Account takeover fraud: How it works and how to stop it

What account takeover fraud is

Account takeover fraud is unauthorized access to an existing account: a bank login, an email inbox, an ecommerce profile, a social media handle, an admin console. It differs from identity theft, where the criminal opens a new account under a stolen name. In ATO the account is real, the credentials are real, and the owner has a history the attacker can hide behind.

Once in, the attacker transfers funds, buys goods, changes settings, pulls personal data or uses the account to reach other systems. Because the login succeeded, nothing looks wrong until the owner notices.

A typical ecommerce case: a credential stuffing bot finds a working email and password pair. The attacker logs in, places several high-value orders on the saved card, changes the shipping address to a drop and swaps the account email so the owner never sees the confirmations. The owner finds the charges on a statement weeks later. By then the merchant has shipped the goods, taken the chargebacks and, if the attack hit many accounts, has a support queue full of angry customers.

Why ATO is worse than other fraud

The attacker behaves like the customer, so the early signals are faint: a new device, a new network, a password reset nobody asked for.

One account leads to the next. The password that opened a retail account often opens the victim's email, and from email the attacker can reset almost anything else.

The money is real. Fake-account fraud spends credit a lender extended; ATO spends a customer's saved card and stored balance, and the damage keeps growing until someone notices.

Regulators treat compromised customer accounts as a breach. GDPR, CCPA and PCI-DSS all carry fines and reporting duties when it happens.

Account takeover statistics

The published numbers all point the same way. The year on each figure is the year the report came out.

24% year-over-year rise in ATO attacks (SpyCloud, 2024). The highest annual growth SpyCloud has recorded, driven by automation and AI tooling on the attacker side.

$17 billion in projected ATO losses by 2025 (VPNRanks). The projection assumed losses growing by about $2 billion a year, faster than most defenses were improving.

99% of organizations targeted by ATO attempts (Proofpoint, 2024). Almost nobody is left off the target list.

62% of businesses had at least one ATO attack succeed (Proofpoint). The gap between attempted and successful is the measure of how well current controls hold.

36% of users projected to suffer ATO fraud by 2025 (VPNRanks). Better social engineering and automation keep pushing the consumer number up.

13% rise in ATO cases, 2024 over 2023 (Veriff). A steady climb with no sign of a plateau.

One-third of ATO attacks use AI-generated deepfakes or synthetic data (Veriff). Generated voices, faces and documents are now standard parts of the kit.

The seven stages of an ATO attack

Most successful attacks follow the same sequence. Each stage leaves a trace you can look for.

1. Reconnaissance

Attackers start by building profiles from breach dumps, social media, company websites and public records. Scrapers pull email addresses, usernames, phone numbers and personal details for later use.

They rank targets by what the account is worth: balances, admin rights, access to sensitive data, or a path into other systems. High-value targets get a file, with notes on online habits and security behavior.

2. Getting the credentials

Credentials come from four places: breach databases bought on dark web markets, phishing campaigns, keylogging malware and social engineering.

The market is specialized. Some groups only harvest credentials, others only cash them out. That split makes the attacks cheaper to run and harder to trace back to a source.

3. Testing the logins

Credential stuffing tools test the stolen pairs across many sites. To stay unnoticed they space out attempts, route through residential proxies so the traffic looks local, and mimic human timing to beat basic bot checks.

The output is a list of working logins, sorted by which platforms they open and what each one is worth.

4. Sizing up the account

Inside, the attacker checks saved payment methods, balances, connected services and privileges. That decides whether the account is worth more time.

They also probe the settings: can notifications be turned off, recovery methods changed, privileges raised? Accounts with admin access or links into business systems get the most attention.

5. Staying in

To survive a password change, the attacker adds a backup email, changes the security questions, enrolls another authentication device or creates a hidden admin account.

The changes are small enough not to trigger a notice. A quiet, long-lived foothold is worth more than a quick cash-out that gets the account locked.

6. Cashing out

What happens next depends on the account. Bank accounts see transfers, ecommerce accounts see orders shipped to a new address, business accounts become a way into the company.

Some attackers take small amounts over months to stay under fraud thresholds. Others drain the account fast, often during peak shopping periods when review teams are stretched.

7. Covering tracks

Professional crews delete logs where they can, clear histories and mask their infrastructure. Once the value is gone they sell the account on or abandon it, which makes attribution hard.

Every stage is a place to catch them: a new device at login, a changed recovery email, a shipping address that matches nothing in the account's history.

ATO breaches at Airbnb, Uber and Twitter

1. Airbnb (2023)

Attackers ran credential stuffing against Airbnb accounts that had weak passwords and no multi-factor authentication. They booked luxury properties, changed payment methods and pulled personal information.

A password policy without mandatory MFA left the door open, and anomaly detection on account activity would have caught the bookings sooner.

2. Uber (2022)

The Uber breach started with social engineering. An employee was talked into handing over login credentials, which gave the attacker access to internal tools and the cloud infrastructure that ran Uber's network.

