The Fight Has Moved Past the Login

MFA did its job at the door, and it belongs there. The next move is to carry that protection to where the fight actually happens now: the authenticated session. Get it right and you keep good users flowing while quietly closing the gap fraud has moved into. Because that’s exactly where organized fraud has gone. Attackers wait for a real user to sign in, then take over the authenticated session, and there are many ways to get one: malware that lifts cookies off the device, phishing kits that sit in the middle of a real login, malicious browser extensions, and more. The method matters less than the result. What they end up with is a live, logged-in session in someone else’s hands, with no password stolen and no MFA prompt to answer. To the user, it surfaces as charges they never made or a payout that never arrives; to your team, it’s one more dispute in the queue that looked completely legitimate on the way in. This is a large and growing pattern. Microsoft records roughly 600 million identity attacks a day, and more than 99% of them target passwords, which is exactly why sophisticated actors have industrialized the next step: taking over the session once a real user is already in. And the cost keeps climbing. The FBI’s Internet Crime Complaint Center reported more than $16 billion in cybercrime losses in 2024, up 33% in a single year. For a trust and fraud team, the question isn’t whether you’ll see this. It’s how you catch it early, act with confidence, and show the call was right.

The Friction Paradox: Why Your Strongest Signal Now Points at Good Users

Conversion depends on a frictionless experience, so your platform runs on long-lived session tokens that keep users signed in across web and mobile. A session token is simply the credential your platform issues at login to keep someone signed in, so whoever holds a live token is treated as that user, no password required. That’s the right call for the business, and it’s also the opening fraud takes. Once a session is taken over, the attacker inherits your user’s trusted status instantly. No password. No MFA challenge. And this isn’t limited to free or trial accounts. Every logged-in account runs on a session, and the higher the account’s value, the more attractive the takeover. That now includes AI sessions themselves: a stolen seat to a paid generative-AI tool or enterprise AI assistant is exactly the kind of high-value session attackers want. To your automated checks, the request looks like it’s coming from the customer. Which is the hard part you already live with: the strongest signal you have (a valid, authenticated session) is now the fraudster’s best disguise. To your defenses, the attacker looks exactly like the customer. The opportunity is telling them apart in real time, while still letting good users through.

The Blast Radius: Beyond a Single Account Takeover

When token fraud lands on a multi-sided platform, it doesn’t stay one account takeover, and it doesn’t stay one team’s problem. Because every hijacked session looks legitimate, the abuse routes straight into the work your team already owns: review queues, disputes, and payout investigations that grow faster than you can staff.

• On the demand side · Buyers — Hijacked sessions ride one-click checkout, drain stored loyalty value, and push fraudulent transactions before the real user notices. Each one comes back as a chargeback to represent and a “was this really fraud?” review. Every rule you tighten to catch it also risks blocking a real buyer, so the queue and the tuning burden climb together.
• On the supply side · Merchants & sellers — A compromised seller account is never a single fix. It’s a high-touch investigation every time: payout holds, banking-change and re-verification, support escalations, counterfeit-listing cleanup. Multiply that across accounts and it’s caseload your headcount can’t scale to.
• For streaming, content & creator platforms — At scale, operators harvest sessions and run them as farms of “trusted” accounts: reselling premium access, botting views and engagement, and laundering funds through subscriptions, tips, and in-app currency, while hijacked creator sessions get payouts diverted and channels taken over. Because every token looks like a real viewer or creator, the abuse buries itself in legitimate traffic and corrupts the very analytics your models and analysts rely on.

None of this is exotic. It’s volume, and volume is the problem: the loss is real, but so is the operational drag, and both land on a team that can’t hire its way out. That’s the case to take upstairs: not just fraud caught, but caseload contained.

Defend the Journey, Not Just the Gate

If your fraud program stops at the login window, everything downstream is exposed, and you’re left reconciling losses instead of preventing them.

In a world of automated fraud, a valid token can’t be taken at face value.

