What: Organised fraud groups are increasingly targeting retail accounts and loyalty programmes with advanced verification bypass and synthetic identity techniques, driving a surge in account takeovers and bot-driven attacks.

Why it is important: This escalation reflects a broader industry shift toward more targeted, sophisticated fraud, requiring retailers to strengthen layered defenses and real-time monitoring.

The Q1 2026 RH-ISAC benchmarks reveal a significant transformation in the account fraud landscape, with organized criminal groups leveraging advanced verification bypass and synthetic identity techniques to exploit retail, QSR, airline, and accommodation accounts. Retailers are now facing a surge in account takeovers, loyalty program abuse, and bot-driven attacks, particularly around high-demand products. The professionalisation of fraud services, including KYC and 2FA bypass, has made it increasingly difficult for traditional security measures to keep pace. Macroeconomic pressures, such as inflation and geopolitical instability, have further increased the value of stored credits and loyalty points, making them prime targets for sophisticated fraudsters. As legal and regulatory frameworks struggle to keep up with rapid technological advances, retailers are compelled to implement their own adaptive security strategies, focusing on layered defences, real-time intelligence sharing, and cross-functional collaboration to protect customer trust and business continuity.

IADS Notes: The Q1 2026 RH-ISAC findings align with recent industry reports, such as the May 2026 Retail Dive analysis documenting a shift toward targeted account takeovers and the March 2026 RH-ISAC emphasis on integrating cybersecurity with fraud prevention. The June 2025 Sainsbury’s loyalty programme breach illustrates the vulnerability of digital assets, while the March 2026 and April 2026 articles highlight how rapid AI adoption is outpacing security measures, exposing retailers to new risks. These developments collectively underscore the urgent need for adaptive, layered security and real-time monitoring to sustain customer trust and operational resilience.

Inside the account fraud economy: Q1 2026 benchmarks for retail