Account takeover techniques: How attackers get in and how to stop them

Why the techniques matter

You cannot write a detection rule for an attack you cannot describe. Each technique leaves a different trace in your logs, and the controls that stop credential stuffing do nothing against a stolen session cookie.

Knowing the methods also tells you where to spend: on the login, on session handling, on secrets in code, or on the people who answer support tickets.

Account takeover fraud statistics

The numbers show both how common ATO is and what it costs. 22% of adults in the US report having been a victim. In the 2021 holiday season, 1 in every 140 login attempts was an ATO attempt.

67% of organizations say they cannot detect account compromise on their own. A successful ATO costs around $12,000 on average, and individual attacks cost victims from $50 to over $200.

Online fraud attacks are growing faster than valid online transactions; Q1 2022 saw a 233% rise. Exposure varies by sector: 29% of retail businesses and 32% of fashion retailers name ATO as their top concern.

Between 2022 and 2023, fraud rates in payments rose 54% and net fraud in ecommerce rose 40%. In banking, identity fraud losses per victim rose to $1,551, and victims spent an average of nine hours putting things right.

A Juniper Research forecast put annual business losses to ATO fraud at over $25 billion by 2024.

On top of the direct losses come breach fines, reputational damage and customers who leave and do not come back.

Impact of ATO fraud

The damage from ATO goes well past the money that leaves the account.

It hits the victim's identity, the company's reputation and the experience of every customer who has to prove who they are afterwards.

Financial losses

The direct hit: drained bank balances, unauthorized purchases, transferred funds. For a business, add the cost of the investigation, the refunds and the clean-up.

The British Airways data breach cost the company €230 million in fines and customer compensation, by the 2019 figures.

Identity theft

ATO often turns into identity theft. Social Security numbers, addresses and card details taken from the account get reused to open new credit, and the damaged credit score follows the victim for years.

The 2017 Equifax breach exposed the personal information of 147 million people, the raw material for exactly this.

Reputational damage

Customers do not distinguish between "the attacker had the right password" and "the company let someone in". They leave.

The 2013 and 2014 Yahoo breaches compromised 3 billion accounts and cost the company a lasting share of user trust and engagement.

Negative impacts on user experience

The victim gets locked out, finds transactions they did not make, and spends hours getting the account back.

After eBay's 2014 breach, users reported trouble getting into their accounts and growing worries about security, and activity and trust fell.

Real-world examples

• Facebook (2018): attackers gained access to 50 million accounts, reaching private messages and posts. Regulatory fines and lost user trust followed.
• Robinhood (2021): a run of account takeovers on the trading platform in which attackers sold off holdings in users' accounts. Victims lost money and faced a slow process to get their accounts back.
• Uber (2016): a breach exposed personal information on 57 million users and drivers. The company's delay in disclosing it brought regulatory fines and reputational damage on top.

Rise of AI in ATO fraud

AI cuts both ways. Attackers use it to run ATO at higher volume and with better bait.

Defenders use it to spot the attempts that rules miss. Both sides are below.

AI's role in ATO fraud

Attackers use AI in four main ways.

• Credential stuffing at scale: bots test thousands of username and password pairs at high speed, so every breach dump gets tried against every major site.
• Phishing and social engineering: models trained on real correspondence produce messages in the victim's own language and the sender's own style, which raises the click rate.
• Behavioural mimicry: tools profile how a real user behaves and replay it, including the timing between actions, to slip past security alerts and 2FA prompts.
• Deepfakes: synthetic voice and video impersonate a customer or an executive to talk someone into handing over credentials or approving a transfer.

AI in detecting and preventing ATO attacks

On the defending side the same techniques catch what static rules miss.

• Anomaly detection: an account that always logs in from one city and suddenly appears on another continent gets flagged.
• Real-time monitoring: login attempts, transactions and other activity are scored as they happen, so the block comes before the takeover, not after the chargeback.
• Behavioural biometrics: typing rhythm, mouse movement and touchscreen habits are hard for an attacker to copy, so they help verify the person behind a valid password.
• Adaptive authentication: the amount of friction tracks the risk. A low-risk login goes straight through; a high-risk one gets a 2FA prompt or extra verification.
• Fraud scoring: every action gets a risk score built from history and known fraud patterns, and high scores go to review or get blocked.

How does account takeover happen?

ATO is a pipeline: get credentials, check which ones work, then use or sell them.

Each stage leaves a different trace, and that is where you detect it.

The four stages

1. Compromising credentials

Everything starts with a working username and password. They come from four places:

• Phishing: email or messages that walk the user into typing their login on a fake page.
• Data breaches: credential databases pulled out of other companies' systems and traded in bulk.
• Malware: keyloggers and stealers on the victim's device that capture what they type or lift saved logins from the browser.
• Social engineering: talking someone, often a support agent, into handing over or resetting credentials.

2. Testing account validity

With a list in hand, the attacker needs to know which pairs still work.

• Credential stuffing: bots replay the stolen pairs across many sites, counting on password reuse.
• Password spraying: a few common passwords tried against many accounts, slowly enough to avoid lockouts.

3. Using or selling credentials

Verified logins are either used straight away or sold.

• Direct use: log in, take what is there, and pivot to any connected accounts.
• Resale: working logins are sold on dark web marketplaces to other criminals.

4. Accessing higher-value accounts

The first account is rarely the real target.

• Bank and financial accounts, to move money out.
• Corporate accounts, for data theft, espionage or a fraudulent transfer.
• Email accounts, because the inbox resets the password on everything else and makes a convincing sender for the next phishing round.

