Account takeover fraud: What ecommerce merchants need to know

What account takeover is

Account takeover (ATO) is a form of identity theft in which a third party gets control of someone else's online account and uses it for their own ends.

It is one of the most common attacks on any site with a login. Whoever holds the account holds everything behind it: saved cards, addresses, order history, and often social security numbers and other financial details.

Attackers take accounts to steal data, damage reputations or commit fraud, and they do it more every year because hijacking an online account has become cheap and easy.

Where account takeover attacks come from

Account takeover attempts arrive from anonymous proxies, botnets, cloud hosting servers and ordinary ISPs. One breakdown by country put 45 percent of attacks in the US, with the UK, Brazil, China and Russia next at much smaller shares. Most attempts pretend to be a trusted browser, usually Chrome, even though a large share (47.2 percent) are launched from proprietary bot engines or tools.

Who gets targeted

Banks used to be the main target. Now any business with a user-facing login is one. The motive is money, and the fastest routes to it are stealing cryptocurrency, selling customer data, or tricking victims into installing ransomware.

Personally identifiable information (PII) is the prize in most cases. With it a criminal can commit insurance fraud, harvest card details, or open lines of credit in the victim's name.

Stolen personal details also make spam and phishing campaigns more convincing and help attackers pick their next victims. Those campaigns lean on the public sector, healthcare and education.

Ecommerce is hit the same way, and so are hosting billing panels. The attacker logs into a customer's account, fills the basket with high-value items, changes the shipping address to one they control, and pays with the card already saved on the account. The whole thing takes minutes. See ecommerce account takeover fraud for the full pattern.

How the credentials get stolen

Five routes account for most account takeovers:

Data breaches. Breaches expose billions of records a year, and most of what an attacker needs is a username and password. Because people reuse passwords across sites, one leaked pair is tried against many services. That is credential stuffing, and it is the most common route in.

Brute force. Attackers run bots that try many password combinations a second until one works. An 8-character password can be cracked in an hour or less with current tools. See brute force attacks.

Phishing. The attacker asks for the credentials and the victim hands them over. The bait arrives by email, SMS, fake websites, chat, or malicious mobile apps. See how to prevent phishing.

Malware. Keyloggers capture passwords as they are typed; other malware reads banking details straight out of the browser. Either way the credentials leave the victim's device without them knowing.

Man-in-the-middle (MitM). Traffic passes through many servers on its way to a site. Unencrypted, it can be read in transit, usernames and passwords included. These attacks usually run over public Wi-Fi or compromised home routers.

How banks detect account takeover, and what merchants should copy

Banks take ATO most seriously because a hijacked account turns into stolen money within minutes. Their answer is continuous monitoring, which spots the early signs before the money moves.

A good detection system sees every action a user takes across a session, not just the login. A criminal has to do several things before they can take money, such as adding a new payee, and each step is a chance to catch them.

Logging every action on an account lets you see the patterns that precede fraud. A system that monitors behaviour continuously picks up those clues and tells you whether the person in the session is the customer.

Location is one of the simplest signals. A login from South America followed 20 minutes later by one from Asia means two different people are using the account.

The most dependable way to detect ATO is a third-party system built for it. The sections below cover what such a system needs to do.

Anyone with an account can be a victim. The defence is the same for all of them: watch the account closely enough to notice when someone else is in it.

How to prevent account takeover

Any business that asks users to register and log in needs account takeover protection. The controls below, in rough order of cost:

Block old browser versions. Bot operators favour outdated browsers for their known weaknesses. Refusing them removes a lot of automated traffic at no cost to real users.

Close the paths bots use. Find the gaps in your site that let bots in, including hidden or forgotten endpoints, and protect them.

Check traffic sources. Source, session length and bounce rate together separate artificial traffic from real visitors.

Watch failed attempts. A high volume of failed logins, failed gift card or card entries, or oddly spaced retries all point to an ATO attempt in progress.

Full-stack bot management. Bot management tools find and cut malicious bots at every entry point. They work, and they are expensive.

Two-factor authentication (2FA). A second check on top of the password: an SMS code, an email code, or a fingerprint on mobile.

The email code is weak if the attacker also has the mailbox and no backup address is set, so prefer an authenticator app or a hardware key where you can.

Modern CAPTCHA. The current generation uses behavioural and environmental analysis with little visible friction, which makes it one of the better defences against automated takeover attempts.

Account takeover protection. Beyond the basics, four strategies protect the account itself.

Multi-factor authentication.** Ask for something in addition to the password:

• Something they know: a security question such as a first pet's name.
• Something they have: a token, a hardware key, or another physical object.
• Something they are: face, iris or fingerprint.

Do not ask every time. Make it adaptive: trigger the extra step when the login comes from a new device or an unusual place, and let known devices through.

Account tracking. Have a procedure for the moment an account is found compromised. Sandbox it so you can review everything tied to it, then suspend it if the review confirms the takeover.

AI-based detection. Fourth-generation bots mimic human behaviour, which puts them past rule-based checks. Machine learning detection that scores device, network and behaviour signals together catches these attempts and flags the sessions worth a second look.

Web application firewall (WAF). A WAF in front of the login helps by:

• blocking requests from known attackers
• detecting the bad bots used in ATO attacks
• identifying credential stuffing on login portals
• blocking brute force by flagging sessions that submit an unusual number of credentials
• enforcing MFA or sign-in through third-party identity providers such as Google
• scanning traffic for the fingerprints of credential stuffing tools

Account takeover protection with Sensfrx

[Sensfrx](/) scores every login in real time from device fingerprint, network and behaviour signals, and compares the session with the account's own history. A login from an unfamiliar device, location or behaviour pattern is flagged before it can be used.

Your rules turn the score into allow, review or block, so a trusted customer logs in with no extra step and a suspicious session gets a challenge or a hold. Sensfrx runs on ecommerce stores, SaaS products, fintech and hosting platforms, with plugins for WooCommerce and Shopify among others.

Integration is a JavaScript tag on the site, a server-side SDK, mobile SDKs, or the REST API. Pick the one that fits your stack in the integration documentation.

Where to start

Account takeover hurts the merchant and the customer at once. Securing the login protects your reputation, your growth and your customers' lifetime value, and the controls above are a tested way to do it.

Every day without them is a day the accounts are exposed. On the login and checkout gateways attackers care about most, bad bots have been measured at 98.3% of requests, and they do not wait.

Behind every bot is someone trying to profit. If stealing an account on your site can be turned into money, the attempts are coming. They range from quiet, low-volume attacks that never show up in a dashboard to floods that can take down a web server. The methods and the numbers above will shift as attackers adapt; the defence, watching every login closely, does not.

Start with adaptive MFA and failed-login monitoring this week. Then add real-time scoring so the decision happens before the login succeeds, without adding friction for the customers you want to keep.