Account Takeover

What Is an Account Takeover?

An account takeover (ATO) is when someone logs into an account that doesn’t belong to them. This can happen in a range of contexts. Some examples include fraudsters:

• targeting businesses by taking over staff email and user accounts
• taking over an individual’s ecommerce or iGaming account
• taking command of a person’s cell phone account
• taking over corporate or personal bank accounts

These are just a few of the many examples. Businesses and individuals must protect their accounts and data to ensure account takeover doesn’t occur. If it does, it can result in stress, inconvenience, and financial loss.

It can also put the fraudster in a strong position to take over further accounts. For example, accessing a staff member’s email account could provide a fraudster with a foot in the company door and an advantage when carrying out phishing attacks. This makes it easier for them to access other systems and accounts within the business.

Differences Between Account Takeover and Identity Theft

Account takeover relates solely to the fraudster taking over an individual’s account(s), while identity theft tends to be far more comprehensive. The latter involves the fraudster worming their way into not just accounts but multiple elements of the victim’s personal affairs, such as their photo ID documents or medical history.

Here are two core differences between the two terms:

• Account takeover (ATO) is easier and faster for fraudsters to carry out than identity theft. ATO criminals can quickly take control of an existing account, whether it’s personal or corporate.
• Identity theft is a longer process than ATO. Identity thieves may open new accounts or lines of credit in the victim’s name, using their identity to access private documents, services, and more instead of just their accounts.

After the crime has been detected, ATO attacks are generally easier to deal with than identity theft, which can take much more time, care, and money to resolve.

There are also similarities between account takeover and identity theft, particularly when it comes to the impact they can have. Both can be major sources of stress for the victim, resulting in significant financial loss.

Many ATO and identity theft victims who are personally affected may end up being professionally affected, too. Businesses can be financially exploited by criminals who have stolen vital information about an employee’s professional life.

How Do Fraudsters Take Over Accounts?

The fact that we now do so much online provides plenty of opportunities for fraudsters to take over accounts. The process often starts with a fraudster using phishing for login information or obtaining the victim’s details on the dark web, where over four million card details are available for sale, according to This Is Money.

Other ways that fraudsters can attempt to take over victims’ accounts include man in the middle (MitM) attacks, application vulnerability exploits, brute force credential cracking, network traffic sniffing, stolen cookies, leaked API keys, and the use of viruses and malware to steal the victim’s information.

Fraudsters may use bots to obtain victims’ details when attempting to crack log-in credentials using brute force. Bots enable fraudsters to attempt passwords faster and at scale.

Once a fraudster has access to the victim’s account, they can use it to carry out their malicious intent, usually defrauding the company or individual as much as they can get away with.

What Are the Consequences of Account Takeover?

The consequences of an account takeover include financial and reputational damage. As examples, let’s look at the damage it brings to iGaming, cryptocurrency, banking, and online lending.

• iGaming: Account takeover in iGaming can result in reputational damage, loss of trust, and financial instability. iGaming companies that lose control over the security and safety of their accounts and also run into trouble in compliance terms. In extreme cases, this could lead to a company losing its license.
• Cryptocurrency: The reputational damage of cryptocurrency account takeovers can be particularly harmful, as many crypto exchanges rely on personal recommendations to grow their customer base. Crypto’s absence of a centralized overseeing body means that ATO victims are unlikely to get their money back. The implications of poor security are, therefore, especially damaging in this context.
• Banking: Bank account takeover attacks are a growing concern for banks because fraudsters can bypass two-factor authentication (2FA) checks with increasing ease. They use social engineering to obtain an account holder’s log-in details and 2FA passcode, exploit password reset process weaknesses, use duplicate one-time password generators, and more. Combating these measures keeps banks busy ensuring robust authentication processes, delivering customer education on account takeover risks, and ensuring new technology supports enhanced security rather than increased vulnerabilities.
• Online lending: Online lender ATO attacks can result in businesses lending money to fraudsters (and thus never seeing it again). They can also lead to lost time and damaged customer relationships. This is because the lender may end up chasing genuine account holders for repayments of loans the account holders never knew about, leaving them confused and frustrated.

In all these industries, businesses must battle account takeover attempts to ensure that their finances, operations, reputations, and customers are all safe from the damage that fraudsters can cause.

How to Fight Against Account Takeovers

Fighting account takeovers starts with detecting them from the moment they’re attempted. Having the right systems and personnel is crucial.

From a systems perspective, implementing fraud prevention software can detect unusual account activity and changes that could indicate attempts at account takeover and brute-force password cracking attempts. Finely tuned fraud prevention platforms can also spot connections between multiple users, which could indicate that a fraud ring is active.

Businesses should do all they can to keep accounts secure, such as using multi-factor authentication for logins, Secure Sockets Layer (SSL) for pages that collect sensitive data, and so on.

The people element of fighting against account takeovers is two-fold:

1. Staff must be well educated on the dangers of account takeovers, how to spot the signs of them, and what to do when they see something suspicious.
2. Customers must be informed about how to guard against phishing attempts and other attack vectors that could lead to an account takeover.

By combining all these tips to achieve detection and prevention, along with implementing comprehensive fraud prevention solutions, businesses can ensure they are doing all they can to fight back against fraudsters.