This article is sponsored by Riskified and was written, edited, and published in alignment with our Emerj sponsored content guidelines. Learn more about our thought leadership and content creation services on our Emerj Media Services page.
Online fraud is becoming more expensive, and stopping it is only one of the objectives enterprise leaders have to manage.
In the Merchant Risk Council’s 2026 survey of more than 1,200 merchants across 37 countries, 98% reported at least one fraud attack in the past year. The share of accepted orders that later proved fraudulent rose from 3.0% to 3.5%, refund and policy abuse was the most common attack type, and merchants reported more false positives, legitimate customers turned away as suspected fraud.
According to the Association for Financial Professionals’ 2026 Payments Fraud and Control Survey, 76% of U.S. organizations experienced attempted or actual payments fraud in 2025, with ACH debits and wire transfers among the most targeted methods after checks.
For merchants and money-movement businesses, every defensive decision creates a second risk: declining a legitimate transaction, adding unnecessary verification, delaying a refund or pushing a valuable customer out of the funnel. Fraud, payments and customer experience (CX) leaders increasingly need to isolate a very small population of bad actors accurately enough to remove friction for everyone else.
In a webinar series produced with Riskified, Emerj examines how fraud is shifting from individual transactions to identities and behavioral patterns, and why the wrong decision now costs far more than a chargeback. The series included conversations with Danielle Dzbanek, Senior Director of Analytics at Riskified, Jeff Otto, Chief Marketing Officer at Riskified, Robert Rose, Senior Director of Customer Experience at Adobe, and Debjit Saha, VP of Engineering and Product, Risk and Compliance at MoneyGram.
Across ecommerce, software and remittances, the guests make it clear that modernizing fraud prevention without sacrificing growth rests on four practices:
- Resolve identities across the network to concentrate fraud controls: Connect accounts, devices, addresses and payment credentials across broader networks to identify the small number of actors driving disproportionate losses without applying the same scrutiny to every customer.
- Monitor behavior inside trusted accounts to catch what legacy controls miss: Track how established identities behave over time and across payment rails, because attackers increasingly exploit accounts that legacy controls have learned to trust.
- Match friction to risk to protect revenue: Increase verification only as risk rises, allowing low-risk and high-value customers to move through the journey with minimal interruption.
- Build a shared policy backbone for consistent decisions across risk and CX: Give risk, CX, finance, bots, and human agents a common decision framework, and feed what agents learn back into the automated channels.
Guest: Jeff Otto, Chief Marketing Officer at Riskified
Expertise: AI-Powered Risk Intelligence, B2B Marketing Strategy, Fintech Marketing, Financial Services Technology
Brief Recognition: Jeff Otto serves as CMO at Riskified, leading global marketing for an AI-powered ecommerce risk intelligence platform serving enterprise brands. Previously, he led marketing at Marqeta and spent more than seven years at Salesforce building and scaling industry and product marketing across financial services, healthcare, and enterprise technology, following earlier leadership experience within Morgan Stanley’s technology and data division. Otto earned an MBA in Finance from Texas McCombs School of Business, where he was a Venture Fellow and Dean’s Award recipient.
Guest: Danielle Dzbanek, Senior Director of Analytics at Riskified
Expertise: Data Analytics, Fraud & Risk Analytics, Marketing Analytics, Data Strategy
Brief Recognition: Danielle Dzbanek has built her career leading analytics teams and data strategy initiatives across digital advertising and fraud prevention. At Riskified, she progressed from analytics team lead to Senior Director of Analytics, overseeing analytics efforts across the Americas and supporting data-driven decision-making for risk and commerce. Prior to Riskified, she spent more than five years at MediaMath in progressively senior analytics roles and was recognized with the 2019 IAB Data Rockstar Award for innovation and impact in the data industry. She holds a BBA from Emory University with a focus on Finance, Marketing, and Analytic Consulting.
Guest: Robert Rose, Senior Director of Customer Experience at Adobe
Expertise: Customer Success, Technical Support Operations, Knowledge Management, Service Transformation
Brief Recognition: Robert Rose led enterprise paid support for Adobe’s Creativity and Productivity Solutions business, where he created and scaled the company’s global paid support program for Digital Media solutions. Across a career spanning leadership roles at Adobe, NICE, EMC, and Symantec, Rose has led large-scale support and customer success transformations, including global technical support organizations, knowledge management systems, and customer experience initiatives. Beyond industry leadership, he served as Adjunct Faculty at Utah Valley University, where he received a Teacher of the Year award, and holds a Bachelor of Science in Business from the University of Phoenix.
