By Bill Bradley, Product Marketing
Nearly 50% of consumers say fraud concerns are the top reason they would abandon a website entirely. Not pricing, not a competitor’s feature set, not a bad checkout experience, but fraud.
And the specific type of fraud accelerating fastest is account takeover (ATO), which rose 37% in 2025 even as overall digital fraud rates declined globally. ATO fraud, which was previously seen as a back-office security problem, is actually a customer experience concern, and the numbers make that uncomfortably clear.
TransUnion released their 1H 2026 Update: Top Fraud Trends with data to quantify the problem. In 2025, the ATO suspected fraud rate rose 37%, even as overall digital fraud rates declined globally. The volume of ATO transactions grew 13% in the same period. Meanwhile, US data breach volume jumped 47% (the primary pipeline feeding ATO attacks), with 78% of those breaches exposing full Social Security numbers. Threat actors are not slowing down, and are getting more targeted, more efficient, and more dangerous to the customers your business depends on.
Here is the part that should concern every security and fraud leader: 77% of consumers say confidence that their personal data is secure is the single most important factor when choosing who to transact with online. And 65% say fraud concerns are the top reason they would abandon a website entirely. The moment a customer’s account is compromised, their trust is gone. In most cases, so are they.
ATO is no longer just a fraud problem, and is a churn problem and a profitability problem.
Close the Gap Between When Credentials Are Stolen and When Your Team Finds Out
Flare gives security and fraud teams real-time visibility into the criminal underground — so you can act before your customers are affected, not after.
How ATO Actually Happens
The attack chain is well-established, even if the tools powering it are increasingly sophisticated. A data breach exposes credentials. Those credentials (usernames, passwords, session cookies) flow into criminal marketplaces and stealer log databases within hours. While session cookies are not credentials per se, they are an even greater enabler of account compromise: whoever holds them is authenticated. Fraudsters acquire them, test them at scale using automated tools, and begin taking over accounts before most consumers even know a breach occurred.
By the time a fraud team flags the anomaly, the attacker has already acted: drained loyalty points, initiated a transfer, changed contact details, or used the account as a launchpad for further compromise. The customer discovers what happened, contacts support, and, if they stay at all, carries permanent distrust of the platform.
The problem is not just detecting the attack. It is that most organizations are fighting the battle too late, at the wrong stage.
How to Comprehensively Win Against ATO
Effective ATO defense requires a strategy that covers the full lifecycle: before the attacker acts, after a credential is compromised, and throughout the recovery process. Most organizations focus on just one of these stages, usually after a credential is compromised, after the damage is already done.
Before the Attack
The window between credential theft and account compromise is narrow, but it exists. Stolen credentials and session cookies appear in criminal marketplaces within hours of a breach. Organizations that monitor those sources in real time can force a password reset or invalidate a session before the attacker ever logs in.
Prevention at this stage is the highest-leverage intervention in the entire fraud chain, because then the customer never experiences harm in the first place. No fraud event means no trust violation, no support ticket, and no churn risk.
When the Attacker is Inside
Speed is everything. The faster an active identity threat is detected and contained, the smaller the business impact: fewer accounts affected, lower fraud losses, less reputational damage. The capability to correlate signals and respond to in-progress compromise is what separates organizations that contain incidents from those that spend weeks in costly cleanups.
During Recovery
This is where customer trust is either rebuilt or lost. Re-verifying identity, restoring access securely, and closing the compromised pathway are not just technical steps. They are a customer experience. Done well, a fraud incident can actually reinforce trust. Done poorly (slow, frustrating, opaque), it accelerates the churn that began the moment the account was compromised.
The Business Case is Simple for ATO Prevention
Security and fraud teams often measure success in loss rates and detection metrics. But business leadership cares about revenue, retention, and reputation. ATO threatens all three simultaneously.
The organizations that will win are those that stop treating ATO as a fraud team problem and start treating it as a customer experience imperative: investing in upstream detection that catches stolen credentials before they are used, building response capabilities that contain compromise in minutes rather than days, and designing recovery processes that rebuild trust rather than destroying it. The breach pipeline is growing. Attackers are faster and better resourced than ever. And your customers are watching how you respond.
Close the Gap Between When Credentials Are Stolen and When Your Team Finds Out
Flare gives security and fraud teams real-time visibility into the criminal underground — so you can act before your customers are affected, not after.