The pattern is common. A phishing email that looks like it came from IT asks for account verification through a link, the employee types credentials into a fake login page, and the attacker is in. From there, customer accounts and transactions are within reach.

3. Twitter (2020)

Attackers tricked Twitter employees into giving up system credentials, then took over accounts belonging to Elon Musk, Bill Gates, Barack Obama and several major companies to push a Bitcoin scam.

Those accounts had more protection than most. It made no difference, because the attack went through staff rather than the account holders, and the damage to Twitter's reputation outlasted the money lost.

How attackers get in

Four methods account for most ATO. Attackers combine them.

Credential stuffing

Credential stuffing is the most common method and makes up as much as 90% of login attempts on retail websites. It works because people reuse passwords: a pair stolen from one site is tried on hundreds of others by a bot.

The process:

1. Buy or scrape breach databases holding millions of username and password pairs.
2. Tune the bots with machine learning so they test faster and trip fewer detectors.
3. Spread the attempts across residential proxies and compromised devices so each login looks like a different, local user.

It succeeds because:

• 70% of users reuse passwords across accounts, so one breach opens many doors.
• A botnet can test millions of pairs an hour across hundreds of sites.
• Many sites still run no bot detection on the login form.

Zoom, 2020. Over 500,000 Zoom accounts were sold on dark web forums after attackers replayed credentials from older breaches. The result was "Zoombombing": strangers joining meetings and disrupting them, plus exposed personal and work information. Zoom overhauled its account security afterwards.

Read more: how to prevent credential stuffing attacks.

Session hijacking

Session hijacking skips the password. The attacker steals the token that proves a user is already logged in, through weak session handling or an insecure network.

How the token gets stolen:

1. Token interception. After login the browser holds a session cookie; anything that can read that cookie can be the user.
2. Man-in-the-middle. On an unsecured Wi-Fi network the attacker sits between the user and the site and captures session data.
3. Cross-site scripting. A script injected into a legitimate page reads the cookie out of the victim's browser.

Why it works:

• No password to crack and no MFA prompt, because the session already passed both.
• The stolen session stays valid until it expires.
• The token is legitimate, so the activity looks like the real user.

Example: an executive opens the company banking portal on airport Wi-Fi. An attacker on the same network grabs the session token and starts a wire transfer. The bank sees a valid session and nothing else.

Malware

Credential-stealing malware runs in stages and can sit on a device for months.

How it operates:

1. Delivery through spear-phishing, drive-by downloads, unpatched software or USB drops.
2. Collection of keystrokes, screenshots, clipboard contents, browser-saved passwords and authentication tokens.
3. Persistence through rootkits, process injection and encrypted command channels.

What makes it effective:

• Months of quiet observation to learn which accounts matter.
• Theft of session tokens, crypto wallets and two-factor codes, not just passwords.
• Behavior that changes when a security tool reacts.

Emotet, 2020 to 2024. Emotet began as a phishing-delivered banking trojan with keylogging, email harvesting and lateral movement. It shipped stolen banking credentials to criminal servers, and its modular design let operators add crypto wallet theft and business email compromise tooling. Law enforcement took it down and variants came back, some using machine learning to dodge detection.

SIM swapping

SIM swapping attacks SMS-based authentication at its weakest point: the mobile carrier. The attacker convinces the carrier to move the victim's number to a SIM they control, and every one-time code follows.

How it is done:

1. Social engineering with personal details scraped from social media, breaches and public records, so the attacker passes as the customer on the phone.
2. Paid insiders at carriers who approve the transfer.
3. Carrier system flaws or stolen employee credentials that let the attacker move the number themselves.

Why it keeps working:

• Many platforms still rely on SMS for two-factor authentication.
• Carrier identity checks rest on facts that are easy to buy or guess.
• Once the swap goes through, every SMS code lands on the attacker's phone.

Coinbase users, 2020 to 2024. Several Coinbase customers lost large cryptocurrency holdings to SIM swaps. Attackers picked targets through social media and blockchain analysis, swapped their numbers at the carrier, passed SMS 2FA and moved funds to their own wallets. Crypto transfers cannot be reversed, so the losses were permanent.

Six controls that stop account takeover

No single control covers all four methods. The six below, layered, do.

1. Multi-factor authentication

MFA is the single most effective control. Research puts it at blocking over 99% of automated attacks, because a leaked password alone no longer opens the account and stolen credential databases lose most of their value.

• Combine factors: something the user knows (password), has (device) and is (biometric).
• Prefer authenticator apps (Microsoft Authenticator, Google Authenticator, Authy) over SMS codes, which SIM swapping defeats.
• Give high-value accounts FIDO2 hardware keys; they resist phishing.
• Make MFA mandatory on banking, ecommerce and business accounts, and add step-up prompts that fire on a new device or location so low-risk logins stay smooth.

2. Bot detection and CAPTCHA

Credential stuffing is automation, so bot detection on the login and signup forms breaks it before a single password is tested. Good systems block 99% of automated credential stuffing attempts without slowing real users.

