Ecommerce account takeover: 7 ways customers lose their accounts
Account takeover is the largest category of ecommerce fraud. Seven routes fraudsters use to get into customer accounts, and what a merchant can do about each.
Any store that sells worldwide has fraudsters among its visitors, and the hardest to spot never type a stolen card at checkout. They log in as an existing customer and use the card already on file.
That is account takeover. The attacker buys or steals a working credential, logs in, and orders as much as they can before the real customer or the merchant notices.
It is the largest category of ecommerce fraud. In FinancesOnline's 2022 round-up of fraud statistics, account takeover accounted for 29.8% of ecommerce fraud.
The credential comes from a phishing page, a stolen password or a leaked database. The seven methods below are how it changes hands.
Once inside, the attacker reads saved personal and payment details, changes the delivery address and places orders. The customer gets card fraud and sometimes identity theft; the merchant gets the chargebacks and loses the customer.
Here is each route, and what it looks like from the merchant's side.
How attackers get into ecommerce accounts
Ecommerce pays well for attackers because every account has a card on file and a trusted order history. The methods run from technical (sniffing a Wi-Fi network) to plain persuasion (emailing your support desk as the customer).
1. Tricking online merchants
Shoppers are the most common victims of ecommerce account takeover, but the way in often runs through the merchant's own support desk.
The fraudster emails support posing as the customer and asks for help with the account: a password reset, a new card on file, or a changed shipping address because they have "misplaced" the old details.
Once support makes the change, the fraudster updates the billing or delivery address and leaves the name and email alone, so the real customer sees nothing wrong until the order has shipped. The tell for a merchant is an address or card change requested by email rather than made from a logged-in session.
2. Sniffing and injecting attacks on public wi-fi
An attacker on the same network as the shopper, or running a fake hotspot, can read traffic in the clear and inject their own. It is a man-in-the-middle attack.
Card numbers and passwords sent over that connection are theirs. The shopper's defence is a VPN service such as NordVPN, which encrypts traffic before it leaves the device. The merchant's defence is HTTPS on every page, so there is nothing readable to sniff.
3. Phishing emails
A phishing email looks like it came from a company the shopper trusts and leads to a login page the attacker controls. The shopper types their email and password; the attacker logs into the real account and buys, or changes the billing details.
Some phishing emails pretend to be the store itself, asking the customer to "update account information". Others announce a lottery or sweepstakes win and ask for personal and bank details to pay it out.
4. Malware attacks
Malware is one of the main reasons ecommerce customers lose their accounts.
It arrives when the shopper visits a compromised site or opens an email attachment.
Once on the machine it reads saved passwords and personal details, or records them as they are typed, and the attacker uses them to log in. From the store's side that login arrives with the right password and sometimes from the right device, which is why behaviour signals matter as much as device signals.
5. Data breaches
Breaches are a fact of online shopping, and the stolen records accumulate.
Attackers hold more personal data than ever: names, addresses, dates of birth, past orders. With it they can impersonate a customer well enough to pass a support desk's identity questions or answer a password reset.
Then they take over the account when the moment suits them.
6. Data dump websites
Data dump sites sell personal information and stolen card details in bulk: names, addresses, phone numbers, email addresses, card numbers and expiry dates.
Some give the data away; others charge for it.
Buyers use it against ecommerce accounts that are not protected by two-factor authentication (2FA) or any other check beyond the password.
On a site with no 2FA and no login risk check, a stolen email and password is a full takeover. The attacker logs in and buys with nothing else asked of them.
7. Automated bots
Bots do the volume work, and they are one of the most common ways customers lose accounts.
One kind harvests email addresses tied to ecommerce accounts and mails them links and attachments that drop malware. Another takes a list of leaked credentials and tries each pair against a store's login form until one fits. More on both kinds on the Sensfrx blog.
Either way the result is the same: malware or a valid credential, and an attacker inside the customer's account.
What a merchant can do about it
As more business moves to online payment, confidence that it is safe grows with it.
That confidence assumes criminals lack the means. They do not. The seven routes above are cheap and well documented, and the people running them adapt as fast as the stores do.
Two steps blunt most of them. Put a second factor or a risk check on login, so a correct password from an unknown device is not enough on its own. And treat any card or address change requested by email as unverified until the customer confirms it from a logged-in session. Our account takeover protection page shows how the login check works.