Memcyco updates PoSA to spot attacker devices earlier

Memcyco has released PoSA v1.11 for its account takeover protection platform, an update aimed at helping fraud and security teams identify attacker devices earlier.

The latest version is intended to give organisations more visibility into suspicious activity before a login attempt or transaction. Memcyco said this earlier view can help teams link attack activity to the users, devices and accounts most at risk before an account is compromised.

Many fraud and authentication tools assess risk only when a customer tries to sign in or complete a payment. Memcyco argues that by then, a user may already have visited an impersonating site, disclosed credentials or entered a journey controlled by an attacker.

PoSA v1.11 adds features designed to make earlier warning signs easier to interpret within existing fraud and login workflows. According to Memcyco, Attack Overview highlights users linked to multiple attack events over the same period, while the Risk API provides real-time user and device risk scores, along with the underlying signals, before access is granted.

This is intended to help fraud teams decide which cases need intervention first and what response is appropriate. The product is designed to support action before a successful account takeover rather than after an incident has advanced.

Earlier signals

The release reflects a broader focus among cybersecurity and fraud suppliers on the period before formal authentication. Banks, retailers and other consumer-facing businesses are under growing pressure to detect phishing, digital impersonation and account takeover attempts earlier, particularly as attacks become more distributed across fake websites, social engineering and compromised devices.

Memcyco said one challenge for fraud and security teams is that alerts often arrive in isolation, making it difficult to tell when separate events relate to the same user or attack path. In that environment, analysts may struggle to identify which customers face the highest risk and where intervention is most urgent.

The updated platform is intended to address that problem by linking earlier signals to account-level risk. Rather than relying only on signals gathered at login, the system aims to show what happened before the sign-in request and which devices may have been involved.

"Fraud teams should not have to make access decisions based only on what they can see at login," said Israel Mazin, Chief Executive Officer of Memcyco.

"PoSA v1.11 brings earlier attack context into those decisions, helping teams recognize malicious devices, prioritize higher-risk users and apply the right intervention before account compromise, without creating unnecessary friction for legitimate customers," Mazin said.

Fraud losses

Account takeover remains a costly issue for financial institutions and other businesses that manage large numbers of online customer accounts. Losses can include direct reimbursement, operational investigation costs and broader damage from customer distrust after fraudulent activity.

Memcyco said acting earlier can reduce the number of successful account takeover incidents and cut the time teams spend reviewing fragmented alerts after the fact. It cited results at a top-10 North American bank, where its approach reduced account takeover by 65% and represented about USD $18 million in avoided annual losses.

That example points to growing commercial interest in tools that sit upstream of conventional login checks. As firms face pressure to reduce fraud without adding friction for genuine users, suppliers are trying to show that more detailed context before authentication can improve both security decisions and customer experience.

Memcyco focuses on detecting threats at the stage when users are exposed to impersonation attempts and attacker-controlled environments. Its platform is intended to identify attacks before stolen credentials are used and before an attacker gains access to an account.

The new release builds on that positioning by turning signals from those earlier stages into information that can be used directly by existing fraud and access systems. For institutions dealing with large volumes of alerts, the ability to rank user and device risk before login may prove more valuable than a larger number of warnings after a compromise has already occurred.