While overall fraud volume remains relatively stable, October’s data shows a striking shift in where fraudsters are focusing their efforts. According to Rippleshot’s Monthly Fraud Intelligence Report, new and unexpected merchant types — including telecom services, bicycle shops, and wholesale clubs — saw the largest month-over-month spikes in fraud.

This trend suggests that bad actors are moving beyond the usual high-risk categories, probing for blind spots ahead of the holiday season.

Fraud Is Shifting to “Low-Risk” Merchant Types

Fraud at telecommunication services (MCC 4814) jumped +42.54% in October, even as spending slightly declined. This disconnect pushed fraud rates to 4.61 basis points — a clear sign that fraudsters are exploiting routine payment systems like prepaid top-ups and bill pay portals. Because these transactions blend into normal billing cycles, they often go undetected until post-auth disputes surface.

Meanwhile, bicycle shops (MCC 5940) — a category that typically cools down as weather turns — saw an incredible +108.48% increase in fraud, even with a 4.9% drop in spend. High-ticket, card-not-present purchases drove the surge, highlighting the resale potential for items like e-bikes and gear.

And at wholesale clubs (MCC 5300), fraud rose +23.26%, outpacing a 7.6% growth in spend. Because these merchants are often trusted and see bulk transactions, they’ve become ideal hiding spots for fraudulent activity.

What This Means for Financial Institutions

The divergence between spend and fraud underscores a fundamental shift in fraud behavior: attackers are looking for under-monitored categories where traditional models might lag. This means fraud managers need to look beyond volume — and focus on fraud rate velocity across all merchant types.

Rippleshot’s consortium data — derived from over 5,000 financial institutions and 50 million daily transactions — highlights that these smaller, “everyday” categories now represent a growing share of total fraud exposure.

Institutions that rely solely on static rule sets or legacy scoring models risk missing early warning signs — particularly when fraud hides within trusted environments or recurring payment systems.

Strategic Recommendations from Rippleshot

1. Track Emerging Fraud in Everyday Utilities:
   Categories like telecom services often fall below typical risk thresholds. Monitoring behaviors like multiple cards tied to a single account or spikes in prepaid recharges can surface early fraud signals.
2. Strengthen Controls in Trusted Merchant Environments:
   Fraudsters are embedding activity in “safe” merchant types like wholesale clubs. Apply merchant-specific scoring and verify bulk transactions to detect hidden fraud.
3. Balance Fraud Rate and Volume in Risk Models:
   Don’t overlook categories with small dollar volumes but fast-rising fraud rates. Early intervention in these areas prevents broader losses later.
4. Apply Smart Rules to Niche Categories:
   Niche merchants, such as bicycle shops, require adaptable rules. AI and consortium data can reveal patterns before traditional alerts trigger.

Staying Ahead of Fraud’s Evolution

As fraud becomes more dynamic, financial institutions must adopt equally dynamic defenses. By leveraging consortium data, AI-driven insights, and early warning indicators, fraud teams can move from reacting to anticipating — catching fraud before it impacts customers.

Fraud is moving fast. Rippleshot helps financial institutions move faster.

👉 Read the full October 2025 Fraud Intelligence Report for deeper insights:
https://info.rippleshot.com/rippleshot-monthly-fraud-intelligence-report-october-2025

‍