For years, account takeover (ATO) followed a predictable script. Attackers bought stolen credentials in bulk, ran them through automated tools, and waited for matches. Credential stuffing was cheap, scalable, and for defenders, relatively well understood.
That era is ending. Not because attackers gave up, but because the front door finally got harder to kick in.
Passkeys are now mainstream. According to the FIDO Alliance’s 2026 research, 75% of global consumers have enabled a passkey on at least one account. At the same time, passkeys are becoming more common in the workplace, with 68% of companies now using, testing, or introducing them for employee sign-ins.
Phishing-resistant, passwordless authentication is no longer aspirational, it’s becoming the default. When the password disappears, so does the value of a stolen password.
So where does the attack go next? It moves downstream, to the moments where systems still trust a human to prove who they are.
The attack surface shifted, not shrank
When primary login flows harden, fraud doesn’t vanish. It relocates to the weakest remaining link, and in most architectures, that link is the identity verification and recovery layer.
Think about every flow that sits around authentication: account recovery, device re-enrollment, step-up verification for a high-value transaction, the magic link sent to “confirm it’s you.” These are increasingly the paths of least resistance.
Magic-link interception is a clear example. The convenience of emailing a one-time login link has a downside: if an attacker can intercept that link, through an unverified mobile deep link, a compromised inbox, or SIM-swap-enabled redirection. They can bypass the intended authentication flow entirely.
The data points in the same direction. Veriff’s Fraud Industry Pulse Survey 2026, based on responses from roughly 1,200 fraud and compliance decision-makers, found that organizations are facing a broad rise in online fraud, with impersonation fraud, malware, authorized fraud, and document fraud among the most commonly reported categories.
AI made impersonation cheap and convincing
The second force reshaping ATO is generative AI, which has turned identity verification itself into a target.
Veriff’s Identity Fraud Report 2026 found that 4.18% of verification attempts were fraudulent, and that digitally presented media was 300% more likely to be AI-generated or altered than in prior periods. Impersonation now accounts for more than 85% of all fraud attacks the company observed. Deepfaked selfies, injected video streams, and synthetic documents are no longer fringe techniques. They’re the mainstream of identity fraud.
The takeaway for defenders is uncomfortable but clear: if your verification step assumes the media in front of it is genuine, you’re defending against last year’s threat model.
Where ATO defense is heading
Account takeover defense is entering a new phase. Over the next 12 to 18 months, three shifts are likely to shape how organizations strengthen their controls.
Intent binding will become more important.
Proving who someone is is no longer enough. Organizations also need stronger assurance around what that person is authorizing. That is driving interest in intent binding: cryptographically linking a verified human action to the specific transaction or instruction being approved. As AI-driven injection attacks become more sophisticated, this approach is moving closer to a practical requirement for high-value and high-risk transactions.
Network-effect data will define defensive advantage.
Single-point checks are becoming easier to evade. A more durable advantage comes from identifying fraud patterns across millions of sessions, devices, and networks, then detecting coordinated attacks before they spread. Defense becomes stronger with scale, especially when signals can be analyzed across the person, document, device, and network rather than in isolation.
Regulatory pressure will continue to raise the baseline.
Compliance and security are becoming increasingly intertwined. Frameworks such as eIDAS 2.0, the Anti-Money Laundering Regulation, and DORA are pushing organizations toward stronger and more standardized identity assurance. At the same time, the phase-out of SMS-OTP is accelerating the move away from interceptable authentication factors. For many organizations, that means the minimum acceptable standard is quickly rising above their current controls.
What to do now
The practical path forward isn’t speculative. It rests on controls that already demonstrably reduce ATO: biometric liveness detection, for instance, has been shown to cut ATO by 80–90% when properly implemented.
Three priorities:
- Make passwordless authentication and biometric liveness baseline requirements, not premium add-ons. Phishing-resistant credentials plus liveness raise the cost of impersonation dramatically.
- Treat re-verification, magic-link flows, and step-up authentication as high-stakes events. They deserve the same scrutiny as initial onboarding, because attackers now target them first. Apply risk-based reverification rather than a single static check.
- Plan for intent binding and AI-resistant verification. Assume the media reaching your systems may be synthetic, and design controls that bind verified identity to verified intent.
The strategic shift is simple to state and hard to ignore. Fraud follows the path of least resistance, and once that’s authentication, it becomes verification. The teams that win in 2026 are the ones already defending the next link in the chain, not the ones attackers have already abandoned.
Note: This article has been expertly written and contributed by Anton Volkov, Senior Product Manager at Veriff.
