If you only watch payment block rates, Q3 2026 looks like good news. Payment fraud attempts are falling. But one step earlier, at login, account takeover (ATO) attempts are rising, and manual review queues are getting heavier. In Sift’s Fraud Industry Benchmarking Resource (FIBR), I see that shift across industries.
The pattern looks like a move from volume to precision, and the old equation of fewer attacks meaning less risk no longer holds.
The Attack Volume Paradox
Here’s where the numbers landed across the Sift Global Data Network in Q3 2026, compared with Q3 2025 (quarter-over-quarter change from Q2 2026 in parentheses). I lead with year over year because it’s the apples-to-apples comparison:
- Payment fraud attack rate fell 13% to 2.70% from 3.10% (down 3% from 2.79% in Q2)
- Manual review rate rose 15% to 2.52% from 2.20% (up 19% from 2.12% in Q2)
- ATO attack rate rose 71% to 1.01% from 0.59% (up 14% from 0.88% in Q2)
- Two-factor authentication (2FA) rate fell 18% to 6.4% from 7.8% (down 25% from 8.5% in Q2)
- Fraud chargeback rate rose 42% to 0.17% from 0.12% (down 7% from 0.18% in Q2)
What stands out to me is the direction of travel: payment fraud attempts are falling while ATO and manual review rise. FIBR tracks rates, not dollar amounts, so I’d compare these shifts against your own loss data before drawing conclusions about your program.
Industry Divergence: Where the Pressure Is Concentrating
Digital Commerce is where I see the paradox most clearly. Its payment fraud attack rate was flat quarter over quarter at 1.53% and down 34% year over year from 2.31%. Yet its 2FA rate fell 35% year over year to 1.9% from 2.9%, the lowest of any industry, while its ATO attack rate rose 6% to 0.50%. Fewer payment attempts, and less friction at login. That combination is the one I’d look at first.
Travel and Ticketing is the other side of the story. Summer is peak season, so its attack rate jumped 71% from Q2, to 3.04% from 1.78%. Compared with last year it’s down 34% from 4.59%, and its manual review rate is down 12% to 2.59% from 2.94%. I read that as Travel teams handling a bigger quarter with a lower attack rate than a year ago.
Finance and Fintech had a tougher quarter. Its attack rate rose 16% quarter over quarter to 2.77% (up 8% year over year), while manual review stayed flat at 1.70% (up 59% year over year). More pressure without added review capacity is a pattern I’d watch.
Internet and Software moved against the trend. After its attack rate peaked at 3.79% in Q2, it eased 10% to 3.42%, still the highest of any industry (up 6% year over year). Yet its manual review rate fell 48% year over year to 1.01%, and its ATO attack rate fell 55% from Q2 to 0.60%. It’s a broad category covering software and digital services beyond e-commerce, so I’d look at what’s in your own segment before reading much into it.
Online Gambling is a quarter to watch. Its manual review rate rose from 0.63% to 3.07% year over year (+384%). The percentage is large because the starting point was small. One possible driver I’d point to is the World Cup, which drew first-time bettors, brought in casual fans who don’t usually bet, and opened new North American markets. Each of those groups arrives without a history, which makes them harder to assess.
These variations reflect structural differences in how money moves and settles. A fraud rate that looks high in isolation may be typical for a high-volume environment, and a low one can mean fraud is easier to hide, so I treat both with caution.
Payment Methods: Where Fraud Shows Up and Where the Rates Run Highest
FIBR also breaks out fraud by payment method, and I find two views most useful: which methods account for the most blocked payments, and which have the highest fraud rate.
Credit and debit cards account for 59.6% of blocked payments across the Sift Global Data Network in Q3 2026, followed by electronic fund transfers (EFT) at 33.3%. Together they make up more than 92% of the total. Digital wallets (3.0%), cryptocurrency (1.7%), points (1.5%), and financing (1.0%) account for most of the rest. Volume largely tracks how widely a method is used, so this view shows where fraud appears, not where it’s most likely.
