Account Takeover Fraud
Account takeover fraud is the unauthorized use of someone else’s existing account. Also called account takeover or ATO, it differs from most fraud in one important way: the account is legitimate, the history is real, and every check performed at onboarding was passed by the rightful owner years earlier.
| Also called | Account takeover, ATO, account compromise |
| Target | An existing account with a real, verified owner |
| Common entry methods | Credential stuffing, phishing, SIM swap, session hijacking, malware, social engineering of support staff |
| Why credential stuffing works | Password reuse — one breach exposes credentials that work elsewhere |
| Typical dwell time | Hours to weeks, depending on the attacker’s patience |
| First action after access | Reconnaissance and quiet changes — contact details, notification settings |
| Sectors most affected | Banking, ecommerce, telecom, loyalty programs, crypto exchanges |
| Why onboarding checks miss it | They ran years ago, on the genuine owner |
How it works
Access comes first, and it rarely involves breaking anything.
Credential stuffing is the volume play. An attacker takes username and password pairs from an unrelated breach and replays them against a target at scale, because a substantial share of people reuse passwords. Nothing is cracked — the credentials were already valid somewhere else.
Phishing harvests credentials directly and increasingly captures the second factor too, by relaying a one-time code through a proxy in real time. SIM swap attacks the recovery channel rather than the login: the attacker convinces a carrier to port the victim’s number, and every SMS code follows. Session hijacking skips authentication entirely by stealing a valid session token, which is why a stolen cookie can be worth more than a password.
The most under-appreciated route is social engineering of support staff. An attacker who cannot pass the login flow calls the contact center instead, armed with enough personal detail — usually from fullz — to satisfy an agent’s verification script. The account is handed over through the front door.
What happens next is what makes ATO expensive. A competent attacker does not immediately drain the account. They change the notification email so alerts stop reaching the owner, add a new device quietly, wait out any cooling-off period on payee changes, and only then move value. The delay is deliberate — it puts distance between the compromise and the loss, so the owner has no obvious event to report.
Why it matters for identity verification
ATO exposes the limit of treating identity as something established once. Verification at account opening confirmed the owner, correctly, possibly years ago. It has nothing to say about who is holding the credentials today.
That is a structural gap rather than a quality problem. No improvement to onboarding verification catches an account compromised afterwards, because the fraud happens entirely outside the window onboarding covers. Detection has to come from signals during the session — an unfamiliar device, an impossible location change, behavioral patterns that do not match the owner’s history.
The response that actually resolves it is step-up verification at the moments that matter. When a session scores as risky, or the user attempts something high-consequence — changing a payee, raising a limit, updating contact details — the useful question is whether the person acting is the account’s verified owner. Answering it takes a live biometric check against the identity captured at onboarding, which is a question a stolen password cannot answer.
This also closes the support-desk route. An agent working from a script can be talked past; a liveness-checked face match against the enrolled identity cannot. Linking activity to a verified identity is what makes that possible, and Microblink’s stolen identity detection covers both the session signals and the step-up check.
Account takeover vs new account fraud
| Account takeover | New account fraud | |
|---|---|---|
| Account status | Exists, with a genuine owner | Created by the fraudster |
| Identity used | The victim’s own, already verified | Stolen, synthetic, or fabricated |
| When onboarding checks ran | Years earlier, on the real owner | At the moment of the fraud |
| Primary control | Session signals and step-up verification | Identity verification at opening |
| Victim awareness | Eventually — unless alerts were suppressed | Often none, if the identity was synthetic |
| Account history | Real, and used as cover | Thin or fabricated |
| Hardest part | Distinguishing the attacker from the owner | Distinguishing a fake identity from a thin file |
The two are frequently handled by one team and need opposite controls. New account fraud is stopped at the door. Account takeover is already inside, using an account the institution has every reason to trust.
What it can’t be solved by
Passwords, at any complexity. Credential stuffing does not attack password strength — it replays credentials that were already valid. A long, complex, reused password fails exactly as fast as a weak one.
SMS one-time codes. SIM swap redirects them and real-time phishing proxies relay them. SMS remains better than nothing and is no longer a meaningful barrier to a motivated attacker.
Login-time checks alone. Session hijacking bypasses login entirely, and an attacker who gets in legitimately at 9am may act at 3pm. Controls that fire only at authentication miss everything that happens after it.
Device fingerprinting on its own. Useful, and defeated by an attacker on a clean device with a residential proxy. It raises cost rather than closing the route, which is why it belongs in a stack rather than as the answer.
Frequently asked questions
What is the difference between account takeover and identity theft?
Identity theft uses someone’s personal information to open new accounts or impersonate them broadly. Account takeover targets an account that already exists, using the victim’s own verified relationship with the institution as cover.
How do attackers get into accounts without breaking the password?
Most commonly by replaying credentials stolen from an unrelated breach, which work because people reuse passwords. Others steal a live session token, redirect the recovery channel through a SIM swap, or talk a support agent through their own verification script.
Why doesn’t multi-factor authentication stop account takeover?
It stops a great deal of it. SMS codes specifically are weakened by SIM swap and by phishing proxies that relay a code in real time. Stronger factors — passkeys, or a biometric check against an enrolled identity — are substantially harder to intercept.
How is account takeover detected?
Through signals during the session rather than at login: an unfamiliar device, a location change that is not physically possible, behavior that does not match the account’s history, and sensitive changes such as a new payee or contact address. Risky sessions then escalate to a step-up check.
Related reading
- Fullz — the stolen data that gets an attacker past a support agent
- Synthetic identity fraud — the opposite problem — an account with no real owner at all
- Fraud detection — the session signals that surface a compromised account
- Fraudulent transaction — what an attacker does once they are inside
