Account takeover (ATO) attack volumes actually dropped 7% last quarter, but don’t let that fool you into a false sense of security.
Sift’s latest network data reveals a much more dangerous shift: fraudsters are abandoning sloppy, mass-volume login attacks and turning to highly targeted, surgical strikes. While login attempts fell, successful breaches caused downstream fraudulent chargebacks to explode by a staggering 75.6% quarter-over-quarter. The truth is, the losses that show up on a report only tell part of the story. A fraudster logging in with a stolen credential is simply the beginning of a longer, costlier campaign that plays out across every screen a customer touches next.
This blog will go over how modern account takeover works, and what your team can do to stop it.
Account takeover is a journey problem, not a login problem
Most fraud teams still treat account takeover as a point-in-time event: a bad login, flagged and blocked. That framing made sense when credential stuffing was the whole attack, but that simply does not hold up anymore.
Once a fraudster is inside a legitimate account, they behave like a patient operator, not a smash-and-grab thief. They check the loyalty balance, browse saved payment methods, confirm the shipping address on file, and wait. Sift’s Q2 2026 Digital Trust Index found that ATO attempts climbed 7% quarter over quarter, with internet and software fraud attacks up 6%, an industry where the payoff for post-login patience is high: stored value, transferable points, and subscription access that can be resold or drained slowly enough to avoid detection.
Treating account takeover as a login-only problem will result in a fraud team’s defenses going dark right when the fraudster becomes most active. A password reset, a new payee added, a shipping address changed, or a payout method swapped are all moments that matter, and all happen well after the point of authentication.
What post-login abuse looks like by segment
The journey looks different depending on the business, but the pattern of delayed, in-session abuse repeats across every ICP.
In e-commerce, a compromised account is used to place orders against saved cards, redirect shipments to a drop address, or drain stored gift card balances.
In marketplaces, the same access lets a fraudster list fraudulent goods under a seller’s trusted reputation, redirect payouts, or scrape buyer and seller data for a second wave of phishing.
In iGaming, account takeover is closely tied to bonus abuse and payout fraud. A fraudster logs into a real player’s account, claims a welcome bonus or loyalty reward the player never touched, and cashes out before the operator notices the login pattern changed.
In B2B and B2C SaaS, post-login abuse often means privilege escalation or data exfiltration: an attacker uses a compromised account to add API keys, invite new users into a workspace, or export customer data before anyone reviews the audit log.
Loyalty and rewards abuse cuts across nearly every one of these segments. Loyalty points carry an estimated global value of more than $30 trillion, and fraud losses run around 3% of that value every year, making loyalty fraud one of the fastest-growing fraud types tracked across retail, travel, and hospitality. Dormant or infrequently used loyalty accounts are especially exposed, since a points balance can sit untouched for months, giving a fraudster a wide window to drain it before the real customer notices.
Why point-in-time login defenses miss the abuse that follows
A login challenge, even a strong one, answers a single question: is this the right person, right now? It says nothing about what that person, or whoever is now in control of the session, does next.
Multi-factor authentication reduces the odds of a successful takeover at the front door, but it does not watch the session afterward. A fraudster who gets past authentication once, through a phished one-time passcode, a SIM swap, or a session token stolen by infostealer malware, inherits every privilege of a trusted, authenticated user for as long as that session lasts.
This is why fraud teams that only invest in login hardening keep seeing the same complaint from customers. They passed every security check, and their account still got drained. This is because the gap is not authentication, it’s everything after authentication; this includes the password change, the new device added without a second look, and the payout address updated an hour before a large withdrawal.
Building account defense that covers the full journey
Stopping account takeover across the full customer journey means connecting signals from login through every high-risk action that follows, rather than evaluating each step in isolation.
Sift’s Account Defense approach assesses thousands of signals, including device and network reputation, behavioral analytics, velocity across accounts, and historical patterns tied to an individual, and aggregates them into a score (referred to as a Sift Score) between 1 and 100, with 1 indicating a trustworthy signal set and 100 indicating a high likelihood of fraud. That score updates as new signals arrive, so a session that might have looked legitimate during login can be reassessed the moment a risky action happens, like a password reset, a new payment method, or a large transfer.
From there, Workflows let a fraud team route different score ranges to different outcomes automatically, so a moderate-risk session gets a step-up challenge while a high-risk one gets blocked outright, without an analyst reviewing every case by hand.
Dynamic Friction applies that same logic to the customer experience. Trusted sessions move through checkout or a payout request without added steps, while suspicious ones get an appropriate challenge, like a One-time passcode or a Verification step, calibrated to the actual risk rather than applied uniformly to everyone. When a case does need human judgment, Queues and Insights give analysts the context to make a fast, well-informed decision instead of digging through raw logs in the Sift Console.
This kind of connected defense matters most for the segments where post-login abuse is most lucrative. A marketplace can watch for a sudden change in payout destination on a seller account with years of clean history. An iGaming operator can flag a bonus claim from a device that never matches the player’s usual pattern. A SaaS platform can catch a new admin invite that follows a password reset by minutes rather than by days.
Closing the gap between detection and action
Detecting a takeover is only useful if a fraud team can act on it before damage is done. That means the signals feeding the Sift Score need to reach a Workflow fast enough to intervene before points are redeemed, funds are moved, or data leaves the building. It also means fraud analysts need visibility into why a session was flagged, not just that it was, so they can refine rules and reduce false positives over time.
A journey-wide approach treats login, session behavior, and high-risk actions as one continuous signal stream instead of three separate checkpoints that never talk to each other. Sift is exactly this, acting as an all-in-one fraud prevention service that closely monitors every point of an account, flags potential fraud actions, and automatically blocks immediate threats. If this sounds like something your business would benefit from, consider scheduling a free consultation today.
Frequently asked questions
What is the difference between account takeover and post-login abuse?
Account takeover refers to the initial unauthorized access to a legitimate customer’s account, typically through stolen credentials, phishing, or session hijacking. Post-login abuse describes everything the fraudster does after gaining access: draining loyalty points, changing payout details, placing fraudulent orders, or exfiltrating data. A defense strategy that only addresses the takeover moment leaves the abuse that follows unchecked.
Why is loyalty and rewards fraud connected to account takeover?
Loyalty accounts are frequently reused across long periods without a password change, and many sit dormant for months at a time. That combination makes them an attractive target for account takeover, since a fraudster who gains access can drain accumulated points before the real customer logs in again to notice.
Can multi-factor authentication alone stop account takeover?
Multi-factor authentication raises the difficulty of a successful takeover, but it does not eliminate risk. Fraudsters bypass it through phished one-time passcodes, SIM swaps, and session tokens stolen by infostealer malware. Once past authentication, the session itself needs continuous risk assessment, since MFA does not monitor what happens after login.
How does account takeover risk differ across e-commerce, marketplaces, iGaming, and SaaS?
The access is similar but the payoff differs. E-commerce fraudsters target stored payment methods and gift card balances. Marketplace fraudsters exploit seller reputation and redirect payouts. iGaming fraudsters chase bonus abuse and withdrawal fraud. SaaS fraudsters pursue data exfiltration and privilege escalation. Effective defense accounts for which high-risk actions matter most in each segment.