• Behavioral analysis: machine learning on mouse movement, typing cadence and interaction timing separates scripts from people.
• Dynamic CAPTCHA: varied challenges that are hard for bots and quick for humans, with invisible reCAPTCHA where the risk is low.
• Device fingerprinting: browser version, screen resolution, installed fonts and hardware traits identify a device that keeps coming back under new accounts.

Read more: device fingerprinting and its role in fraud prevention.

Run the checks on every login and registration form, raise the challenge as the risk score climbs, and let the machine learning models retrain on each new attack pattern.

3. Login anomaly monitoring

Watching login behavior in real time catches the ATO attempt that got past the password.

• Learn each user's baseline and flag deviations: odd hours, unfamiliar devices, impossible travel between two logins.
• Score every login attempt on IP reputation, device traits and behavior, as it happens.
• Step up authentication or hold the session when the score crosses your threshold.

Decide the response before you need it: which score locks the account, which asks for a second factor, which pages a human. The same analytics show coordinated attacks across many accounts that no single login would reveal.

4. API security and rate limiting

Many ATO attacks go straight at the authentication API rather than the web form.

• Use OAuth 2.0 and JWT so passwords never travel with each request.
• Rate limit login and reset endpoints with limits that adapt to normal traffic, and allowlist known high-volume integrations.
• Put an API gateway in front of authentication endpoints to monitor, filter and log every call.

Rate limiting alone kills most brute force and credential stuffing runs. The gateway gives you one place to see them.

5. Password policy

MFA matters more, but password hygiene still cuts the number of stolen credentials that work.

• Require at least 12 characters with mixed case, numbers and symbols.
• Check new passwords against known breach databases and force a change on a hit.
• Keep a password history so rotation does not cycle back to an old one.
• Roll out a password manager so a unique password is the easy option, and check strength at account creation and on every change.

6. Security awareness

Uber and Twitter both fell to a person, not a system. Training reduces how often that works.

• Run phishing simulations on a schedule, not once.
• Teach the common attack patterns and what to do on a suspected hit.
• Share new threats as they appear, with role-specific detail for the teams most exposed.

Trained staff report the odd email instead of clicking it. A little gamification helps the lessons stick.

How Sensfrx stops account takeover

Sensfrx scores every signup, login and payment as it happens, from device, network and behavior signals. Your rules turn the score into allow, review or block. It is built for SaaS, fintech and ecommerce teams and is self-serve.

The Sensfrx account takeover protection page has the full feature list. The five pieces that matter for ATO are below.

1. Behavioral signals through the whole session

Sensfrx keeps checking identity after login. It reads typing rhythm, mouse movement, touch gestures and how the device is handled, builds a baseline per user and scores each session against it.

• Monitoring runs for the whole session, not just at the login form.
• Models learn each user's normal and flag the small deviations that mark a takeover.
• When behavior drifts far enough, the system steps up authentication or locks the account, by your rules.

The user sees nothing during normal use, and the baseline adapts as habits change.

2. Anomaly detection

Machine learning models score login attempts, session data, behavior and device traits together, and catch patterns that rule-only systems miss.

• Hundreds of data points go into each risk score.
• The models retrain on confirmed attacks and on false positives, so precision improves with use.
• Scores come back in time to act on the request, not after it.

3. API monitoring

Authentication and session APIs are prime targets, so Sensfrx watches them directly.

• Request monitoring flags unusual volumes, origins or timing.
• Rate limits adapt to your normal traffic and clamp down on stuffing and brute force runs.
• Coverage extends to every endpoint that handles login, session or sensitive data.

4. Alerts and automated response

When a score crosses a threshold, Sensfrx alerts your team with the context behind it and, if you set the rule, acts on its own: locks the account, demands a second factor or blocks the transaction.

• Alerts carry the device, network and behavior evidence behind the score.
• Actions run without waiting for a human, so a high-volume attack does not swamp the team.
• Thresholds and actions are yours to set per risk appetite.

5. Integration

Sensfrx sits alongside what you already run. Plugins cover WooCommerce, Shopify, WHMCS, Blesta and WISECP; REST APIs cover custom stacks, existing auth systems and other fraud tools. Configuration is per customer, and the free plan and 14-day trial let you test it on live traffic before paying.

Where to start

ATO attacks rose 24% year-over-year in SpyCloud's last count and reach 99% of organizations according to Proofpoint. The breaches at Airbnb, Uber, Twitter, Zoom and Coinbase show that budget alone does not stop them.

What the breaches have in common

Each one came down to a login that looked valid: a reused password, a phished employee, a replayed credential, a swapped SIM. The password check passed. Nothing after it was looking.

The order to do things in

Turn on MFA with app or hardware factors first. Then put bot detection and device fingerprinting on the login form, then risk scoring on each login with step-up rules behind it. Training closes the social engineering gap the technical controls leave.

One query to run this week

Pull the last 90 days of logins and list the accounts where a new device was followed by a recovery email or shipping address change within an hour. That is the lifecycle above, caught in your own data, and it tells you how big the problem is before you change anything.