Inside the Account Fraud Economy: Q1 2026 Benchmarks for Retail, QSR, Airlines and Accommodation

Account fraud isn’t a one-off event, it’s an industry. Operators run shops, set prices, manage stock and respond to customers. They specialize, collaborate, and follow the money into whichever industries are paying out. For a retailer, it is a customer’s account quietly emptied of points, gift card credit and stored payment value. For a quick service restaurant (QSR), reward points cashed out at the counter. For airlines and hotels, it is miles and points spent on a stranger’s trip.

KasadaIQ continuously monitors this activity across nine industries, tracking account sales, pricing, stock levels and the operators behind them. The result is a benchmark dataset that shows where adversaries are focused, how the threat is trending and how industries stack up against each other. This blog walks through what that looked like in retail, QSR, airlines and accommodation in Q1 2026, the macro forces shaping each industry and the Q1 benchmarks behind the story.

The Adversaries Behind the Market: KYC Bypass and Synthetic Identity at Scale

In Q1 2026, KasadaIQ observed 13.2 million account sales tagged “verified,” “KYC” (know your customer) or “2FA,” representing $24.6 million in observed revenue. The premium has shifted decisively toward persistent, verification-proof access. Stolen credentials are still being traded, but the money has moved up-market, and the buyers paying it want accounts that won’t trip a step-up challenge mid-session.

That market doesn’t run itself. Behind the 13.2 million sales sit organized fraud operators selling the tradecraft to bypass verification at scale and, increasingly, to fabricate identities outright. They run customer support, post update logs, restock on a schedule and compete on coverage and reliability the way any supplier would.

Verification Bypass as a Service

KasadaIQ is tracking organized fraud groups advertising bypass services across 50+ platforms. The catalog covers most of what a verification flow throws at a user:

• Selfie liveness bypass, including “head rotation” verification used by tier-one platforms
• KYC bypass spanning 250+ countries, sold as a service rather than a one-off
• Passport templates and utility bills from 50+ countries, used to seed new accounts that pass document checks on the first try
• US SSN card templates for accounts that need a US identity attached
• Ready-made PayPal accounts with 2FA already attached, sold as drop-in payment infrastructure
• “Fraud starter kits” bundling browser setup tutorials, anti-detect configurations and the documents needed to onboard

One operator we track, which we refer to as Casio Carl, claims coverage across 250+ countries and runs the operation like a managed service. Buyers name the platform, Casio Carl delivers a verified account or a bypass package, with a guaranteed turnaround. The pitch isn’t “I have stolen credentials,” it’s “I can get you through the door of any platform you name.”

The shift this represents is one of accessibility. Bypassing modern verification used to require a level of skill most fraudsters didn’t have. Now it’s a service with a catalog and a price list, and the skill stays with the supplier while everyone downstream just buys the output.

Synthetic Identity, Productized

According to LexisNexis’s 2026 Cybercrime Report, fabricated identities overtook true identity theft globally for the first time in 2025. Synthetic identities have no victim to raise the alarm; there’s no genuine cardholder calling the bank, no real person noticing a strange login, no fraud report tying the activity back to a known individual. The account passes verification, ages on the platform, builds a transaction history and is then either sold or used directly.

KasadaIQ is tracking a Canadian-focused operator, which we refer to as Maple Forge, selling custom synthetic identities with established credit profiles for around $200. Maple Forge’s product isn’t a document, it’s a person on paper, with the artifacts to back it up. Optional add-ons include:

• Postal verification (a working address that will receive and forward mail for confirmation flows)
• A physical bank card shipped to a drop location
• A SIM for 2FA and recovery codes

For $200 plus a few add-ons, a buyer gets an identity that can open accounts, receive statements, pass phone verification and survive the kind of checks designed to catch a stolen credential in seconds. The economics flip the old assumption on its head: it’s now cheaper to fabricate an identity than to steal one and keep it alive through the verification gauntlet.

Industry Impacts

The four industries covered in this post sit directly downstream of this market. The retail, QSR, airlines and accommodation industries all depend on verification at signup and recovery, all carry stored value that makes a verified account worth paying for and all show up in the catalogs of operators like Casio Carl. The Q1 benchmarks below are what that demand looks like in motion.

The Q1 Macro Picture

That adversary infrastructure didn’t operate in a vacuum. Three macro forces shaped how Q1 2026 played out across the retail, QSR, airlines and accommodation industries.

1. Macroeconomics increased the value of compromised accounts. Tariffs and the 2026 Iran War-led oil disruption drove up retail prices. The stored value sitting inside compromised accounts (credits, points, locked-in pricing) carries more purchasing power as a result.

1. AI rapidly became infrastructure for part of the adversary market. Daily sales of paid AI accounts on criminal marketplaces jumped 640x (from 6 to 3,845) in Q1 2026. Seasoned operators remain hesitant, but novices using no-code tools are driving rapid adoption.
2. Legal frameworks trail agentic AI. The Amazon v. Perplexity ruling applied the Computer Fraud and Abuse Act to AI agents, separating user permission from platform authorization. Platforms react unevenly: eBay banned “buy-for-me” agents, Amazon mandates agent ID, and others use DMCA §1201 against scraping. For retail, accommodation, and airlines, compromised accounts are valuable due to dynamic pricing, loyalty point arbitrage, and stored credentials. Enforcement is currently limited to platform Terms of Service, with organizations setting interim boundaries until courts catch up.

Industry Benchmarks

Retail: Account Takeover Down, Bot Checkouts Up

Account Takeover

18%▼ Account Sales

39%▼ Revenue

1%▲ Active Shops

3.5%▲ Total Stock

64K Avg Stock by Brand

91 Brands Targeted

25%▼ Average Price

Criminal marketplace data showed that account takeover in the retail industry remained high‑volume but reset from Q4: 145,317 sales (‑17.75%), 1,455 stores (+1.04%), 5,433,337 max stock (+3.47%), $361,646 revenue (‑38.71%) and $2.49 average price (‑25.45%). The sharper revenue decline versus unit decline indicates material price erosion and likely weaker conversion economics (higher fraud friction, lower urgency baskets and heavy competition among sellers).

 

Example of Verification Bypass in Action | A customer logs in to redeem a gift card balance and finds it gone. The account was sold for $2.49 last week, drained of points. The saved card used to ship orders to a reshipper before the alert email even hit the inbox. The buyer didn’t need to break in, they bought a verified login from a shop with a satisfaction guarantee.

 

Bot Checkouts

3.4M Total Checkouts Observed

122+ Brands Targeted in Bot Checkouts

KasadaIQ observed 3.4 million bot checkouts across 122+ brands and 13 retail sub-industries in Q1. Footwear remained dominant at 73%, six of the top ten targeted brands sold collectibles (trading cards, “ugly-cute” figures) and pickleball paddles entered the target list for the first time. The hype-item economy keeps widening.

In Q1 2026, bot checkout activity was heavily drop-driven. Looking at total bot checkouts by day (see below), Thursday and Friday are the primary “drop days”. Weekends are quieter, with Saturday and Sunday combined accounting for only 11% combined for bot checkouts in Q1 2026. The average daily bot checkouts was 38K, but seven days had a surge of 100K+ checkouts.