Fraud's identity crisis

Fraud isn’t new. But it’s no longer visible in a single moment.

Today, the behaviors that drive fraud often look legitimate at the point of transaction, such as a familiar customer on a recognized device. The pattern may only become clear over time, across accounts and interactions.

Fraud now adapts and operates in a continuous cycle, where tactics are deployed and refined in real time. What works is repeated, and what doesn’t is quickly dropped.

Rather than testing a single approach, attackers can run thousands of variations simultaneously — adjusting identity details, payment methods, speed at checkout, or transaction values to explore what gets through.

Automation keeps those attacks running continuously, applying what works and optimizing it in real time. Every outcome becomes feedback, with authorizations, declines, and downstream activity shaping the next attempt until it can pass a business’s fraud controls.

Automation and AI don’t create these patterns. They make them faster, more consistent, and easier to scale.

At the same time, automation and AI are changing how fraud behaves. AI has allowed fraudsters to bolster synthetic identities through deepfakes, falsified documents, and other tactics designed to evade standard checks.

Because these attacks are so easy to automate and scale, fraudulent actors no longer target only the largest platforms. Businesses of every size, in every industry, across every region can find themselves exposed to the same playbooks, executed with the same speed and precision. Fraudsters don’t operate within brand loyalty or competitive boundaries; once they uncover a loophole in one business, that same vulnerability is quickly tested and exploited across other businesses.

In practice, this means the same pattern can appear across multiple environments at once. The script that tests card numbers on one platform gets repurposed for another. The same promotion-cycling method runs across a dozen brands. The identity data that passed verification once gets reused until it doesn't. It may feel familiar, but the difference is speed and adaptability — how quickly tactics can be recycled.

Because these patterns span merchants, channels, and industries, businesses with access to larger, high-quality datasets are better positioned to spot and prevent fraud proactively.

Instead of only being concentrated in a small number of high-value transactions, fraud has expanded to include lower-value activity as it’s become easier to scale.

This changes the demands placed on fraud systems. Controls built for isolated, high-risk events now experience a continuous stream of activity, increasing both the volume of decisions and the ambiguity between legitimate and abusive behavior.

The impact goes beyond fraud losses. It shows up in rising manual review costs, increased false declines, and missed revenue opportunities.

Fraud no longer sits only with unknown identities. It now operates through identities and interactions that appear legitimate.

For years, fraud detection focused on a narrow set of questions, including: Is this a real person, and are they who they claim to be? Those questions still matter. But they are no longer enough.

The challenge is no longer just static identity verification at a single point in time, but understanding behavior as it unfolds across the customer lifecycle.

The same account or device can represent a genuine customer in one moment and abusive behavior in the next — like a new account linked to a real customer but created only to access a new promotion or a legitimate purchase later returned under false pretenses.

This shift is reflected in the types of fraud businesses are now facing.

First-party fraud, where customers make legitimate purchases then falsely dispute the charges through their bank — claiming non-receipt, defects, or unauthorized use when none occurred — is now one of the most common forms of abuse, reported by 44.3% of businesses in our survey.

Fake accounts and identity abuse, like cycling promotions, distributing activity, or accessing segment-specific offers, follows closely at 42.2%.

Policy and promotion abuse, where customers exploit merchant policies directly through serial returns, wardrobing, free trial cycling, loyalty point harvesting, or stacking discounts beyond their intent, are not far behind at 39.8%.

First-party fraud has entered the mainstream, and each type of abuse stems from legitimate identities, not by breaking into them. From the system’s perspective, these behaviors often look valid. They pass checks designed to identify unauthorized access or fraudulent payment details.

The challenge isn’t just identifying these users. It’s preventing abuse from being repeated.

Historically, fraud has moved to where defenses are weakest — for example, moving from exploiting physical cards in the days of magstripe technology to ecommerce. Now it’s increasingly moving back to in-person shopping. As online protections have matured, attackers are adapting by exploiting gaps in physical retail, where fewer signals and less mature controls make abuse harder to detect.

This pattern helps explain why issues like point of sale (POS) refund abuse are emerging as part of a broader redistribution of risk.

Not all abuse starts with malicious intent. In many cases, it begins with incentives.

A discount for new customers encourages multiple sign-ups. A generous return policy lowers the cost of misuse. Free trials become something to cycle through rather than a one-time benefit. Over time, activity that was once the exception becomes normalized.

Online communities openly share ways to “game” systems, from how to maximize promotions to how to get refunds approved. What might once have been considered fraud is reframed as a loophole, a hack, or simply a way to get better value. Customers who do not consider themselves fraudulent may still engage in actions that result in loss. 

For businesses, this makes the problem harder to define, let alone solve. Welcome to the grey area.

The challenge is not a lack of signals. Frequently, nothing stands out at the transaction level, and the pattern only emerges through repetition:

• Promotion access scaled across multiple accounts

• Free trials repeatedly cycled across identities

• Returns clustered just below policy thresholds

• Activity deliberately distributed to avoid detection

• Gift card fraud

As fraud becomes harder to distinguish from legitimate activity, the cost of getting a decision wrong can exceed the fraud loss itself.

A small fraction of identities now drives a disproportionate share of risk. But the controls used to stop them are applied much too broadly. In trying to prevent abuse from a minority of users, businesses introduce friction that affects everyone.

The real cost of fraud shows itself not just in what gets through but in what gets blocked. In some cases, static controls block up to 10% of legitimate customers, according to Adyen platform data.

False declines, unnecessary friction, and rising manual review costs are no longer side effects; they’re central to how fraud impacts revenue. 

Most fraud strategies were built to minimize loss. That model is now outdated.

