Account takeover
ATOAlso called account hijacking, credential takeover
Account takeover is a fraud in which a criminal gains control of a genuine customer's account, usually with stolen login details, and then uses it to move money, change contact details or open new products. The account holder is real and already verified, which makes the activity harder to spot than a new fake account.
How it works
Criminals obtain credentials through phishing, data breaches, malware or social engineering of the customer or the firm's call centre. They then log in, often from a new device or location, and change the email address, phone number or password to lock the real customer out. Common next steps are adding a new payee, raising payment limits, requesting a new card or porting the customer's mobile number to intercept one-time passcodes.
Firms defend against account takeover in layers. Strong customer authentication makes stolen passwords alone insufficient, while device fingerprinting, behavioural analytics and velocity checks flag sessions that do not match the customer's normal pattern. High-risk changes such as a new payee or contact detail trigger step-up checks or a cooling-off period. Confirmed cases are refunded where the law requires, and the funds trail can lead to a suspicious activity report.
The rules
Requires strong customer authentication for online account access and electronic payments, and transaction monitoring that detects unauthorised or fraudulent payment transactions.
Payment service providers in the EUMake the payment service provider liable to refund unauthorised payment transactions promptly, and limit the payer's liability unless the payer acted fraudulently or with gross negligence.
UK payment service providers and their customersReplaces the 2005 and 2011 internet banking guidance; expects risk-based, layered authentication and identifies single-factor authentication as insufficient for high-risk access.
US banks and credit unions supervised by FFIEC member agenciesCommon questions
How is account takeover different from identity theft?
Identity theft uses a person's details to open new accounts in their name. Account takeover hijacks an account the person already holds. Both start with stolen personal data, but account takeover exploits the trust a firm has already placed in a verified customer.
What are the warning signs of account takeover?
Common signs are a login from a new device or country, a password reset followed by a change of email or phone number, a new payee added soon after, a request for a replacement card, and payments that break the customer's usual pattern.
Does multi-factor authentication stop account takeover?
It blocks most attacks that rely on a stolen password alone. Criminals respond with SIM swaps, phishing pages that relay one-time codes and social engineering of the customer, so firms combine authentication with device and behaviour monitoring.
