New Account Takeover
Fraudsters create a brand-new online account on a platform you use — exploiting weak identity verification — and then claim ownership of your profile, rewards, or payment methods. Unlike standard account takeover, no password reset is needed because the account never existed before the fraud.
Last reviewed: 1 June 2026
What this scam is
New account takeover sits at the intersection of identity theft and platform fraud. The attacker creates a duplicate account on a service you already use — an airline loyalty programme, a retailer, a subscription service, or a financial platform — using your name and enough personal details to pass the platform's verification process. Because many platforms lack robust duplicate-identity detection, the fraudster's new account can coexist with yours temporarily, or in some cases the platform's system merges the two or replaces the genuine one.
Once the fraudulent account is established, the criminal can request password resets to your email address (which they may also control), transfer loyalty points or store credit to themselves, change the delivery address for pending orders, or use saved payment methods if the platform allows account-level billing.
This type of fraud is particularly damaging on platforms where rewards or credits hold significant monetary value — frequent-flyer programmes, hotel points, gaming platforms, and retail wallets have all been targeted. The harm is not always immediately visible on a credit report, making discovery slower.
How it works
The attacker begins with personal data obtained from a breach or phishing campaign: full name, email address, phone number, and date of birth are usually sufficient. They register a new account on the target platform using this data, sometimes using a slightly modified email (for example, adding a dot or number) to avoid a duplicate-email block.
Next they contact the platform's customer support, claiming the 'real' account (yours) was compromised and requesting a merge or transfer. Alternatively, they use the new account to trigger 'I forgot my email' flows, feeding in enough of your personal details to convince a customer service agent to hand over account access or transfer balances.
Some attackers do not bother with customer service at all. If the platform allows social sign-in, they create the fraudulent account via a different auth provider and then link it to your email, effectively inserting themselves into your login chain. By the time you notice, rewards may be redeemed and payment details changed.
Why this scam works
Platforms invest heavily in protecting existing accounts from password-based takeover, but many have weaker controls around account creation because they do not want to create friction for genuine new users. Customer service agents, trained to help frustrated customers, may be socially engineered into merging accounts or transferring value before verifying identity thoroughly. Loyalty programmes in particular have historically treated fraud as a low-priority customer experience issue rather than a security one.
Common red flags
- Email confirming a new account registration you did not initiate
- Notification that your account email or phone number was changed
- Loyalty point balance drops without corresponding redemptions
- Customer service tells you a second account exists under your details
- Password reset emails arriving unexpectedly
- Orders placed or delivery addresses changed without your action
- Subscription or payment method changes you did not make
Sanitized example messages
Illustrative, sanitized examples. Personal details are replaced with placeholders such as [phone number] and [fake link].
Welcome to [Platform], [Your Name]! Your account has been created. If this was not you, contact [Support Email].
Your [Airline] Frequent Flyer account email has been updated to [New Email]. If you did not make this change, call [Fraud Line] immediately.
You have redeemed [Points] from your [Hotel Programme] account for a stay at [Property]. Enjoy your stay!
Hi [Your Name], a new sign-in method has been added to your [Retailer] account. If this was not you, secure your account now.
[Gaming Platform]: your in-game wallet balance has been transferred to account [ID]. Contact support if you did not authorise this.
Common variations
- Loyalty point theft via duplicate account creation
- Gift card or store credit transfer after account merge manipulation
- Subscription service duplicate account to access paid content
- Gaming account hijack through alternate sign-in method injection
- Retailer account clone to redirect pending orders
How to verify before you act
Log in to all platforms where you hold an account and check your profile settings for unrecognised email addresses, phone numbers, or social sign-in connections. Enable all available security notifications so you are alerted to any changes. If a platform allows you to view active sessions or linked devices, review these periodically. Use a unique email address for high-value loyalty accounts so that a breach of your primary email does not expose all registrations.
Payment methods used
- Cryptocurrency
- Bank/wire transfer
- Gift cards
- Money transfer services
- Payment apps to 'friends & family'
Who is usually targeted
- Frequent flyers and hotel reward members
- Retail loyalty programme members
- Online gamers with valuable in-game currency
- Subscription service users
What to do immediately
- Contact the platform's fraud team immediately — not general support — and report the duplicate account
- Change your password and enable two-factor authentication on your legitimate account
- Remove any unrecognised payment methods or delivery addresses
- Ask the platform to lock the fraudulent account and provide you a case reference number
- Check other platforms that use the same email address for similar suspicious activity
- Report to Action Fraud (UK) or the FTC (US) if financial loss occurred
- Review linked payment methods at your bank for any unexpected charges
How to prevent it
- Use a unique, strong password for every loyalty and retail account
- Enable two-factor authentication wherever available
- Use a separate email address for high-value reward accounts
- Periodically review linked sign-in methods in your account security settings
- Set up email and app notifications for any account changes
- Check your loyalty balances monthly to spot unexpected redemptions
- Never reuse passwords across platforms, especially those with stored payment details
Evidence to preserve
- Screenshots of the fraudulent account if visible in your profile settings
- Email notifications of unauthorised changes or registrations
- Platform customer service correspondence and case reference numbers
- Records of any redeemed points, missing credits, or changed orders
- Bank or payment statements showing charges linked to the platform
- Timestamps of when you last legitimately accessed the account
- Any customer service chat transcripts
Where to report it
- Action Fraud (UK) — UK national fraud & cybercrime reporting centre
- FTC ReportFraud (US) — US Federal Trade Commission fraud reports
- FBI IC3 (US) — US Internet Crime Complaint Center
- Scamwatch (Australia) — Australian competition & consumer reporting
- Your bank's fraud line — Use the number on the back of your card or in your banking app — never a number the caller gives you
Always verify reporting routes and emergency contacts on the official government or agency website for your country.
Frequently asked questions
Can the platform reinstate stolen loyalty points?
Many platforms will reinstate points if you report quickly and provide evidence. There is no legal guarantee, but most major airlines and hotel chains have fraud recovery teams that handle these cases. File a formal fraud report with the platform in writing.
Is this the same as account takeover fraud?
Not exactly. Traditional account takeover compromises an existing account via stolen credentials. New account takeover creates a duplicate account using your identity data, bypassing the need for your password entirely. Both require prompt action but different remediation steps.