The average person has dozens of online accounts that they use for email, social media, shopping, banking and other services. While many of these accounts are protected by passwords, some are vulnerable to unauthorized access or account takeover. Account takeover attacks allow bad actors to steal data, plant malware or deliver scams.

What is an account takeover?

What is an account takeover? (ATO) is a form of cyberfraud in which criminals gain unauthorized access to a victim’s online personal or business account by using stolen credentials. These stolen credentials may be obtained through phishing, hacking, data breaches or malicious malware. Once a criminal has access to an account, they can transfer funds, use stored credit cards, deplete loyalty or reward accounts such as airline miles or hotel points, make fraudulent purchases, submit bogus credit applications or engage in more advanced threats like ransomware and cyberterrorism.

While ATO is a type of identity theft, it differs from other forms of ID fraud because attackers focus on compromising and exploiting specific accounts rather than stealing the victims’ overall identities. This is why it’s important to follow a few simple security steps to protect yourself against ATO and other types of fraudulent activity.

A good defense against ATO is a system that checks all actions on a bank account, not just those related to money transfers. Because fraudsters have to undertake a number of activities before they can withdraw or spend funds, a system that monitors every step can identify clues and patterns to detect suspicious behavior. This can help prevent unauthorized transactions and limit financial losses for individuals, as well as reputational damage for businesses that are publicly disclosed.