8 ways fraudsters take over accounts
How fraudsters take over accounts: breaches, phishing, brute force, malware, man-in-the-middle, rogue extensions, password reuse and social engineering.
Account takeover (ATO) is what happens when someone else logs into a customer's account and uses it as their own: to spend a saved card, drain stored value or read what is inside. At scale it costs millions of dollars, and each incident costs the merchant the chargeback, the goods and the customer.
The attacker needs one thing first: a working credential. An email address and password, a session token, or a security answer good enough to reset the password.
They get it through phishing (fake mail that looks like it came from a company the victim trusts), brute force (software that tries password combinations until one works) or keylogging malware (software that records what the victim types).
Once in, they change the contact details so the owner cannot get back in, then move funds or data out.
The eight routes into an account
1. Third-party breach
The credentials often come from somewhere else. A supplier, a SaaS tool or a marketing vendor gets breached, and the usernames and passwords it held go up for sale. The company whose customers get taken over never had an incident of its own.
Saudi Aramco is the usual example.
One terabyte of data on the Saudi Arabian Oil Company, Saudi Aramco, was stolen: employee records, client details, site information, reports and project documents. It was offered on the dark web for $5 million, and the extortionists demanded $50 million to destroy it. Aramco said the data left through a flaw at a third party.
2. Email phishing
By one widely quoted count, 96% of phishing attacks arrive by email. It is cheap to send at volume, and out of any large list someone clicks.
The message looks like it came from the victim's bank, a courier or a tool they use. The link leads to a copy of the real login page, or the attachment installs malware that reads passwords and banking details off the machine.
For the person receiving it: delete mail from unknown senders unopened, and treat a familiar name with an unfamiliar request the same way. Before logging in from a link, check the address bar shows the real domain. For the business: a login made with a phished password still arrives from a new device and usually a new network, and that is where detection sits.
3. Brute force attacks
A brute force attack throws credentials at a login form until one works: every password against one account, or one common password across thousands of accounts. It is easy to run and hard to stop at the form alone, which is why it stays popular.
It works because most people choose weak passwords and reuse them. One hit gives the attacker a password that may open the victim's other accounts as well.
4. Malware
Malware is any software that takes over a device, steals from it or acts without the owner's permission.
The kinds that feed account takeover:
Trojans pose as a legitimate program and carry a credential stealer. Banking trojans go after one target: online banking logins and sessions. Keyloggers record every keystroke, passwords included. Spyware collects the same data without logging keystrokes. Ransomware encrypts the victim's files and demands payment for the key.
New families appear all the time, so no list is complete. The defences do not change: unique passwords, patched software and an up-to-date antivirus.
An unpatched machine is the easy case. The malware uses a known hole, reads the saved passwords, and the attacker logs into the bank as the victim and moves the money.
5. Man-in-the-middle (MitM) attacks
In a man-in-the-middle attack the criminal sits between the user and the server, reading and altering what passes between them. They can change content, drop it, or pose as either side to the other.
Each side believes it is talking to the other, so login credentials for email and other services pass straight through the attacker. An open Wi-Fi network is the classic setting.
With a banking session intercepted, the attacker can move money and lock the owner out until they reach the bank and reset their access.
6. Malicious extensions
A browser extension with broad permissions sees every page the user opens. A malicious one changes browser settings and reads login details as they are typed.
Users install them from a site that looks legitimate, or pick them up through a drive-by download: visit a compromised page and the code installs itself.
Once installed it works quietly: settings change without the user noticing, and credentials go out as they are entered.
7. Password reuse attack
According to a Google security survey, at least 65% of people reuse passwords across sites and services. Credential stuffing is the attack built on that number: take a username and password leaked from one service and try it on others.
One leak anywhere becomes a key to everything else.
If the email password and the banking password are the same, an attacker who buys the email credentials from a breach dump logs into the bank with the email address as the username and the same password.
8. Social engineering fraud
Social engineering is persuasion. The fraudster talks the victim into handing over a password, a card number or a one-time code: a call from "the bank's fraud team", or a text saying the account needs updating through a link.
It pairs with phishing. A fake email from a bank or a tech company asks the victim to click through and "verify" their details.
The link installs software, or lands on a login page the attacker controls, and the credentials or the whole machine are now theirs.
The business version: a caller tells a salesperson they are from accounting and need their login to check something for an audit. The salesperson reads out the credentials, and the caller is inside the company network.
What this means for your login form
Every route above ends the same way: a valid username and password arriving at your login form in the wrong hands. Password hygiene on the user's side helps, but you do not control it. What you control is whether a correct password from a new device, a new network or an odd hour gets straight in.
Score each login on those signals and hold the ones that do not match the account's history. That is what Sensfrx does for signups, logins and payments: device, network and behaviour signals produce a score, and your rules decide whether to allow, review or block.