Account Takeover Scams

Account takeover (ATO) is a broad category of fraud in which a criminal gains unauthorised access to an existing account belonging to someone else. Unlike identity theft, which typically involves creating new accounts fraudulently, account takeover focuses on hijacking accounts that already exist and have established history, balances, contacts, and trust.

The mechanisms vary. Credential stuffing uses username and password combinations leaked in data breaches and tries them across many services — exploiting the widespread habit of reusing passwords. Phishing captures credentials directly through fake login pages. SIM swaps intercept SMS authentication codes. Malware on a device can log keystrokes or extract saved credentials from a browser.

Once inside an account, the attacker's options depend on what they have accessed. A compromised email account is particularly valuable: it acts as a master key for resetting passwords across any service linked to that address. A banking account enables direct financial fraud. A social media account can be used to run scams targeting the victim's contacts, sell the account, or hold it for ransom. A loyalty or rewards account may have points that can be converted to gift cards or transferred.

Account takeovers have grown in frequency as the volume of data breaches has made credential data widely available and inexpensive. Many people have credentials from old accounts floating in breach databases, and those same credentials unlock more valuable accounts if passwords have been reused.

The most common pathway begins with a data breach at a service you use. Your email and password combination from that breach enters the criminal marketplace. Automated tools then attempt those credentials across hundreds of popular services to find matches — a technique called credential stuffing. Services that do not require additional verification or where you reused the same password are immediately vulnerable.

Alternatively, phishing delivers a convincing fake login page for a service you use. You enter your credentials, and they are captured. The page may redirect you to the real service to delay discovery.

Once credentials are obtained, the attacker logs in and quickly takes control: changing the recovery email address and phone number, disabling legitimate two-factor authentication and substituting their own, or completing their objective — transferring funds, extracting data — before you notice.

For accounts protected by SMS two-factor authentication, a preceding SIM swap removes that barrier. For accounts protected by app-based authentication, the attacker may instead use a phishing relay that captures the one-time code in real time.

In business contexts, account takeovers of corporate email accounts enable invoice fraud, impersonation of executives, and access to sensitive data.

Password reuse is exceptionally common, meaning that a single breach can unlock many accounts. Most people use the same password across multiple services, often for years, so old breach data retains value long after the original incident.

SMS two-factor authentication, while better than no two-factor, is vulnerable to SIM swaps and real-time phishing relays. Many accounts use it as the sole additional barrier, providing less protection than users assume.

Account changes — like updating a recovery email — are often not immediately flagged or are easy to miss among routine notification emails, giving attackers time to fully entrench before the owner realises something is wrong.

A person receives an email notification that their email account password has been changed. They did not make this change. Attempting to log in fails. By the time they contact the service to recover the account, the attacker has used it to request password resets for several linked accounts including an online shopping account with saved card details. The email account's recovery address has been changed to an address they do not recognise. Recovery takes several days and requires identity verification with the email provider.

Your password for [account] was recently changed. If this wasn't you, secure your account at [fake link].

New sign-in detected on your account from [location]. If this wasn't you, click here: [fake link].

Your recovery email has been updated. If you did not make this change, contact support at [fake link].

Your account has been temporarily locked for security. Verify your identity at [fake link] to restore access.

The main signals of an account takeover are: unexpected notifications that your password, email address, or phone number has been changed; login alerts from unrecognised devices or locations; being unable to log into an account with your correct credentials; or contacts reporting messages from your accounts that you did not send.

To check whether your email address has appeared in known data breaches, use a reputable breach-checking service. If your credentials appear in a breach, change the password on that service and on any other service where you used the same password.

To prevent takeover, use a unique password for every service managed by a password manager, enable app-based two-factor authentication rather than SMS where possible, and review account recovery options periodically to confirm they still point to you.