The transaction value of digital goods fraud is outpacing physical goods fraud, hitting $10.4bn in 2025 and set to rise to almost $30bn by 2027.
According to the latest study from Juniper Research, fraud around purchasing of digital only goods such as games, content and streaming is growing faster than online physical goods fraud and is a bigger net business.
The report highlights synthetic identity use, promo-abuse and friendly fraud as key drivers behind the surge in digital goods fraud, with fraudsters using AI tools to reach scale.
“Mobile-first purchasing, gaming, streaming, and apps are widening the attack surface for fraudsters,” says Shane O’Sullivan, Research Analyst at Juniper Research. “Instant delivery provides a near-zero intervention time, meaning traditional fraud tools struggle to detect and block fraud before fulfilment. The rise of synthetic identity fraud and credential-stuffing attacks are also enabling far more sophisticated, high-impact risks.”
An extract from eCommerce Fraud Prevention Market 2025-2030 is now available as a free download
Looking good isn’t a good look
Interestingly, Juniper’s analysis reveals that the fastest growing attacks stem from behaviour that appears legitimate: authorised accounts, valid payment credentials and clean device histories.
Account takeover (ATO) fraud also plays a role here. ATO fraud is the unauthorised access and use of a legitimate user’s account, such as bank, merchant, email, social, marketplace, etc, by an attacker who has either bypassed or managed to obtain credentials or authentication. Subsequently, the attacker will impersonate the user to steal funds, loyalty points, gift cards, or data, or to set up further fraud.
Fraudsters will also make non-monetary alterations to the account by changing the password or adding a new authorised user. After making these changes, fraudsters can begin to gain access the victim’s other accounts and sensitive information.
Common attacker techniques include credential stuffing, phishing and social engineering, SIM swap/number takeover, infostealer malware, multi-factor authentication (MFA) bypass combos, and account resale on marketplace.
Examples of preventative actions that merchants take are MFA authentication if a login attempt is from a new device or location, block password reset and transaction within 24-hour sequence, hold high-risk transactions pending verification, and force password reset if credentials appear to have been breached.
How fraud defence must change
This evolving pattern, fuelled by continuous leaking of credentials and AI-driven spoofing, creates fraud that mimics genuine customers and resulting in systems treating it as benign until fulfilment is complete.
As such, the next generation of fraud defence as shifting from identifying ‘bad transactions’ to modelling intent, behavioural deviation, contextual identity and detecting cross-merchant reputation signals by incorporating advanced AI models.
“The reduced time to intervene means ecommerce fraud prevention providers must shift to AI-powered, real-time prevention. If these providers fail to implement proactive techniques such as behavioural biometrics, merchants will drown in increased fraud risks, eroding profitability,” says O’Sullivan.