The opportunity is to close that gap with continuous, automated validation of every session that monitors the whole journey and acts in real time, without the friction that pushes good users away, and without standing up a program you don’t have the headcount to run. FiveBy pairs that automation with experienced practitioners who operate it alongside your team, so signals become decisions instead of another dashboard to watch. You can start with one capability and expand as you see results. None of this replaces MFA. It extends that protection to the session. Three moves make it work:

1. Contextual and behavioral signal analysis — AI reads the whole journey continuously. Does the way this session moves, navigates, and transacts break from the user’s own baseline? The point isn’t more signals. It’s signals that resolve into a decision.
2. Device and network intelligence — Tie each session to the device and network it began on. When a live token suddenly appears on a new device, from an impossible location, or behind a mismatched fingerprint, that’s a clean, explainable reason to step it up or shut it down, one you can put in front of anyone.
3. Operational calibration, operated with you — Models and playbooks tuned continuously against your real traffic (by automation and by FiveBy practitioners working alongside your team), so you clear good users and hold a high-fidelity trigger on genuine abuse. That’s the difference between “we have signals” and “we made the right call, and here’s why.”

Scope a Pilot

How confident are you that the sessions you trust today are still the users you onboarded? At FiveBy, we help trust and fraud teams make confident, defensible decisions about the sessions they trust, combining experienced practitioners, intelligence, and AI-powered technology to catch abuse tools alone miss, and operating it alongside your team without disrupting the customer journey or adding headcount. Let’s scope a pilot: start with one capability, with the proof and the numbers you can take to finance.

Limit your risk, not your business.

---

Sources

1. Microsoft, 2024 Microsoft Digital Defense Report. com/security/security-insider
2. FBI Internet Crime Complaint Center (IC3), 2024 Internet Crime Report. gov/AnnualReport

For years, fraud has been treated as a series of isolated incidents. A fraudulent transaction, a compromised account, a chargeback, a fake user, or a policy violation triggers an investigation, gets routed to the right team, and is eventually closed. The assumption underneath is that every incident is a discrete problem that can be resolved on its own. That assumption is breaking down.

Why are fraud incidents no longer isolated?

Because the actors behind them are organized. Most companies now face coordinated operations, not lone bad actors, and one group’s activity surfaces separately to security, fraud, and Trust & Safety. What looks like unrelated incidents is often one entity seen from different angles. Each event looks manageable on its own. Together, they describe one entity operating across the platform. That is the core idea behind entity intelligence: the risk lives in the whole entity behind the account, not in any single signal it trips.

What does “the account is the inventory” mean?

It means a compromised account is not the prize but stock to be sold. One group steals it, another supplies the infrastructure, a third monetizes it, and it may be resold to thousands of buyers. The account is inventory in a larger operation.

Which businesses are most exposed to this kind of fraud?

Any business where accounts carry value: creator platforms, marketplaces, gaming, subscription services, loyalty programs, and fintechs. Attackers are not after access itself but after assets they can monetize, rent, resell, or transfer. Wherever value exists, organized actors find a way to reach it.

If everyone has more data, why is fraud still winning?

Because the problem is context, not data. Security, fraud, Trust & Safety, and operations each see one symptom of the same activity, and no team owns connecting them. You can flag every alert and still not know who is behind it. More data is not the answer. Better context, resolved into a single entity, usually is. 94%. In one FiveBy analysis of 300,000 accounts already flagged for fraud, 94% would have fallen into the highest-risk band at account creation, before the loss occurred.

What separates the fraud programs that pull ahead?

They turn understanding into decisions they can defend. The programs that win are not the ones catching the most incidents but the ones that recognize the entity and business model behind the activity and act early, before the loss lands. If you lead one of those programs, the shift is from reacting to events to recognizing the entity driving them, and deciding with enough confidence to act before the chargeback or payout occurs.

How does FiveBy help?

FiveBy is a risk-intelligence partner. We pair practitioners who have built fraud programs for more than fifteen years with purpose-built technology that resolves entities and maps their connections, so you can see the whole entity behind an account and decide with confidence. Handled this way, the goal stops being damage control. When you can see the whole entity, you can tell a trusted new customer from an organized threat at signup, approve more of the good with less hesitation, and defend every call you make. That is the difference between limiting your business to limit risk and limiting the risk so the business can grow. The future of fraud prevention will not belong to the organizations that investigate the most incidents. It will belong to the ones that understand the businesses behind them, and turn that understanding into confident, sustainable growth.

Frequently asked questions

What is entity intelligence?