Guest: Debjit Saha, VP of Engineering and Product, Risk and Compliance at MoneyGram
Expertise: Financial Crime Technology, Fraud and Risk Engineering, Product Management, AI and Machine Learning
Brief Recognition: Debjit Saha is VP of Engineering and Product, Risk and Compliance at MoneyGram, where he builds data- and AI-driven controls for fraud, compliance, and payments decisioning. He previously advised large global financial institutions as a senior management consultant at EY. He holds a Master of Business Administration from the University of Chicago Booth School of Business.
Resolve Identities Across the Network to Concentrate Fraud Controls
When Riskified analyzes merchant populations, Jeff Otto says, identities associated with losses can represent roughly 20 basis points of the customer base, which he compares to a few drops of poison in a lake. Those individuals rarely look that small inside transactional systems, because one person may operate dozens of accounts. For Otto, this reframes the question: not whether a transaction or account looks fraudulent, but whether seemingly separate accounts belong to the same person.
In her episode, Danielle Dzbanek describes how fraud rings exploit the same blind spot across merchants. Attackers once studied one site, found its vulnerabilities, and concentrated there. Today, she explains, fraudsters care about the goods, not which store they come from. A technique that works at one merchant gets carried to the next, and the next. Because each merchant sees only its own piece of the attack, none can recognize the pattern alone.
One account-takeover ring Riskified tracked in ticketing started with small test purchases, escalated once something worked, and then repeated the pattern at six merchants over several months. In her view, no business can understand modern fraud using only its own data:
“If you’re sitting in your silo, it’s hard to know what’s going on out there. You need that network effect now. You can’t work in isolation anymore. You can’t look at your own population and try to stop fraud there.”
— Danielle Dzbanek, Senior Director of Analytics at Riskified
Ring, the Amazon-owned home security company, is Otto’s clearest example of what clustering identities reveals. Its losses to refund abuse ran to roughly $4 million, Otto says, and traced back to just 600 people, who had created tens of thousands of accounts to run refund-as-a-service schemes.
Otto describes the mechanism as identity resolution: linking physical addresses, emails, phone numbers, IP addresses, devices, and payment credentials until what a customer data platform shows as 50 different people resolves into one person, operating what he calls a garage scam center. Once those actors are isolated, he explains, stronger controls can apply to them without imposing the same cost on the rest of the customer base.
Network-level information also changes how teams should treat first-time customers. Someone who has never purchased from a particular site, Dzbanek points out, may still carry observable history through shipping addresses, IPs, devices and buying patterns elsewhere, so a new customer is not necessarily an unknown one.
Dzbanek also notes that off-the-shelf tools can now alter IDs, fake selfies and clone voices, which makes verification at sign-up less definitive. Debjit Saha describes MoneyGram’s response as a layered identity model that adds device, IP and behavioral information to traditional know-your-customer (KYC) checks.
Otto points to what can happen once an account is compromised. He describes “fullz,” packages sold among fraudsters that can bundle email and password credentials, device access, bank account details and full card data. In one case he discussed with CNBC, attackers took over accounts, added victims’ cards to Apple Pay and Google Pay wallets, and sent mules into stores to buy gift cards. Each payment looked secure, he notes, because the account takeover had already happened upstream.
Monitor Behavior Inside Trusted Accounts to Catch What Legacy Controls Miss
Riskified’s analysts, who monitor fraud forums on the dark web and clear web, noticed roughly a year ago that aged accounts were commanding higher prices, Otto says. Saha, speaking alongside him, sees the same shift and traces it to where controls have been concentrated:
“Over the years, there has been a lot of focus on new customers, having rules and patterns on new customers. But there has been this concept: we know that this particular customer behaves in a certain way. There’s an established account, and that’s why the aged accounts have so much more value to the fraudsters, because they know that’s much weaker in terms of where the controls are today.”
— Debjit Saha, VP of Engineering and Product, Risk and Compliance at MoneyGram
Otto relays an analogy from a payments CTO: knowing your neighbor does not make it normal to find him sitting in your kitchen at midnight. In his framing, identity resolution tells an organization who someone is, while behavioral intelligence asks whether what that identity is doing now makes sense.
Dzbanek describes a device-takeover case where the strongest identity signals continued to look legitimate. The fraudster was using the victim’s own phone, so the IP address, home location, and saved Google Pay wallet all matched expected behavior. What exposed the attack was a combination of weaker signals: customers previously associated with Android 14 appearing on Android 10, which has fewer security controls; buyers moving through relatively few pages at unusual speed, often in the middle of the night; and the same combination appearing across many customers at once.
Over three months, she says, the scheme generated more than $1 million in fraud attempts across five ticketing platforms in Riskified’s network. Any single order could have appeared reasonable; the pattern could not.
