10 authentication rules to prevent account takeover fraud

10 authentication rules to prevent account takeover fraud

1. Require multi-factor authentication

Multi-factor authentication (MFA) asks for two or more proofs of identity before a login succeeds. One published figure puts MFA at blocking over 99.9 percent of account compromise attacks.

The usual form is a password plus a code sent to the user's phone or email, or generated by an authenticator app. The second factor is the point: a stolen password on its own then fails. It is not unbreakable, so read the common two-factor authentication bypass techniques and prefer app or hardware-key codes over SMS.

Make it step-up where you can. A known device on a normal day goes straight through; a new device, a new country or an odd hour gets the second prompt. That keeps the friction on the sessions that earn it.

2. Act on login alerts

Alerts turn the account holder into a second reviewer. Send one on every new-device login, password change, and change of recovery email or phone.

A "someone signed in from a new device" alert the user did not trigger means the password is already in someone else's hands. The alert should carry a one-click "this wasn't me" that ends every session and forces a reset.

An attacker changes the recovery email first, so an alert that goes only to the new address is worthless. Send it to the old contact as well, and hold recovery changes for a cooling-off period before they take effect.

Log every alert with the device, IP and timestamp. When the user disputes a later transaction, that record tells you whether the session was theirs.

3. Keep admin and payment sessions off public WiFi

Public WiFi is a risk for your staff more than your customers. An admin console or payment back-office opened on a coffee-shop network is exposed to anyone else on it: unencrypted traffic can be read and replayed, and a captured session cookie is a login without a password.

Require a VPN for admin tools, and treat a login to them from an unknown network as a step-up event. If client data leaks that way, the blame lands on you, not the café.

4. Push users to a password manager

A password manager generates and stores a different password for every site, which is the only practical way to end password reuse. One survey found 1 in 4 people use a password manager, which leaves most of your users without one. Recommend one at signup and in every reset email.

The manager also fills credentials only on the domain it saved them for, so a lookalike phishing page gets nothing typed into it.

An attacker then needs both the master password and the device the vault lives on, and a third factor if the vault sits behind something like Google's 2-step verification.

5. Train staff on how takeovers start

Your employees are a target in their own right. A support agent who resets a password on a convincing phone call hands over the account with no hacking involved.

One compromised account becomes the lever for the next: the attacker reuses what they learn from it against customers with similar profiles.

Train the people who touch accounts to recognise a social-engineered recovery request, and give them a hold-and-verify path that does not cost them a complaint. The aim is to notice the breach while it is one account, not a hundred.

6. Cover every stage, from first visit to repeat purchase

Customers meet you in four stages: awareness, consideration, purchase and post-purchase. Each one exposes them to a different attack.

While researching you they click out to other sites and can land on phishing pages or malware dressed as your content. While comparing you to competitors they visit many sites, any of which may be compromised and used to harvest the credentials they later reuse on yours.

At purchase the risk is the scam around the payment itself, including money-mule schemes where the buyer is drawn into moving stolen funds. After the first purchase, a customer with a stored card and an order history is the one phishing campaigns go after, because the account is now worth taking.

Your controls should cover all four stages, not just the login form. A fraud score at signup catches the account created to abuse a promotion; the same score at checkout catches the taken-over account spending someone else's card.

7. Patch software and run current antivirus

Unpatched software on the machines that hold credentials is a standing invitation. Keep operating systems, browsers and remote-access tools current, above all where staff reach your servers from outside.

Do not rely on each employee to update on their own. Push updates centrally and check compliance; one stale laptop with remote access is a route to every system it can reach.

Run antivirus or endpoint protection on every staff machine. Infostealer malware is a common source of the credentials later used in takeovers, and the endpoint is where it gets caught.

The same applies to your authentication rules. Feed them current risk data, such as new phishing campaigns aimed at your users, and update them as the attacks change.

8. Serve every login page over TLS

Every page that takes a password must be served over HTTPS with current TLS, and so must the API behind it.

Encryption in transit stops a password or session token being read on the network between the user and you. Some login forms still post over plain HTTP. If any page of yours that takes a password does not show HTTPS, or mixes secure and insecure content, fix it before anything else on this list.

Apply the same test to the vendors you hand credentials to. If a provider cannot tell you how its login is encrypted, do not send your users' passwords through it, and if they will not fix it, move.

9. Secure the first credential capture

Many takeovers start with a credential captured at signup or first login: a form posted in the clear, a token written to a log, a widget that can see the password field. Secure the moment the credential is first captured.

Capture credentials over TLS only, hash passwords before they touch a database, and keep them out of logs, analytics and session-replay tools.

If a third-party provider handles login or forms for you, confirm they encrypt in transit and hash at rest with current algorithms, and check again at each renewal.

10. Harden business email

The most common attack on a business is a compromised business email account, used to send fraudulent requests to customers and vendors. One widely quoted statistic puts 90% of security breaches down to phishing. A fake invoice sent from your real domain does damage you cannot fully undo.

Three things to do:

• Strong, unique passwords on every staff mailbox, checked against breach lists.
• Two-factor authentication on every mailbox login.
• A review process for outgoing mail that asks for payments, new bank details or new passwords.

Bonus: Lock or wipe lost devices with mobile device management

A lost or stolen laptop or phone with a logged-in session is an account takeover without a single credential stolen.

Mobile device management (MDM) lets you lock or wipe a device remotely the moment it is reported missing. Enrol every device that can reach customer data.

Where Sensfrx fits

Rules 1 to 10 raise the cost of a takeover. They do not make the login smart about which attempt is the attacker's. That is the layer to add next: score each login on device, network and behaviour signals, and let your rules turn the score into allow, step-up or block. An attacker who holds a valid password still logs in from a device and network the account has never seen.

Sensfrx account takeover protection does this at signup and login. Start on the free plan: enable it on login, read the scores next to your current alerts for two weeks, then let the rules block.