Account takeover fraud (ATO fraud) occurs when an unauthorized person gains access to a legitimate account and uses that access to commit financial abuse or steal sensitive data, with the trusted identity sometimes becoming a launch point for additional attacks.
Between January and November 2025 alone, the FBI IC3 received more than 5,100 ATO complaints with losses exceeding $262 million. Because the activity comes from a real account, it often looks legitimate at first glance and can spread damage quickly before anyone realizes the account has been misused.
Key Takeaways:
- Account takeover fraud begins with compromised access and allows attackers to misuse a trusted identity for fraud, data theft, or follow-on attacks.
- Attackers use several paths to gain access, but they often rely on persistence mechanisms that help them stay inside an account after the initial compromise.
- The strongest warning signs appear when unusual logins, unauthorized account changes, and suspicious downstream activity are viewed together.
- Prevention is most effective when strong authentication and behavioral monitoring are backed by fast response to contain misuse before it spreads.
Types of Account Takeover Fraud
Account takeover fraud attacks usually begin with credential theft or token abuse and often combine several methods in one campaign.
Attackers use a range of methods to gain unauthorized access, and they frequently chain multiple techniques together within a single operation. Most attacks begin with credential acquisition through one of the methods below. Once inside an account, the attacker works to stay hidden through email forwarding rules that redirect security alerts and registration of new MFA tokens on attacker-controlled devices. They may also delete notification messages.
Credential Stuffing
Credential stuffing is the automated injection of stolen username and password pairs, typically sourced from unrelated data breaches, into login forms across different services. The attack exploits a simple reality: many people reuse the same password across personal and business accounts. When a breach at one service exposes credentials, attackers test those same combinations against banking portals, email platforms, and SaaS applications.
Automated tools make this feasible at scale. Attackers feed millions of credential pairs from breach dumps into software that tests them against dozens of target services simultaneously. They rotate through residential proxy networks to defeat both IP-based rate limiting and geofencing controls.
Organizations can detect credential stuffing by monitoring for elevated failed-login rates across many accounts simultaneously, a pattern distinct from the per-account failures of brute force. The 2025 Verizon DBIR found that credential abuse accounted for 22% of all confirmed breaches as an initial access vector.
Phishing and Spear Phishing
Phishing remains the most common entry point for account takeover fraud. Broad phishing campaigns cast a wide net. They send messages that mimic login pages for email providers, banks, or cloud platforms to trick recipients into entering their credentials. Spear phishing narrows the focus: attackers research a specific target, reference real conversations or business relationships, and craft messages designed to bypass both technical filters and human skepticism.
Modern phishing operations frequently use real-time proxy techniques. The attacker's spoofed login page is a relay that passes the victim's credentials and MFA codes to the legitimate service in real time. The attacker captures the resulting session token before the victim realizes anything is wrong, which can defeat standard MFA entirely. Attackers have also used legitimate infrastructure to generate authentication prompts that appear to originate from the target organization's own domain. From the victim's perspective, every element of the login flow looks authentic because the underlying infrastructure is real.
Password Spraying and Brute Force
Password spraying takes a different approach from traditional brute force. Traditional brute force tries many passwords against a single account, which triggers lockout protections. Password spraying uses a small list of common passwords like "Password01" against hundreds or thousands of accounts simultaneously. This keeps the number of failed attempts per account below lockout thresholds, often at one or two attempts per account per day. Akira threat actors have used password spraying against VPN endpoints, SSH services, and Active Directory environments as initial access vectors.
Traditional brute force and offline password cracking remain effective under specific conditions. When attackers steal hashed password databases, they run cracking tools on their own hardware without any interaction with the target's login systems, which means lockout policies and rate limiting offer no protection.
SIM Swapping
In a SIM swap, the attacker contacts a mobile carrier, impersonates the victim, and convinces a representative to port the victim's phone number to an attacker-controlled SIM card. Once the number is transferred, every SMS verification code and one-time passcode sent to that number goes directly to the attacker. Attackers compile personal details from social media profiles and prior breach data to impersonate victims convincingly to carrier representatives. The Scattered Spider threat group has used SIM swapping as an operational step in broader intrusion campaigns.
SIM swapping is particularly dangerous because it defeats SMS-based MFA without any interaction with the target organization's systems. The attacker simply receives the codes that the legitimate authentication service sends. Phishing-resistant MFA methods like FIDO2 hardware security keys counter SIM swapping directly, since authentication is bound to a physical device and domain, and a carrier-redirected phone number cannot control access.
Help Desk Social Engineering
Help desk manipulation targets the people authorized to manage authentication controls within an organization. Attackers call IT help desks impersonating employees, present personal details sourced from social media or prior data breaches, and request password resets or MFA token transfers. CISA reported that threat actors posed as company IT staff via phone calls and SMS. They convinced help desk personnel to reset credentials and register new MFA devices on attacker-controlled hardware. CISA has documented threat actors adding a federated identity provider to an organization's single sign-on environment after compromise, a backdoor that survives password resets.