To catch it, Dzbanek describes a real-time anomaly-detection layer above transaction-level models, one that connects orders across the network to surface clusters and spikes no single order would reveal. Waiting 30 to 90 days for chargebacks to confirm a pattern, she argues, leaves too much time for the same attack to continue.
Saha cautions that behavioral change is not automatically fraudulent. A long-standing customer may behave differently because their circumstances have changed, and first-party fraud is another possibility. In his view, telling the difference depends on the breadth and quality of the data behind the models.
Match Friction to Risk to Protect Revenue
Saha argues that the goal is not to eliminate fraud at any cost, but to find a balance where most customers never encounter friction, and the business can still grow. As he puts it, “We can have zero fraud if we do zero transactions.”
In money movement, Saha says, customer experience is a competitive factor, and every additional question or verification step can translate into drop-off. His response is what he calls adaptive friction: customers who trigger no meaningful controls move through with the minimum number of questions, while scrutiny rises as risk indicators accumulate, from a request for additional information to manual review to an outright block.
Tell a fraud team to drive fraud to zero, Otto warns, and a business can lose $100 million as good customers abandon an over-protected funnel. Saha’s team measures approval rates separately for new and existing customers and across card and ACH. Dzbanek adds that chargebacks alone do not capture the full cost of fraud decisions, since lifetime value lost after an account takeover and longer-term brand damage also count.
Otto describes the same concept as a “trust dial.” Combining an identity’s history with its current intent lets the business vary its response for each customer. In a support context, he describes three broad groups:
- Trusted identities: Customers with a strong history may receive a low-friction resolution even when the interaction begins badly.
- Ambiguous identities: Customers displaying potential friendly abuse may be routed toward an intermediate option, such as an in-store return.
- High-risk identities: Customers connected to fake accounts or other negative indicators may be escalated away from frontline agents to loss-prevention specialists.
Otto applies the same logic earlier in the journey. A high-risk identity may face stricter terms at checkout, such as a sale being final, while a high-value customer who triggers a control can be routed to a concierge call instead of an automatic decline. He says some merchants that identify strong customers early and offer them faster refunds have seen repurchase rates double and complaint rates fall.
Robert Rose adds another variable: intent. A parent ordering the same item in several colors to find the right one may generate an expensive returns profile while still acting in good faith. The raw outcome can resemble abuse even though the intent is legitimate, and in his view AI can help distinguish the two by combining transactional history, identity and behavior.
Build a Shared Policy Backbone Across Risk and CX
Rose places policy abuse between traditional fraud and customer dissatisfaction. Repeat refund requests, repeated cancellations, or promotion misuse can spread across channels, leaving frontline support teams to interpret situations that do not fit neatly into one category:
“This often creates backlogs. It creates inconsistent resolutions. It creates tension between the customer experience teams that are chasing that satisfaction goal and the risk teams that are looking to prevent loss. What we’ve found is that when our policies aren’t clear and they aren’t equally managed across all of those channels, our trust and our reputation often suffer.”
— Robert Rose, Senior Director of Customer Experience at Adobe
Otto notes that payment fraud, ecommerce and loss-prevention teams often sit in different reporting structures and optimize toward different goals. At a company with tens of thousands of employees, Rose adds, coordination cannot depend on informal conversations between adjacent teams. It has to be embedded in systems, policy, and shared data.
Rose sees the gap between human and automated channels as the place policy breaks down. AI chatbots apply the policies they are given consistently. When a frustrated customer escalates, human agents measured on customer satisfaction often apply more empathy than the policy allows, and the reasoning behind their decisions rarely makes its way back into the bot.
His remedy is a loop between people and automation: AI coaches agents on what to say when they start to drift from policy, and what agents learn on the phone is fed back into the bots, so customers get the same answer in every channel.
He recommends building a shared policy backbone across teams and channels first, while more sophisticated instrumentation is still being developed, so automated and human decisions can be compared against the same standard. Otto extends the idea across the whole journey, from checkout and claims to returns and chargebacks, online and in store.
Rose also expects the policy cycle itself to accelerate, with leaders adjusting policies daily or even hourly as promotions, attacks and customer behavior change, instead of monthly. His advice to middle managers is to start in their next team meeting without waiting for direction from above.
Otto puts the business case in numbers: Riskified has seen department stores save $17 million a year, alongside the $4 million a year in losses uncovered at Ring. For Otto, the bigger prize is in conversion as well as recovered losses:
“There’s a real opportunity financially to add hundreds of basis points to approval rate and total conversion by being surgical with these technologies. It’s such an exciting time. Not only are people getting better experiences if they’re doing the right thing and they’re a great identity, but we’re also able to very surgically pull the poison out of the well.”
— Jeff Otto, Chief Marketing Officer at Riskified
