Loading...

Account Takeover: The Defense in Depth Strategy

by Guest Contributor 4 min read December 22, 2020

Preventing account takeover (ATO) fraud is paramount in today’s increasingly digital world. In this two-part series, we’ll explore the benefits and considerations of a Defense in Depth strategy for stopping ATO.

The challenges with preventing account takeover

Historically, managing fraud and identity risk in online banking has been a trade-off between customer experience and the effectiveness of fraud controls. The basic control structure relies on a lock on the front door of online banking front door—login—as the primary authentication control to defend against ATO.

Within this structure, there are two choices. The first is tightening the lock, which equals a higher rate of step-up authentication challenges and lower fraud losses. The second is loosening the lock, which results in a lower challenge rate and higher fraud loses. Businesses can layer in more controls to reduce the false positives, but that only allows marginal efficiency increases and usually represents a significant expense in both time and budget to add in new controls.

Now is the perfect time for businesses reassess their online banking authentication strategy for a multitude of reasons:

  • ATO is on the rise: According to Javelin Strategy & Research, ATO increased 72% in 2019.1
  • Users’ identities and credentials are at more risk than ever before: Spear phishing and data breaches are now a fact of life leading to reduced effectiveness of traditional authentication controls.
  • Online banking enrollments are on the rise: According to BioCatch, in the months following initial shelter-in-place orders across the country, banks have seen a massive spike in first time online banking access.
  • Users expect security in online banking: Half of consumers continue to cite security as the most important factor in their online experience.

Businesses who reassess the control structure for their online banking will increase the effectiveness of their tools and reduce the number of customers challenged at the same time – giving them Defense in Depth.

What is Defense in Depth?

Defense in Depth refers to a strategy in which a series of defense mechanisms are layered in order to protect data and information.

The basic assumptions underlying the value of a Defense in Depth strategy are:

  • Different types of transactions within online banking have different levels of inherent risk (e.g., external money movement is considerably higher risk compared to viewing recent credit card transactions)
  • At login, the overall transaction risk associated with the session risk is unknown
  • The risk associated with online banking is concentrated in relatively small populations – the vast majority of digital transactions are low risk

This is the Pareto principle at play – i.e., about 80% of online banking risk is concentrated within about 20% of sessions. Experian research shows that risk is even more concentrated – closer to >90% of the risk is concentrated in <10% of transactions. This is relatively intuitive, as the most common activities within online banking consist of users checking their balance or reviewing recent transactions. It is much less common for customers to engage in higher risk transaction. The challenge is that businesses cannot know the session risk at the time of challenge, thus their efficiency is destined to be sub-optimal.

The benefits of Defense in Depth

A Defense in Depth strategy can really change the economics of an online banking security program. Adopting a strategy that continuously assesses the overall session risk as a user navigates through their session allows more efficient risk decisions at moments that matter most to the user. With that increased efficiency, businesses are better set up to prevent fraud without frustrating legitimate users.

Defense in Depth allows businesses to intelligently layer security protocols to protect against vulnerability – helping to prevent theft and reputational losses and minimize end-user frustration. In addition to these benefits, a continuous risk-based approach can have lower overall operational costs than a traditional security approach.

The second part of this series will explore the cost considerations associated with the Defense in Depth strategy explored above. In the meantime, feel free to reach out to discuss options.

