What is Dormant Account Fraud?

Dormant account fraud is when an attacker unlocks an inactive account (credential stuffing, social engineering, or via insider lookups), then silently extracts any value: refunds, loyalty balances, stored payment instruments, payout privileges. Alert fatigue: an account that never moves is assumed to never change.

Signals: credential resets prior to payee name or account number changes; device fingerprints that have never been seen associated with the account; high‑risk transactions with no recent account activity; login attempts outside of working hours from new ASNs. Support tickets frequently arrive after the fact, referencing “surprise” emails.

Mitigation: tighten up reactivation flows, device rebindings, and introduce some cool‑off before high‑value activity. Trigger out‑of‑band alerts for critical changes and require confirmation before payouts get enabled. Anchor with identity verification and trigger a review if any funds or sensitive features get accessed. Align runbooks with a risk‑based AML compliance program to enable fast recoveries and reporting.

Don’t let dormant accounts be sleeper fraud risks. Wake them up carefully.