For risk, I look at fraud rate first. EFT has the highest rate at 4.58%, just ahead of cryptocurrency (4.52%) and financing (4.48%). Cards sit at 3.73% and points at 3.18%. Digital wallets are lowest at 1.96%, less than half the EFT rate. EFT pairs the second-highest volume with the highest rate. Rates are unweighted averages across customers.
Card controls are necessary but not sufficient. If yours are tuned mainly for cards, I’d check whether EFT and financing get the same scrutiny, since those methods carry some of the highest rates in the network.
ATO and 2FA: Less Friction, More Effective Attacks
ATO is the number I’d pay the most attention to. The attack rate rose 71% year over year to 1.01%, while the 2FA rate fell 18% to 6.4%.
ATO is a more sophisticated kind of fraud. The fraudster takes over an account with established history, so the activity looks like a trusted user and is better placed to cash out. I also think attacks that once took real technical skill may be easier to attempt now, because AI-assisted scripting puts them within reach of more people. That could help explain a higher attack rate.
Less friction doesn’t necessarily mean more attacks. It can mean more effective ones. Digital Commerce has the lowest 2FA rate of any industry at 1.9%, down 35% from 2.9% a year ago, and its ATO attack rate rose 6% even as its payment fraud attack rate fell 34%. Travel and Ticketing sits at the other end with a 14.1% 2FA rate (up 20% year over year) and a steadier ATO attack rate (up 3% year over year). FIBR can’t prove cause, but the pattern is a strong reason, in my view, to look at where you added or removed friction this year. This is where layering risk rules matters. Instead of asking every user to verify every time, layer signals like new devices, unusual login locations, and login velocity, and save step-up checks for the sessions that look risky. That’s how you keep accounts secure without adding unnecessary friction for your trusted users.
What This Means for Q4 2026
Q3 shows that falling attack volume can coincide with rising ATO and review demand. Three signals have my attention heading into the holiday peak.
First, ATO attempts are up 71% year over year even as payment fraud attempts are down 13%, which suggests to me that fraud pressure is moving from the payment to the account. Second, 2FA use is down 18% over the same period, so authentication gaps deserve a closer look. Third, peak season will push review demand beyond team capacity, so decide in advance which rules you will loosen and how you will track the cost.
My advice: benchmark year over year, scrutinize ATO where authentication adoption is low, and plan review capacity before peak season. Teams that do will be better positioned for what’s ahead.
Putting AI to Work Responsibly
AI is helping both sides. At an iGaming conference I attended recently, much of the conversation centered on how fintechs, neobanks, and iGaming operators can use AI effectively with a human in the loop. I agree with that, especially in regulated areas. Regulators aren’t telling teams to avoid AI. They expect responsible use, which means being able to explain and answer for the decisions it supports. Three principles from one panel apply to any fraud team: start from a problem you already have, scale eyes and not hours, and test before you trust. Nothing should ship until it’s been checked against something a human already verified.
Using FIBR to Inform Strategy
I think the most effective fraud teams use benchmarks as a starting point for investigation, not a conclusion. A rate below the industry average can still mean unacceptable loss if your margins are thin, and a rate above it may be manageable if customer lifetime value supports it.
Key questions I’d ask for Q4 2026:
- Is your ATO rate rising even though your payment block rate is improving?
- Where did you add or remove friction this year, and what happened to account takeover afterward?
- Do your controls apply the same scrutiny to EFT and financing as to cards?
- How does your ATO rate compare with industries that have the highest 2FA adoption?
- Is your manual review capacity ready for peak season, and when will you adjust your rules?
- Are you comparing this peak with last year’s, not with last quarter?
- Are you on budget for your year-end target?
Explore the full Q3 2026 FIBR data to benchmark your performance and see where fraud is concentrating in your industry.
