What does "81% of fraud targets existing customers" actually mean?

It means most digital fraud no longer happens at account opening. In its H1 2026 Top Fraud Trends report, TransUnion found that 81 percent of suspected digital fraud globally occurred during interactions with existing customers rather than at onboarding. Fraudsters are exploiting accounts that are already verified and already trusted, because scrutiny is lowest after the login. For businesses, that shifts the moment of risk from the sign-up form to every logged-in session that follows.

Why is the logged-in session harder to protect than the login itself?

Because your web application runs in an environment you do not control: the customer's browser. Once your app is rendered there, its code, page structure, tokens, and live session sit where malware, a malicious extension, an automated script, or a man-in-the-browser overlay can read and manipulate them. A session can pass every authentication check and still be unsafe, because the credentials were real but the environment the session is running in has been compromised. Server-side rules react to signals from a browser the attacker may already control.

Does Haven Enterprise stop scam calls, text spoofing, or authorized fraud?

No, and it is important to be precise about that. Spoofed phone calls and smishing happen on telecom networks and on the customer's own device, outside the web app Haven Enterprise protects. Authorized or scam fraud, where a customer is socially engineered into willingly approving a transfer, is also outside its scope, because the legitimate user is performing the action themselves. Haven Enterprise addresses the part of the problem that unfolds inside your application's sessions: automated fraud, bots, agentic AI, and browser-side attacks that turn a legitimate login into a compromised session.

Is Haven Enterprise an identity verification or KYC tool?

No. Haven Enterprise is not an identity-verification or KYC product, so it does not address synthetic identity fraud at onboarding, which TransUnion flags as a leading concern. Its job begins after a user is in: protecting the live session and hardening the specific high-value workflows where money and control change hands. It is designed to complement identity verification at the front door, not replace it.

How is Haven Enterprise different from Haven Business?

They defend the browser from opposite sides. Haven Enterprise protects the sessions running on the web applications you operate, for your customers and partners, by keeping your app's code and session out of the end user's browser. Haven Business is a browser extension that protects your own employees as they browse, flagging impersonated login pages and risky downloads before anyone acts on them. Spoofed calls and phishing links aimed at your staff are Haven Business territory; compromised sessions on your own app are Haven Enterprise territory. Many organizations use both.

← Blog

For businesses

Fraud Moved Past the Login. Your Defenses Should Too

Avery Scout · Oct 28, 2026 · 6 min read

Explore an AI summary

Perplexity ChatGPT Claude

New TransUnion data shows most digital fraud now happens after onboarding, inside the relationships you already trust. The logged-in session is the new front line.

Most fraud programs were built around the front door. Verify the identity at account opening, check the device at login, and treat everything after that as a trusted customer doing normal things. That model is now facing the wrong way.

TransUnion's latest Top Fraud Trends report, Fraud in the Age of Continuous Trust, found that 81 percent of suspected digital fraud globally in the first half of 2026 happened during interactions with existing customers, not at onboarding (TransUnion). Fraudsters have learned that the established account, already verified and already trusted, is the softer and more valuable target. Business leaders in the study estimated fraud losses equal to nearly 7 percent of annual revenue over the past year.

The report is worth reading in full, but the strategic takeaway is simple. The moment of risk is no longer only when a stranger tries to get in. It is every logged-in session after that, where a trusted account is doing something that moves money or changes control.

TransUnion makes the point directly for regulated industries: in financial services, while account creation carries real risk, "transaction-related activities pose even greater risk." The same shape shows up across retail and gaming, where threats continue through logins and transactions long after the account is open.

This is the part most defenses underweight. A customer logs in cleanly, passes every onboarding and authentication check, and then the dangerous activity happens inside a session that the business no longer looks at closely. A payment is initiated. A payee is added. An account recovery email is changed. A balance is moved. These are exactly the workflows an attacker wants, and they sit on the trusted side of the login, where scrutiny is lowest.

Two forces are widening that gap at once. Attackers are automating the work, using AI and scripts to open, infiltrate, and operate accounts at a scale that manual fraud never reached. And they are manipulating trusted channels to get in: TransUnion reports that nearly one in five outbound business-to-consumer calls with U.S. mobile carriers was spoofed in the first half of 2026, and six in ten business leaders said their customers were hit by text spoofing in the past year. The result is more compromised-but-legitimate sessions arriving at your web app than before.

Keep your business safe from online threats

Haven for Business protects every employee from phishing, fake sites, and browser-based attacks.

Why the logged-in session is hard to defend

Here is the uncomfortable structural fact. Your web application runs in an environment you do not control: the customer's browser. Once your app is rendered there, its code, its page structure, its tokens, and the live session all sit in a place where malware, a malicious extension, an automated script, or a man-in-the-browser overlay can read and manipulate them.

That is why a session can pass every authentication check and still be unsafe. The credentials were real. The device may even be real. But the environment the session is running in has been compromised, and the attacker is operating from inside it. Server-side rules and step-up prompts help, but they are reacting to signals from a browser the attacker may already own.

What Haven Enterprise does about it

Haven Enterprise is built for exactly this layer: protecting the sessions running on the web apps you operate, throughout the customer relationship, not just at the door.