What gets done with a stolen account

Once inside, the attacker has options:

• Financial theft: draining balances, buying goods, moving funds to accounts they control.
• Identity theft: opening new accounts and loans in the victim's name.
• Phishing from a trusted sender: the victim's contacts get a message from a real account.
• Reputation damage: posts from a hijacked social account.
• Deeper access: a corporate login that opens restricted systems and intellectual property.

Methods of account takeover

The techniques you will see most, and what to do about each.

Credential stuffing

Credential stuffing is brute force with a head start: automated tools test large volumes of leaked username and password pairs against many sites. It works because people reuse passwords.

Exploitation of password reuse

One breach at one site gives the attacker a working login for every other site where the victim used the same pair. The attacker never guesses; they check.

Impact of data breaches

Every breach feeds the next attack. Leaked credentials circulate on the dark web quickly and end up in the lists that stuffing tools run.

Phishing

Phishing is a message that gets the user to type credentials somewhere the attacker controls.

Bulk phishing sends the same generic message to everyone. Spear phishing targets one person or one company with details that make it credible.

Training that works

Teach people what a phishing attempt looks like and give them a one-click way to report it. Then assume some will still click, and make the login survive it with MFA that a phishing page cannot relay.

Malware

Malware on the victim's device takes credentials at the source, before any of your controls see them.

Types of malware used for ATO

• Keyloggers record keystrokes, including usernames and passwords as they are typed.
• Trojans pose as legitimate software, then open a backdoor and pull login data out.
• Spyware watches activity quietly and harvests browsing habits, login details and other personal data.

What it costs

• Financial loss from the transactions made with the stolen logins.
• Identity theft from the personal data taken alongside them.
• Backdoor access to personal and corporate systems that outlasts the first theft.
• Reputational and legal damage for the organization whose users were hit.

Run anti-malware, and do not trust the device

Anti-malware on endpoints catches known keyloggers, trojans and spyware. On your side, treat the device as untrusted: a correct password from a machine that is suddenly behaving differently is a signal, not a pass.

Mobile banking trojans

Mobile banking trojans are built to steal financial data from phones. They pose as banking apps or other trusted apps to get installed, then capture what the user enters.

Mobile hygiene

Three habits remove most of the risk:

• Install apps only from the Apple App Store or Google Play Store. Sideloading from third-party sources is where most of these trojans come from.
• Keep the operating system updated; the patches close the holes the malware uses.
• Run a mobile security app that can detect and stop known malicious activity.

Man-in-the-middle (MITM) attacks

In a MITM attack the attacker sits between the user and the service, reading and sometimes altering traffic, through a compromised network such as an open Wi-Fi hotspot or through malware on the device.

Whatever crosses that connection unencrypted, including credentials, is theirs.

TLS everywhere, VPNs on untrusted networks

Two controls cover most of it:

• HTTPS encrypts traffic between browser and site, so an intercepted connection yields nothing readable. Serve everything over it and redirect plain HTTP.
• A VPN wraps all of a device's traffic in an encrypted tunnel to a server you trust, which is what protects a user on public Wi-Fi.

Stolen cookies

A session cookie is the token that keeps a user logged in. Steal it and you are logged in as them, with no password and no 2FA prompt.

That is why stealer malware goes for the browser's cookie jar as well as its saved passwords.

What a stolen session gives the attacker

Everything the user could do, for as long as the session lives:

• Act as the user, reading personal information and making changes in their name.
• Make purchases and transfers.
• Read email, private messages and confidential documents, which for a corporate account means a data breach.

Hardcoded passwords

Hardcoded passwords are credentials written into source code or config files. Convenient for the developer, and visible to anyone who gets the code.

Code leaks through breaches, accidental public repositories and insiders, and the credentials in it are the first thing extracted.

Where to keep secrets instead

Put secrets in environment variables or a secrets vault, rotate them, and scan repositories for anything that looks like a credential before it is pushed.

Compromised API keys

An API key is a password for machines. A leaked one gives the attacker whatever that integration can do: read customer data, create orders, issue refunds.

Why leaked keys hurt

• Easy to exploit: a key found in code or a log works at once, with no password guessing and no 2FA.
• Static: keys are set once and rarely rotated, so a leak from years ago can still be live.
• Widely copied: every clone of the repository and every CI log carries the same key.

Network traffic sniffing

Sniffing is passive capture of network traffic to pull out credentials and personal data. It works wherever traffic travels unencrypted.

What an unencrypted connection leaks

Anything sent in the clear can be taken:

• Passwords, card data and personal details, straight off the wire.
• Enough personal information to impersonate the victim and open accounts in their name.
• Working logins, which lead to transfers, purchases and confidential data.

Encrypting traffic against sniffing and MITM

Encryption in transit closes both sniffing and MITM:

• TLS for every web property (HTTPS in the address bar), so intercepted traffic is unreadable. Redirect plain HTTP so no login form is ever served unencrypted.
• A VPN for users on networks you do not control. It encrypts everything between the device and the VPN server.

What to do first

Most ATO still arrives as a valid password typed by the wrong person. Start where that happens: rate limit and score the login, add MFA, and keep sessions short and bound to the device.

Then work outward: secrets out of code, keys rotated, TLS everywhere, and a support process that does not reset passwords on request.

Where Sensfrx fits

Sensfrx scores every signup, login and payment in real time from device, network and behaviour signals. A valid password from a new device on a datacenter network with bot-like timing scores high; the same customer on their usual phone scores low.

Your rules turn the score into allow, review or block, so the attacker is stopped at the login and the customer never sees a challenge.

Plugins exist for WooCommerce, Shopify, WHMCS, Blesta and WISECP, and REST APIs cover everything else. There is a free plan and a 14-day trial; see pricing.

Questions about where it fits in your stack? Contact us.