Fraud management is increasingly understood as a series of commercial decisions that ultimately determine how much legitimate revenue a business can capture. 

The question is no longer how much fraud a business is willing to tolerate. The question is how much legitimate revenue it’s willing to lose trying to stop it.

When fraud rises, increased control can feel like the obvious response. More rules, more verification steps, more manual reviews, tighter policies — all of which add costs and friction. 

The impact is already visible. Minimizing operational costs became the top priority for 29% of merchants in 2025, up from just 10% in 2024, according to MRC data.

Our survey shows 58% of businesses are experiencing rising manual review costs, while 50% report an increase in false declines. With additional controls often relying on static signals, up to 10% of legitimate customers are blocked.

There’s a disconnect between perceived risk and reality. In trying to protect against a concentrated minority of abusive identities, businesses introduce cost and friction. Every false decline not only suppresses conversion in the moment but also undermines trust, retention, and future spend. It becomes a tax on your most valuable customers.

For most businesses, fraud management is a series of compromises. According to our survey, 97% of businesses made at least one fraud-related tradeoff in the last year.

Fraud prevention no longer works as a blunt instrument.

Applied broadly, controls increase cost, reduce conversion, and erode trust. Applied precisely, they become a growth lever — improving approval rates, reducing unnecessary friction, and protecting long-term customer value. Not reacting to isolated transactions but understanding patterns. Not applying friction uniformly but allocating it where it has the greatest impact.

The next question is what it actually takes to tell the difference.

If traditional identity checks can’t distinguish legitimate customers from abuse, what can?

Earlier chapters described a fraud environment in which a rapidly-growing risk comes from recognized users: verified accounts, familiar devices, and activity that passes every checkpoint.

This shift means that distinguishing legitimate customers from abuse is harder than ever.

The answer isn’t stronger verification. Identity is no longer a credential to be confirmed once. It’s dynamic — a continuous layer of context built from activity across the customer lifecycle, rather than validated at a single point in time.

Verification answers a binary question at a single moment — is this person who they claim to be? And recognition builds a view over time — does this activity fit the pattern of a trusted customer?

The difference matters because fraud has learned to pass verification. What it can't easily replicate is a consistent behavioral history. A returning customer purchasing within their typical range on a recognized device moves through with minimal friction. But when that same pattern shifts — into unusually frequent returns, promotion cycling, or activity distributed across multiple accounts — the change in intent becomes visible, even when the identity itself hasn't changed.

Trust is earned and tracked, not granted once and assumed.

The value of connected identity compounds across a wider network. A single merchant can build behavioral context within their own ecosystem. But network-level recognition — drawing on signals across a variety of merchants and devices — creates a richer picture from the very first interaction.

Across Adyen's global network, there is an 84% chance that an identity has already appeared across transactions, businesses, payouts, or card issuing. That means even new customer relationships can begin with context, allowing for more confident decisions earlier and less friction for customers who've already demonstrated trusted behavior elsewhere.

It's a system where recognition becomes reputation.

Historically, fraud prevention has centered around two fundamental challenges: identifying good actors vs. bad actors — typically through behavioral signals — and authenticating authority to ensure the person initiating a transaction is allowed to do so.

Agentic commerce introduces a third participant, the agent, which both complicates these problems and creates new ones entirely. Merchants must now also:

• Identify legitimate agents vs. malicious or exploitative ones

• Verify that an agent is authorized to act on behalf of a customer

• Ensure the agent is operating within the bounds of what the customer actually intended

This last dimension, intent, is new. Even a legitimate, authenticated agent may behave in ways that diverge from user expectations due to optimization strategies, adversarial manipulation, or misaligned incentives.

That shift makes agentic commerce a distinct fraud challenge — not simply a faster version of what came before. The risk isn’t only that bad actors will deploy agents. It’s that trusted agents and malicious ones are increasingly indistinguishable at the point of transaction, and that existing systems weren’t designed to tell them apart. 

Agentic commerce is expected to influence a meaningful share of payment volume within the next five years. But its impact is uneven across industries, and so is the risk.

In the age of agentic commerce, it’s no longer enough to apply fraud controls at checkout. By the time an agent reaches that point, many decisions have already been made, often inside systems the merchant cannot observe or control. The result is greater exposure to chargebacks, refund abuse, promotion exploitation, and transactions that are technically valid but misaligned with user intent

In short, trust must be established earlier across systems, protocols, and participants — not just at the moment of payment.

These challenges are still evolving, but a few clear approaches are emerging:

Behavioral intelligence

Fraud systems must adapt to recognize agent-specific behavioral patterns, not just human ones. This includes training models on agent-driven interaction patterns, capturing signals earlier in the transaction lifecycle, and sharing more data across ecosystem participants including merchants, networks, issuers, and AI platforms.

Agent identification

A critical capability will be distinguishing trusted agents from untrusted ones. This will likely depend on collaboration with payment networks and financial institutions, shared identity frameworks or registries for agents, and standardized signals indicating agent provenance and reputation.

Authentication and delegation

Existing authentication systems were not designed for delegated commerce. Work is underway to extend current protocols to support agent-based authorization, define how consent and delegation are captured and verified, and align emerging transaction patterns with industry standards and regulatory frameworks.

The mechanics of fraud have fundamentally shifted. In 2026, the most significant risks no longer sit at the perimeter; they operate within the systems and behaviors built for legitimate customers. This shift makes traditional controls less effective and broad friction more costly.

It’s not about more controls but about more precision — using dynamic identity, behavior, and context to distinguish between trust and risk earlier in the customer journey.

In doing so, fraud management becomes more than a defensive function. It becomes a way to protect revenue and drive growth while making better decisions about where and how trust is applied.