Because the resulting access comes through legitimate administrative channels, it generates no suspicious login signals and produces credentials indistinguishable from normal IT operations in audit logs. The attack bypasses technical controls entirely by manipulating authorized personnel. Attackers often perform targeted reconnaissance beforehand, identifying the most valuable users and gathering enough personal information to answer security questions or satisfy identity verification procedures that rely on knowledge-based checks.
Session Hijacking
Session hijacking allows attackers to take over active, already-authenticated sessions without ever needing the account password. Techniques include stealing session cookies from a victim's browser through infostealer malware, intercepting tokens via man-in-the-middle positions on unsecured networks, or extracting locally stored session data from applications. Session tokens extracted from browser storage can be replayed from any device, and attackers gain access without triggering device-based authentication challenges. Remote session hijacking is an established technique that can let attackers bypass password and MFA requirements.
Session management guidance addresses session attacks as a distinct threat category. A password reset alone may leave an attacker's session active. Revoking all active sessions, rather than simply resetting passwords, is the only reliable way to remove an attacker who gained access through session theft. Organizations should treat any confirmed session hijacking as requiring a full session and token invalidation across all services the account can reach.
OAuth and Device Code Abuse
OAuth abuse and device code phishing target the authentication tokens that grant third-party applications access to a user's account. In device code phishing, the attacker tricks a victim into entering a code on a legitimate authentication page, which authorizes the attacker's device to receive an access token. Because the authentication URL and code are both legitimate, the interaction is indistinguishable from normal device registration, and the attack bypasses traditional phishing detection. Attackers have used device code phishing for account takeovers. Security teams should monitor for device code authentication flows originating from unexpected geographic locations.
Unauthorized OAuth grants are a documented persistence mechanism, and an attacker who obtains an OAuth grant can maintain access long after an organization believes it has remediated a compromise. To terminate this type of unauthorized access, revoke all active OAuth grants. Security teams should audit OAuth application grants as part of any compromise investigation, since unauthorized grants are a persistence mechanism that standard password resets do not address.
Warning Signals of Account Takeover Fraud
Unusual login patterns and unauthorized account changes often reveal account takeover fraud, especially when later activity shows the attacker trying to turn access into fraud.
Detecting account takeover fraud depends on correlating multiple behavioral signals. A single alert rarely provides enough context.
Login Behavior Anomalies
Login behavior often provides the earliest visible sign that an account has been misused. Warning signs include unrecognized devices, logins at unexpected times, impossible travel between geographic locations, and connections from anonymization services or known threat infrastructure. A single event may not confirm compromise on its own, but patterns across multiple sessions can reveal that a legitimate account is being used in a way that does not match the real user's normal activity.
These signals are most useful when organizations compare them against a baseline. In practice, that means correlating device history, location, timing, and authentication flow details. When several anomalies appear together, the likelihood of account takeover fraud rises sharply.
Post-Compromise Account Changes
Unauthorized changes inside the account often show that an attacker is trying to maintain access or reduce visibility. Common examples include new email forwarding rules that redirect messages externally, mass deletion of sent items or security notifications, and unauthorized OAuth application grants, as noted in CISA Exchange Online security guidance. These actions are valuable to attackers because they help hide alerts, capture future communications, and preserve access even after a password reset.
The timing of these changes also matters. A new forwarding rule that appears shortly after an unusual login or MFA enrollment event is far more suspicious than the same change in isolation. This is why mailbox auditing, change tracking, and sign-in logs need to be available before an incident occurs.
Downstream Activity
Suspicious downstream activity shows how account takeover fraud turns unauthorized access into business impact. Requests to change payment account details or redirect wire transfers are especially important because they move the incident from compromise into fraud. Attackers may also use the compromised account to contact coworkers, vendors, or customers in ways that appear routine at first glance.
These later-stage behaviors are often what trigger investigation, but they usually come after earlier signals. By the time a payment diversion attempt appears, the attacker may already have reviewed messages, mapped relationships, and established persistence. Organizations that correlate downstream activity with earlier login and account-change signals are better positioned to catch misuse before losses escalate.
How to Prevent Account Takeover Fraud
Preventing account takeover fraud requires layered controls that combine stronger authentication with continuous behavior monitoring and fast containment.
Phishing-Resistant Authentication and Credential Policies
Standard MFA, particularly SMS-based one-time passcodes, can be intercepted through SIM swapping, real-time phishing proxies, and social engineering of help desks. Phishing-resistant MFA methods, such as FIDO2 hardware security keys and passkeys, bind authentication to a specific device and domain, which prevents attackers from replaying credentials on a spoofed site. CISA recommends phishing-resistant MFA as a top-priority control and specifically identifies webmail, VPNs, accounts accessing critical systems, and privileged accounts as priority deployment targets.