Entity intelligence evaluates the whole entity behind an account, its identity, relationships, and behavior over time, rather than scoring isolated signals. It classifies entities by risk and explains why, so teams can make faster, defensible decisions about trust, fraud, and payments.

Why treat fraud as organized rather than as isolated incidents?

Because most abuse now involves multiple specialized actors who acquire, monetize, and resell access. Investigating incidents one at a time misses the connections between them. Identifying the shared entity behind the activity reveals the larger operation and where the real risk sits.

Which industries are most affected by account-based fraud?

Any business where accounts hold value: creator platforms, online marketplaces, gaming, subscription services, loyalty programs, membership organizations, and fintechs. In each, attackers pursue assets they can monetize, rent, resell, or transfer, not access for its own sake.

Can fraud be caught before the loss happens?

Often, yes. In one FiveBy analysis of 300,000 accounts already flagged for fraud, 94% would have fallen into the highest-risk band at account creation. Recognizing the entity early lets teams act before a chargeback or payout occurs.

What is a risk-intelligence partner?

A risk-intelligence partner combines experienced practitioners with purpose-built technology to help a company understand the entities behind its accounts and act on them. FiveBy works alongside a team’s existing tools and infrastructure rather than replacing them.

When results become inconsistent, the issue is rarely a failure of detection; it is a failure of what happens after the alert fires.

The Hidden Breakdown: The Handoff to Judgment

A breakdown occurs when the tech stack identifies a mid-risk score or a set of mixed signals and hands the case off to human judgment. This is where divergence begins. Without explicit, shared criteria, “defensible” decisions (decisions that can be explained in isolation) quickly become “inconsistent” ones across the broader team. In practice, we see this systemic breakdown manifest in four specific ways:

Thresholds That Age Quietly: A score that meant “review” six months ago may no longer be relevant. As attacker behavior changes and legitimate customer patterns shift, static thresholds lead to a gradual increase in false positives or overlooked losses. The system behaves as configured, but the configuration no longer matches the environment.

Escalation Without Shared Criteria: When two reviewers look at the same case and reach different conclusions, the problem isn’t their experience, it’s the lack of explicit criteria. If one reviewer blocks based on velocity while another approves based on account age, the outcome depends on the individual rather than the policy.

Automation Beyond Its Original Scope: Rules are often introduced to reduce volume, but eventually, nuanced cases start being auto handled by systems that were never intended for that level of complexity. Reviewers lose visibility, and the system begins running outside its original strategic intent.

Business Misalignment: Tools are often set with general assumptions that fail to account for a specific company’s risk tolerance or revenue sensitivity. The tool may perform “correctly” according to its code, but its impact on the business is misaligned.

Micro-Case Study #1: The Consistency Gap

Consider a marketplace that saw rising refund volumes and customer complaints, yet no single fraud alert was firing consistently. The team had plenty of data, but because each event looked “normal” in isolation, no detection was triggered.

Inside the review queue, the problem was compounded by subjectivity. Reviewers regularly disagreed on mid-risk cases: one would weight account history while another focused on transaction velocity. Both were “correct” in their reasoning, but the inconsistency meant that the same type of fraud was being approved by one person and blocked by another. Once decision rules were made explicit and tested against past cases, escalation dropped significantly and outcomes stabilized. No new signals were added; the team simply aligned their interpretation of the signals they already had.

Micro-Case Study #2: The Static Threshold Trap

In another instance, a mature risk team relied on a score threshold that had been highly effective at launch. However, as attackers adapted, the threshold “aged” quietly. The stack remained the same, but the behavior of the attackers became more subtle. Because the thresholds weren’t recalibrated based on current behavior, review queues grew uncontrollably and false positives spiked. The solution wasn’t a new tool; it was recalibrating the judgment calls within the existing stack.

The “More Signal” Fallacy

When outcomes stall, the instinctive reaction is to add more signal, more rules, more models, and more data points. However, if the interpretation of the current data is inconsistent, adding more data only increases the debate. More alerts increase volume, and more signals increase escalation. You end up with more activity, but not more consistency.

Calibration: Moving Beyond the Framework

To change outcomes, decisions must be made consistently under the same conditions, a process we call Calibration. This isn’t a theoretical policy rewrite; it is an operational discipline that involves working inside live workflows to:

• Identify exactly where decisions diverge between reviewers.
• Define how specific signals should be weighted in different contexts.
• Revisit thresholds based on current, observed behavior rather than historical assumptions.
• Clarify the precise boundaries where automation should stop and human review should begin.

