the most visible page can leave the rest of the chain intact. A resilient response focuses on the whole path, including domains, redirects, hosting, messaging channels, and any secondary forms or clone pages.
It also supports faster scoping after a report. If a target already entered credentials or a one-time code, the likely impact is not limited to the visible web asset, it extends to the accounts, sessions, payment methods, or recovery channels that the attacker can now abuse.
Risk and Threat Considerations
Victim flows are dangerous because they turn a single deceptive touchpoint into a controlled sequence that guides the target toward a harmful action. The longer and more coherent the flow, the more likely it is that a victim will comply before noticing the fraud.
Failure mechanism: The attacker aligns messaging, redirects, branding, and form design so each step increases trust or urgency until the target volunteers the data or action the attacker needs.
Impact: Successful flows can lead to credential theft, payment fraud, session compromise, account takeover, and repeated abuse if the supporting infrastructure remains live.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while OWASP ASVS and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP ASVS | V16 — Security Logging and Error Handling | Victim flow analysis depends on seeing the sequence of user interactions and failures. |
| Recommendation — Instrument user-facing journeys so suspicious step sequences and form submissions are logged and reviewable. | ||
| NIST CSF 2.0 | DE.CM-01 — Networks and network services are monitored to find potentially adverse events | Victim flows often span hosted pages, redirects, and delivery infrastructure that must be monitored. |
| Recommendation — Monitor delivery and redirect infrastructure for malicious flow changes and clone-page activity. | ||
| MITRE ATT&CK | T1566 — Phishing | Victim flow commonly describes the social-engineering path used to elicit credentials or codes. |
| Recommendation — Map observed lure-to-capture steps to phishing techniques and hunt the supporting infrastructure. | ||
Practitioner Guidance
What to watch for: Treat reports as flow problems, not page problems. If one lure has multiple branches or replicas, remove every reachable step in the chain and verify that the attacker can no longer direct victims into a replacement asset.
Governance implication: Track victim flow ownership across security, web, messaging, fraud, and brand-protection teams so takedown and user protection actions happen in parallel instead of waiting on a single team to close one page.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org