It renders your application so that its code, DOM, tokens, and session never live in the end user's browser. That removes the browser as an attack surface for the session. Man-in-the-browser attacks, malicious extensions, formjacking, session theft, and automated fraud lose the thing they depend on, which is direct access to your application's code and session inside a browser the attacker can reach.

You choose which workflows to protect, such as logins, payments, or account changes, and automation is switched off for exactly those flows. It runs at your edge, alongside the stack you already use, including Cloudflare, Akamai, and Fastly. Your customers install nothing and sign in the way they always have.

The connection to the TransUnion data is direct. If the fraud has moved into the logged-in session and into the high-value transactions inside it, then protecting the session itself, and hardening the specific workflows where money and control change hands, is where a defense belongs.

What this does not solve, and we want to be clear about it

No single control covers the whole fraud picture, and the same report makes that obvious. Haven Enterprise protects the sessions on web applications you operate. It is not an answer to several of the categories TransUnion ranks highly, and it would be wrong to suggest otherwise.

It does not touch the phone and text channels behind much of today's scam activity. Spoofed calls and smishing happen on telecom networks and on the customer's device, outside your web app. It does not stop authorized or scam fraud where a customer is socially engineered into willingly approving a transfer, because in that case the legitimate user is performing the action themselves. And it is not an identity-verification or KYC product, so synthetic identity fraud at onboarding, which TransUnion flags as a top concern, is a different control's job.

What Haven Enterprise does own is the part that unfolds inside your application's sessions: automated fraud, bots, agentic AI, and the browser-side attacks that turn a legitimate login into a compromised session. That is a meaningful slice of the post-login problem, and it is the slice that server-side rules and step-up authentication struggle to see.

Where it fits with the rest of Haven

The browser is where people make trust decisions, so it is where we build. Haven Enterprise protects the sessions on the apps you operate, for your customers and partners. Haven Business protects your own people as they browse, flagging impersonated login pages and risky downloads before anyone acts on them, which is the side of the house that spoofed calls and phishing links are aimed at. Many organizations need both, and both come from one place.

If your fraud strategy still treats the login as the finish line, the data is now clearly pointing the other way. The relationship you already trust is where the attention is, and the session is where the defense has to be.

About Haven

Haven helps people and organizations make safer trust decisions online. Haven is free for individual use. Haven Business extends that protection across a team, and Haven Enterprise protects the sessions on the web apps businesses run. Haven is operated by MirrorTab Corp.

Learn more about Haven Enterprise at starthaven.com/enterprise.

Frequently asked questions

What does "81% of fraud targets existing customers" actually mean?: It means most digital fraud no longer happens at account opening. In its H1 2026 Top Fraud Trends report, TransUnion found that 81 percent of suspected digital fraud globally occurred during interactions with existing customers rather than at onboarding. Fraudsters are exploiting accounts that are already verified and already trusted, because scrutiny is lowest after the login. For businesses, that shifts the moment of risk from the sign-up form to every logged-in session that follows.
Why is the logged-in session harder to protect than the login itself?: Because your web application runs in an environment you do not control: the customer's browser. Once your app is rendered there, its code, page structure, tokens, and live session sit where malware, a malicious extension, an automated script, or a man-in-the-browser overlay can read and manipulate them. A session can pass every authentication check and still be unsafe, because the credentials were real but the environment the session is running in has been compromised. Server-side rules react to signals from a browser the attacker may already control.
What does Haven Enterprise protect, specifically?: Haven Enterprise protects the sessions running on the web applications you operate. It renders your application so that its code, DOM, tokens, and session never live in the end user's browser, which removes the browser as an attack surface for man-in-the-browser attacks, malicious extensions, formjacking, session theft, and automated fraud. You choose which workflows to protect, such as logins, payments, or account changes, and automation is switched off for exactly those flows. It runs at your edge alongside Cloudflare, Akamai, or Fastly, and your customers install nothing.
Does Haven Enterprise stop scam calls, text spoofing, or authorized fraud?: No, and it is important to be precise about that. Spoofed phone calls and smishing happen on telecom networks and on the customer's own device, outside the web app Haven Enterprise protects. Authorized or scam fraud, where a customer is socially engineered into willingly approving a transfer, is also outside its scope, because the legitimate user is performing the action themselves. Haven Enterprise addresses the part of the problem that unfolds inside your application's sessions: automated fraud, bots, agentic AI, and browser-side attacks that turn a legitimate login into a compromised session.
Is Haven Enterprise an identity verification or KYC tool?: No. Haven Enterprise is not an identity-verification or KYC product, so it does not address synthetic identity fraud at onboarding, which TransUnion flags as a leading concern. Its job begins after a user is in: protecting the live session and hardening the specific high-value workflows where money and control change hands. It is designed to complement identity verification at the front door, not replace it.
How is Haven Enterprise different from Haven Business?: They defend the browser from opposite sides. Haven Enterprise protects the sessions running on the web applications you operate, for your customers and partners, by keeping your app's code and session out of the end user's browser. Haven Business is a browser extension that protects your own employees as they browse, flagging impersonated login pages and risky downloads before anyone acts on them. Spoofed calls and phishing links aimed at your staff are Haven Business territory; compromised sessions on your own app are Haven Enterprise territory. Many organizations use both.