At FiveBy, we focus on making the work repeatable. We move the criteria out of people’s heads and into documented, tested investigation workflows and escalation playbooks.

The Results of a Calibrated Program

Within weeks of shifting focus toward decision consistency, organizations see tangible improvements:

• Repeated case types stop resurfacing in the queue.
• Escalation rates drop as reviewers gain confidence in the criteria.
• Decisions become faster and are no longer dependent on which individual handles the case.

The system becomes predictable because the interpretation is shared. You aren’t just reacting to alerts; you are managing a system with intentionality.

The Diagnostic Question

If you want to know if your program is struggling with this breakdown, stop looking at your detection dashboards for a moment and ask one question:

“Would two different reviewers make the same decision on the same case today?”

If you can’t answer with a definitive “yes,” that is exactly where your work needs to begin.

Most organizations don’t start with a clearly defined fraud problem.

They start with something harder to explain.

Revenue doesn’t reconcile cleanly. Behavior feels off but doesn’t trigger alerts. Complaints surface, but they don’t map to known patterns. The same edge cases keep resurfacing in different parts of the business.

Nothing points to a single issue. No dashboard is lighting up. But something isn’t right.

This is often the earliest stage of fraud, before it’s measured, named, or clearly owned.

When fraud exists before it’s visible

In many organizations, fraud doesn’t begin as an obvious spike or a clean pattern. It shows up as small inconsistencies spread across systems and teams.

Looked at one event at a time, everything appears normal.

Taken together, value is leaking in ways no one can fully explain.

The problem isn’t a lack of data. In most cases, the signals already exist. What’s missing is visibility into how activity connects across the system.

Fraud at this stage isn’t an alerting problem. It’s a context problem.

Why more signal doesn’t always fix this stage

When something feels wrong but can’t be clearly identified, the instinct is to add more detection.

More rules. More models. More thresholds.

But additional signal rarely resolves early‑stage fraud. It often makes it harder to see what’s actually happening.

Why?

Because fraud at this stage isn’t hiding inside a single event. It moves across flows, accounts, payments, promotions, referrals, or content, changing shape as it goes.

If you only look at isolated moments, you miss the sequence.

A common pattern we see

Context: A marketplace saw rising refunds and customer complaints, but no single fraud alert was firing consistently.

What looked normal: Each transaction passed standard checks. Accounts appeared legitimate. Individual events didn’t cross thresholds.

What was actually happening: The same actors were testing limits across multiple entry points, small amounts, spread out, designed to look like edge cases rather than attacks.

What changed: Instead of asking “Which events are fraudulent?”, the team mapped how value could be extracted end‑to‑end and traced activity across systems.

Outcome: Patterns became visible that had been impossible to see in isolation. Fraud could be named, scoped, and owned.

This isn’t about finding more bad events. It’s about understanding how abuse actually works inside your business.

The shift that unlocks visibility

Teams that break out of this stage stop asking only:

“Which alerts should fire?”

And start asking:

“If someone wanted to extract value from our system today, how would they do it, step by step?”

That question changes everything.

It reframes fraud from a detection exercise into a systems problem. It exposes where assumptions break, where controls don’t connect, and where ownership is unclear.

Once the sequence is visible, measurement follows. Ownership follows. Action becomes possible.

A diagnostic question

If you had to explain, without dashboards or alerts, how value could be extracted from your system today, end‑to‑end, could you?

If not, you may already have fraud.

You just can’t see it yet.

 

Let’s Talk

Contact us to learn how we can help you add context to your fraud signals. 

“Automation excels at speed and scale, but it’s human insight that brings context and clarity.”

In the fight against fraud, where tactics evolve rapidly, relying solely on one approach can leave gaps. Use automation to handle high-volume, precision-driven tasks, but always pair it with human expertise for nuanced decision-making. A balanced strategy ensures you’re not just reacting to threats—but staying ahead of them.

FiveBy’s Approach To AI

Speed

• Replace manual processes
• Accelerate decision-making

Accuracy

• Reduce human error
• Decrease false positives
• Quantify confidence levels

Value

• Maximize human contribution/time
• Reduce solution overhead