The Fraud Economy Scales Up: Payment Attacks, Account Takeover, and Coordinated Fraud Rings

The most dangerous ATO attacks don’t always look suspicious. Fraudsters may spend months inside a legitimate account, mirroring the owner’s behavior before taking action. But coordinated loyalty fraud doesn’t rely on compromised accounts alone. In this loyalty program fraud ring identified across the Sift network, bad actors used a mix of ATO’d accounts and born-bad accounts to commit first-party payments fraud and mileage plan abuse. They accessed legitimate loyalty accounts, changed associated email addresses, and redeemed or transferred points before account holders knew anything was wrong.

The ring spanned more than 90 businesses across multiple industries and generated nearly 13,000 attempted transactions. Because the cluster included victimized customers, compromised accounts, and fraudsters operating through newly created accounts, it produced mixed risk signals, with manual blocks and accepts coexisting inside the same connected network. That overlap makes blunt rules the wrong response: blanket blocks can lock out legitimate customers, while isolated decisions miss the broader pattern. Targeted friction interrupts suspicious behavior at the right moment while protecting trusted customer relationships.

Card testing is fraud infrastructure maintenance in production. Before attempting larger purchases or cash-out activity, fraudsters validate stolen cards through low-value, low-friction transactions at merchants where checkout leaves little time for additional verification. 

This food delivery ring followed that pattern closely. One email address cycled through 94 distinct credit cards, generating 390 transactions across five businesses while keeping average order value at $4.06, below common detection thresholds and going unnoticed by many cardholders. Chargebacks appeared at a single merchant, but the broader card footprint extended across the cluster. Once the pattern surfaced, the recommended response was to block associated users across the full ring.

A pattern is emerging in U.S. iGaming environments where phishers steal a card primary account number (PAN) and one-time passcode, provision the card into a digital wallet on their own device, create a device-specific DPAN, and run a deposit-and-cash-out cycle. On the surface, the activity can resemble legitimate wallet traffic unless fraud teams can distinguish digital wallet indicators, issuer BIN data, and DPAN BIN mappings inside their decisioning logic.

In this pattern, the majority of chargebacks traced back to a single credit union that didn’t require OTP or 2FA to provision a card into a digital wallet. Because digital wallets treat provisioning controls as the issuer’s responsibility, merchants still need downstream controls to catch abuse that issuer-level verification misses.

Banking and financial accounts led reported payment fraud incidence at 35%, followed by social media and food/grocery delivery at 22% each, and igaming/online gambling at 21%. The pattern reflects where consumers store credentials, save payment methods, and transact often, making everyday digital accounts attractive targets once access or payment data is compromised.

Fraud pressure did not peak evenly across industries, reinforcing that each vertical has its own fraud calendar. Across the Sift network, the highest overall fraud-pressure day in the past year was March 27, 2025, likely reflecting a mix of quarter-end activity, spring travel, tax-season identity abuse, and seasonal commerce. Industry peaks followed different patterns: Online Gambling peaked shortly after a major sports-betting period, Travel & Ticketing peaked during spring travel planning, and Digital Commerce and Food & Delivery peaked later in the year, when promotions, seasonal demand, and low-friction checkout flows can create more room for fraud testing. These dates can help fraud teams compare network-level peaks against their own spikes in traffic, declines, chargebacks, manual reviews, and step-up activity.

A fraud rate only tells part of the story. The financial exposure behind each decision depends on average order value, which varies widely by industry. In Q1 2026, Internet & Software had an average order value of $342, compared with $14 in Food & Delivery, meaning the same fraud rate can create very different revenue and loss implications. Fraud teams need to calibrate decisions by both risk and transaction value, using different threshold strategies for higher-value categories like Internet & Software (B2B and B2C software as a service), Finance & Fintech, Travel & Ticketing, and Online Gambling than they would for lower-value, high-frequency categories like Food & Delivery.

Average order value shows what’s at stake in each decision, while false-positive cost shows the revenue impact when trusted customers are blocked. Across the Sift network in Q1 2026, the average false-positive cost was $135, but the impact varied significantly by industry, reaching $496 in Digital Commerce and $396 in Online Gambling compared with $24 in Food & Delivery. Those differences reinforce why fraud controls need to be calibrated to economic exposure, not just fraud prevalence. A strict threshold may reduce fraud, but in higher-value categories it can also turn away substantial legitimate revenue.