Contact us

1Identity Fraud in the Digital Age, Javelin Strategy & Research, September 2020

Related Posts

For many banks, first-party fraud has become a silent drain on profitability. On paper, it often looks like classic credit risk: an account books, goes delinquent, and ultimately charges off. But a growing share of those early charge-offs is driven by something else entirely: customers who never intended to pay you back. That distinction matters. When first-party fraud is misclassified as credit risk, banks risk overstating credit loss, understating fraud exposure, and missing opportunities to intervene earlier.&nbsp; In our recent Consumer Banker Association (CBA) partner webinar, “Fraud or Financial Distress? How to Differentiate Fraud and Credit Risk Early,” Experian shared new data and analytics to help fraud, risk and collections leaders see this problem more clearly. This post summarizes key themes from the webinar and points you to the full report and on-demand webinar for deeper insight. Why first-party fraud is a growing issue for banks&nbsp; Banks are seeing rising early losses, especially in digital channels. But those losses do not always behave like traditional credit deterioration. Several trends are contributing:&nbsp; More accounts opened and funded digitally&nbsp; Increased use of synthetic or manipulated identities&nbsp; Economic pressure on consumers and small businesses&nbsp; More sophisticated misuse of legitimate credentials&nbsp; When these patterns are lumped into credit risk, banks can experience:&nbsp; Inflation of credit loss estimates and reserves&nbsp; Underinvestment in fraud controls and analytics&nbsp; Blurred visibility into what is truly driving performance&nbsp; &nbsp;Treating first-party fraud as a distinct problem is the first step toward solving it.&nbsp; First-payment default: a clearer view of intent&nbsp; Traditional credit models are designed to answer, “Can this customer pay?” and “How likely are they to roll into delinquency over time?” They are not designed to answer, “Did this customer ever intend to pay?” To help banks get closer to that question, Experian uses first-payment default (FPD) as a key indicator. At a high level, FPD focuses on accounts that become seriously delinquent early in their lifecycle and do not meaningfully recover.&nbsp; The principle is straightforward:&nbsp; A legitimate borrower under stress is more likely to miss payments later, with periods of cure and relapse.&nbsp; A first-party fraudster is more likely to default quickly and never get back on track.&nbsp; By focusing on FPD patterns, banks can start to separate cases that look like genuine financial distress from those that are more consistent with deceptive intent.&nbsp; The full report explains how FPD is defined, how it varies by product, and how it can be used to sharpen bank fraud and credit strategies. Beyond FPD: building a richer fraud signal&nbsp; FPD alone is not enough to classify first-party fraud. In practice, leading banks are layering FPD with behavioral, application and identity indicators to build a more reliable picture. At a conceptual level, these indicators can include:&nbsp; Early delinquency and straight-roll behavior&nbsp; Utilization and credit mix that do not align with stated profile&nbsp; Unusual income, employment, or application characteristics High-risk channels, devices, or locations at application Patterns of disputes or behaviors that suggest abuse&nbsp; The power comes from how these signals interact, not from any one data point. The report and webinar walk through how these indicators can be combined into fraud analytics and how they perform across key banking products.&nbsp; Why it matters across fraud, credit and collections Getting first-party fraud right is not just about fraud loss. It impacts multiple parts of the bank. Fraud strategy Well-defined quantification of first-party fraud helps fraud leaders make the case for investments in identity verification, device intelligence, and other early lifecycle controls, especially in digital account opening and digital lending. Credit risk and capital planning When fraud and credit losses are blended, credit models and reserves can be distorted. Separating first-party fraud provides risk teams a cleaner view of true credit performance and supports better capital planning.&nbsp; Collections and customer treatment Customers in genuine financial distress need different treatment paths than those who never intended to pay. Better segmentation supports more appropriate outreach, hardship programs, and collections strategies, while reserving firmer actions for abuse.&nbsp; Executive and board reporting Leadership teams increasingly want to understand what portion of loss is being driven by fraud versus credit. Credible data improves discussions around risk appetite and return on capital.&nbsp; What leading banks are doing differently&nbsp; In our work with financial institutions, several common practices have emerged among banks that are getting ahead of first-party fraud: 1. Defining first-party fraud explicitly They establish clear definitions and tracking for first-party fraud across key products instead of leaving it buried in credit loss categories.&nbsp; 2. Embedding FPD segmentation into analytics&nbsp;They use FPD-based views in their monitoring and reporting, particularly in the first 6–12 months on book, to better understand early loss behavior.&nbsp; 3. Unifying fraud and credit decisioning&nbsp;Rather than separate strategies that may conflict, they adopt a more unified decisioning framework that considers both fraud and credit risk when approving accounts, setting limits and managing exposure.&nbsp; 4. Leveraging identity and device data They bring in noncredit data — identity risk, device intelligence, application behavior — to complement traditional credit information and strengthen models.&nbsp; 5. Benchmarking performance against peers&nbsp;They use external benchmarks for first-party fraud loss rates and incident sizes to calibrate their risk posture and investment decisions.&nbsp; The post is meant as a high-level overview. The real value for your teams will be in the detailed benchmarks, charts and examples in the full report and the discussion in the webinar.&nbsp; If your teams are asking whether rising early losses are driven by fraud or financial distress, this is the moment to look deeper at first-party fraud.&nbsp; Download the report: “First-party fraud: The most common culprit”  Explore detailed benchmarks for first-party fraud across banking products, see how first-payment default and other indicators are defined and applied, and review examples you can bring into your own internal discussions.&nbsp; Download the report Watch the on-demand CBA webinar: “Fraud or Financial Distress? How to Differentiate Fraud and Credit Risk Early”&nbsp; Hear Experian experts walk through real bank scenarios, FPD analytics and practical steps for integrating first-party fraud intelligence into your fraud, credit, and collections strategies.&nbsp; Watch the webinar First-party fraud is likely already embedded in your early credit losses. With the right analytics and definitions, banks can uncover the true drivers, reduce hidden fraud exposure, and better support customers facing genuine financial hardship.

by Brittany Ennis 4 min read February 12, 2026

Discover why Experian’s unified fraud prevention platform, backed by decades of data stewardship and AI innovation, is the trusted choice for enterprises seeking scalable, compliant, and transparent identity verification solutions.

by Laura Davis 4 min read December 8, 2025

Learn how you can mitigate e-commerce fraud with identity verification and fraud prevention best practices.

by Theresa Nguyen 4 min read December 3, 2025

Subscribe to our blog

Enter your name and email for the latest updates.

This site is protected by reCAPTCHA and the Google Privacy Policy and Terms of Service apply.

Subscribe to our Experian Insights blog

Don't miss out on the latest industry trends and insights!
Subscribe