8 steps to protect ecommerce customers from account takeover
Eight controls that stop ecommerce account takeover: unique passwords, 2FA, login monitoring, anti-phishing, TLS, patching, education and a response plan.
Ecommerce account takeover is a criminal logging into a real customer's account with stolen credentials and spending what is stored there: the saved card, the loyalty balance, the gift card. The merchant eats the chargeback and the customer blames the store.
Veriff's account takeover statistics put over 60% of ATO attacks on ecommerce accounts. The attack works at several points, from password reuse to a missed login alert, so the defence has to cover several points too. Eight controls below.
What ecommerce account takeover fraud is
Account takeover is identity theft moved online. Instead of lifting a wallet, the attacker logs into a shopper's account and takes the personal and payment data inside it, usually in seconds and usually unnoticed until the orders ship. The one upside of the attack being so common is that the controls against it are well understood. Here they are.
1. Push customers to strong, unique passwords
A strong password is at least 12 characters and mixes upper and lower case, numbers and symbols. It contains nothing guessable from the customer's life: no pet's name, no street.
Unique matters as much as strong. A password reused across sites falls the moment any one of those sites leaks.
"I love my dog!" is short and has one capital letter. "I_love_my_dog#!" is still memorable and far harder to crack. Enforce the length rule at signup.
Tell customers not to reuse passwords: in 60% of account takeover cases the victim's password was in use on more than one platform.
2. Turn on two-factor authentication
Two-factor authentication (2FA) asks for a second proof of identity on top of the password.
The first factor is something the customer knows, the password. The second is something they have, a phone or a device. On an ecommerce store that means an SMS code or a one-time passcode (OTP) from an app at login.
Make 2FA available on every customer account, and require it where a stolen password does the most damage: logins that look risky, and changes to email, phone or payment details.
3. Watch logins and accounts for the unusual
Monitor customer accounts for logins from unfamiliar locations and for unexpected changes to account details.
Watch behaviour as well as location: a sudden jump or drop in spending or order count, a new shipping address added minutes after a login, orders from an IP address or country the customer has never used.
4. Defend against phishing
Phishing is one of the commonest routes to account takeover. The attacker sends an email that looks like it came from you, asks for login details, then uses them to sign in, place orders or reset the password.
Set up email authentication (SPF, DKIM and DMARC) so attackers cannot send mail as your domain, and use anti-phishing tools to catch phishing attacks aimed at your customers.
5. Use SSL certificates
An SSL (now TLS) certificate encrypts traffic between the customer's browser and your site, which blocks man-in-the-middle attacks on the login and checkout. It is not a complete defence against account takeover, but it removes one way for credentials to leak.
Without it, a password typed on public Wi-Fi can be read in transit and replayed against the account.
6. Keep software and protocols current
Attackers target old software because old versions carry known, exploitable flaws. Patch the platform, its plugins and the server stack on a schedule.
Keep the transport layer current too: run a recent TLS version and retire old ones, since outdated or downgraded protocols are what man-in-the-middle attacks exploit. TLS does nothing against cross-site scripting (XSS) or phishing; those need their own controls.
7. Teach customers the basics
Give customers short, plain guidance on choosing passwords and spotting phishing.
A one-page guide or a short video showing what a fake email from your store looks like does more than a policy page nobody reads. Tell them you will never ask for a password by email.
8. Have a breach response plan
You hold your customers' data, so you own the response when it leaks. Write the plan before you need it: how a breach is detected and contained, who decides, and how and when affected customers are told.
On the technical side, use firewalls and network segmentation to limit access to sensitive systems, and intrusion detection to spot attacks on the network early.
Where to start
Account takeover is not an Amazon-sized problem. Small stores get hit because their controls are weaker and the stored cards are just as real. Start with the two controls that cost nothing: a minimum password length at signup and 2FA on account changes.
Then put scoring in front of the login so a stolen password used from the wrong device, network or behaviour pattern is caught before the session opens. That is what Sensfrx account takeover protection does, and it is self-serve.