Password policies should align with current NIST guidance. Passwords should be long, stored with salted hashes, and password hints should be disabled. Account lockouts after multiple failed attempts reduce the effectiveness of spraying and brute force. NIST's current SP 800-63 guidelines also recommend against requiring frequent password rotations, which tends to push users toward weaker, more predictable passwords. Knowledge-based authentication (security questions) should be eliminated entirely, as NIST explicitly states that KBA does not constitute an acceptable secret for digital authentication.
Behavioral Monitoring and Zero Trust Architecture
Behavioral monitoring and zero trust architecture help limit account takeover damage by treating valid credentials as only one part of the trust decision.
Behavioral analytics tools establish a baseline of normal activity for each user. The baseline includes typical login times, devices, locations, and communication patterns. The tools flag deviations from that baseline. Baselines should also cover data access patterns, file download volumes, and communication frequency. An attacker who logs in with valid credentials from an expected location but then accesses systems the real user has never touched or downloads large volumes of email will trigger alerts that point-in-time authentication alone would miss. New forwarding rules can provide another signal of misuse. Integrating these signals with security information and event management (SIEM) systems allows security teams to correlate alerts across identity and email activity, along with network-layer events.
Zero trust architecture reinforces behavioral monitoring by operating on the principle that no user or device should receive implicit trust based solely on network location or prior authentication. Every access request is verified independently, and authorization is scoped to the minimum permissions required. CISA's Zero Trust Maturity Model provides a practical roadmap for implementation. For account takeover prevention specifically, zero trust reduces the blast radius of a compromised account.
Incident Response for Account Compromises
Account takeover response works best when organizations can quickly contain access while preserving evidence and reviewing the account for persistence and downstream misuse.
Organizations should have documented procedures for responding to confirmed or suspected account takeovers. Effective response starts with preserving forensic evidence before taking remediation actions that could overwrite logs. Containment follows: immediately revoke active sessions and OAuth tokens, then reset credentials and disable compromised accounts. Responders then conduct a forensic audit of recent account activity by reviewing email forwarding rules, OAuth application grants, login history, and delegated access permissions for unauthorized changes.
After reviewing direct account modifications, responders should check whether the compromised account was used to send internal phishing messages or access systems outside its normal scope. Downstream contacts who received messages from the account during the compromise window should be notified directly, since those messages may contain fraudulent payment instructions or credential-harvesting links. Organizations should pre-establish logging and retention policies so forensic data is available when an incident occurs.
Regulatory Frameworks That Address Account Takeover Fraud
Authentication strength, access controls, logging, and identity theft prevention sit at the center of the main regulatory frameworks that address account takeover fraud.
Authentication and Access Control Requirements
Multiple regulatory frameworks now directly address the risks that account takeover creates, with authentication and access controls as primary requirements.
- NIST SP 800-63-4: Establishes an assurance level system for authentication strength.
- FFIEC Authentication Guidance: Applies to federally supervised financial institutions and requires MFA for high-risk transactions and layered security controls.
- PCI DSS v4.0: Extends MFA requirements to broader user groups, prohibits hard-coded credentials, and mandates secure MFA implementation.
Building Defenses That Match the Threat
Account takeover fraud is hardest to stop when organizations rely on one control. Organizations should treat identity abuse as a layered risk. Phishing-resistant MFA and continuous behavioral analysis, applied under zero trust principles, give organizations a stronger way to limit damage when a trusted account is misused.
Frequently Asked Questions
Does Multi-Factor Authentication Stop Account Takeover Attacks?
MFA significantly raises the difficulty for attackers. Some account takeover attempts can still succeed. Phishing-resistant methods like FIDO2 hardware security keys and passkeys are much harder to bypass because they bind authentication to a specific device and domain and stop credential replay on attacker-controlled sites. SMS-based MFA remains vulnerable to SIM swapping and real-time phishing proxies.
What Types of Accounts Are Most Targeted in Account Takeover Attacks?
Financial accounts are the most frequently targeted because they offer direct monetary payoff. Email accounts are a close second because they are recovery points for other services. Business email accounts are especially valuable because they enable business email compromise (BEC), where attackers impersonate executives or vendors to redirect payments.
What Should an Organization Do Immediately After Discovering an Account Takeover?
Containment comes first: revoke all active sessions and invalidate any OAuth tokens granted during the compromise, then reset credentials. Review recent activity for email forwarding rules, delegated access grants, and message deletions that could indicate data exfiltration or persistence mechanisms. Notify affected parties directly.
