10 ways fraud prevention managers can reduce account takeover
Ten controls against account takeover a fraud prevention manager can put in place: MFA, risk scores, login monitoring, staff access, leaked credential checks.
Javelin's 2022 Identity Fraud Study put the year-on-year rise in account takeover losses at 90 percent. The pattern inside most of those cases is the same: a password that was reused or phished, a login that nobody looked at twice, and a scramble weeks later to work out which accounts were touched.
None of the ten controls below needs a new team. Most are configuration, policy, or a tool you already pay for. For a worked example of how one weak login flow gets exploited, see this account takeover vulnerability walkthrough.
10 ways to reduce account takeover fraud
1. Require more than a password
A password alone is one leaked database away from useless. Multi-factor authentication asks for a second proof before the login completes. A 2022 forecast put the MFA market on an 18 percent annual growth rate through 2030, so this is no longer a differentiator; it is the baseline.
Each extra factor is one more thing the attacker has to steal, and the three kinds do not travel together. A stuffed password does not come with the customer's phone or fingerprint.
Ask for at least two of:
- Something they know, such as a password
- Something they have, such as a phone or hardware token
- Something they are, such as a fingerprint or face
Ask for the second factor only when a login looks risky and most customers never see it.
2. Lock down employee access
Not every takeover comes through the customer login. Weak internal access is one of the more common routes: a support agent's account with rights to reset any customer password is worth more to an attacker than one customer's credentials.
Write down what each role can do and enforce it in the system, not in a wiki.
When someone leaves, their access ends the same day, shared logins and API keys included. While they are there, they get the least access their job needs. Review the list quarterly; rights accumulate.
3. Score accounts and logins by risk
With tens of thousands of accounts you cannot watch them all, so decide which ones deserve attention. A risk score does that: a number for how likely an account or a login is to be compromised, built from many signals, including device, network, behaviour and account history.
Use it to triage. Low scores pass without friction, mid scores get a second factor or a review, high scores are blocked. The same number tells your analysts which accounts to open first on a Monday morning.
4. Watch the login system
Log the IP address, device type and browser on every login attempt, successful or not, and read the stream rather than single events.
A customer who has only ever logged in from one phone and now appears from a desktop in another country is worth a second look. So is a spike in failed attempts across many accounts from a small set of IPs, which is what a credential stuffing run looks like from your side.
5. Flag behaviour that does not fit the customer
Takeover does not end at the login. The attacker still has to do something with the account, and that is where they look different from the owner.
A customer who uses a different card for every transaction, or whose purchases land in several cities across the country within days, is probably not the customer.
Write those patterns down as rules, so the order is held before the goods ship rather than refunded after the chargeback.
6. Train the people attackers target
Attackers change tactics faster than your policy document does.
The figure most often quoted is that around 90 percent of cyberattacks involve a human mistake somewhere in the chain. Whatever the exact share, the people who reset passwords, approve refunds and answer support tickets are the ones social engineers call first.
Give them two things. First, tooling that shows the context of a request (IP, device, location, account history) so a convincing story can be checked against facts. Second, short, repeated training on what a takeover attempt looks like and how to report it in under a minute.
7. Put a web application firewall in front of the login
A web application firewall sits between the internet and your web servers and inspects each request before it reaches the application.
Against account takeover it does the blunt work: it rate-limits login attempts from one source, blocks known bad IPs and bot signatures, and stops the brute-force runs that never needed to reach your code.
It will not catch a correct password submitted once from a clean IP. That is where the risk score and the behaviour checks above take over.
8. Scan the dark web for your credentials
The dark web is the part of the internet you reach only with specific software, not through a search engine. It is where stolen credentials and card numbers are sold, and because law enforcement finds it hard to trace sellers there, the markets persist.
A dark web scanner checks those dumps for your domain, your staff and your customers. When a match turns up, force a password reset on the affected accounts and step up the checks on their next login.
9. Put admin access behind a VPN
A virtual private network is an encrypted tunnel between a device and a VPN server, so staff can reach internal systems from anywhere with a connection.
For a fraud team the point is not hiding the analyst's IP address. It is that admin panels, back-office tools and database consoles should not be reachable from the open internet at all. Put them behind the VPN, and an attacker holding a stolen admin password has nothing to point it at.
Pair it with the access controls in point 2. The VPN decides who can reach the door; the role decides what they can do once inside.
10. Keep up with compliance requirements
Rules on authentication, data handling and breach notification keep changing. If you fall behind, a breach that was already expensive also becomes a liability question.
Review your policies and procedures at least quarterly, sooner when a new rule lands, and brief the staff who handle customer data each time something changes. Fines usually follow the mistake nobody was told about.
Where to start
If you do one thing this week, add a second factor for admin and support accounts and turn on login monitoring for customers. Those two close the doors most takeovers walk through.
Then add risk scoring, so the friction lands only on the logins that earn it.
To see how scoring each login by device, network and behaviour fits into that, read about account takeover protection.