How to Stop Social Engineering Account Takeovers: 2026 Guide

Executive summary

Social engineering is now the dominant entry point for account takeover. Attackers impersonate real people through phishing, vishing, SIM-swap fraud and help desk manipulation. The FBI’s Internet Crime Complaint Center logged approximately 4,700 complaints in 2025 for account takeover fraud through impersonation of financial institution support, carrying $359.7 million in reported losses (FBI IC3, 2025). This guide sets out why credential-centric defenses fail against these tactics, and what changes when identity is verified against an authoritative record instead.

The modern ATO problem

Account takeover is no longer a side effect of cybercrime. It is the objective. Attackers work inside legitimate workflows — password resets, help desk calls, account recovery, one-time links — because those are the places where an organization hands access to whoever asks convincingly enough.

The cost is documented. IBM put the global average cost of a data breach at $4.44 million in 2025 (IBM, 2025). Phishing was the most common initial attack vector in that study, behind 16% of the 600 breaches examined, and those breaches cost an average of $4.80 million each (IBM, 2025).

Individual victims fare differently, though not better. In a December 2023 survey of 1,062 US adults, 29% said they had experienced an account takeover (Security.org, 2025). The typical victim lost about $180, while individual losses in the same survey ran as high as $85,000, and about 40% of those affected said identity theft followed (Security.org, 2025).

Modern social engineering runs on data. Attackers scrape breach dumps and social profiles to build a persona that survives a phone call, and AI now does the writing. KnowBe4 found that 82.6% of the phishing emails its filters analyzed between September 2024 and February 2025 showed some use of AI (KnowBe4, 2025). IBM found that 16% of the breaches it studied involved attackers using AI, most often for AI-generated phishing and deepfake impersonation (IBM, 2025).

The tooling is getting cheaper as it gets better. Accenture’s threat intelligence researchers recorded a 223% rise in the trade of deepfake-related tools on major dark web forums between Q1 2023 and Q1 2024 (Accenture, 2024).

Phone numbers are a target in their own right, and the two markets look different. Unauthorized SIM swaps reported to the UK’s National Fraud Database rose 1,055% in 2024, reaching nearly 3,000 cases (Cifas, 2025). The US picture is smaller and flat: IC3 logged 971 SIM-swap complaints and $17.4 million in reported losses in 2025, against 982 complaints the year before (FBI IC3, 2025). A surge in one market is not evidence of a surge everywhere.

Why traditional defenses fail against social engineering

Most ATO defenses assume that whoever completes a login or a reset step must be the account owner. That assumption is exactly what an attacker buys when they buy a breach dump.

Access gets handed over in two main ways: someone persuades a support agent to reset it, or someone takes over the phone number the reset depends on. In the UK, 48% of the account takeover cases filed to the National Fraud Database in 2024 involved mobile phone accounts (Cifas, 2025).

Recovery flows are the softest target, because they are built to work precisely when a user has lost everything else. Security questions can be answered from public data, and a convincing email now takes minutes to write. In a June 2024 survey of more than 300 security professionals, 83% said their organization had been hit by at least one account takeover attack in the prior year, and 45.5% by more than five (Abnormal Security, 2024).

The common thread is that these systems check a signal rather than a person. Email access, phone possession and self-reported personal data are all things an attacker can acquire, which means none of them answers the question the workflow is actually asking.

The social engineering kill chain

An attack of this kind runs in four phases. Attackers gather personal data and behavioral patterns. They impersonate the user to a help desk, a recovery form or a high-risk workflow. A person or a system trusts a weak signal and grants access. Credentials are then reset, the real user is locked out, and money or data moves.

Breaking that chain means stopping the impersonation before access is granted, which is a different problem from detecting the misuse afterwards — and a much cheaper one to solve.

What actually stops ATO: authoritative identity verification

The alternative to trusting a signal is checking the person against a record they cannot forge.

ATO Protect verifies a government-issued ID against the authority that issued it — in the US, state DMV records over the AAMVA network — in real time, in the user’s mobile browser. It runs no selfie and no liveness check, because generative AI can now defeat those methods. Before it trusts a phone number it checks telecom records for SIM swaps and port-outs, and it detects man-in-the-middle relay attempts and replayed scans.

There is nothing for the user to pre-register and no app to install, so the check works the first time someone needs it. That matters most for the callers a knowledge-based check handles worst: the day-one hire, the contractor, the alumnus, and anyone whose phone is the thing that went missing.

How ATO Protect works

ATO Protect is built for the workflows where impersonation pays. It verifies identity against authoritative records, detects SIM swaps to neutralize phone-based attacks, blocks man-in-the-middle relay attempts, guards against replayed scans, and applies at the workflow level to password resets, account recovery, support interactions and other sensitive actions. Each of those addresses a specific step in the kill chain above rather than adding another signal to weigh.

Where ATO Protect delivers the most value

The highest-value deployments are the ones with real impersonation risk: customer account recovery, help desk access requests, privileged actions, financial changes, B2B portals and regulated environments. Rather than adding friction everywhere, verification goes where the loss would be.

What changes operationally

The honest version of the business case is narrower than a return-on-investment claim, and easier to defend.

Verification moves the reset decision off the agent, so a convincing caller no longer has a person to convince. The session returns a red, yellow or green risk summary, which means a first-week agent reaches the same answer as a ten-year veteran. And because all PII from a verification session is deleted, the check does not leave behind a new store of identity data for someone else to breach.

Preparing for 2026 and beyond

AI-assisted social engineering will keep scaling, because the economics favor it. Governance has not kept pace: 63% of the breached organizations IBM studied either had no AI governance policy or were still developing one (IBM, 2025).

The direction of travel is toward account recovery and the phone network, both of which sit outside the authentication system most security budgets are pointed at. The defense that holds is not a better signal. It is declining to accept an unverified identity claim in the first place.

Frequently asked questions

How do attackers exploit account takeover fraud during account recovery calls?

Recovery flows are built to work when a user has lost everything else, which is exactly what makes them the softest target. An attacker calls claiming to be locked out, and every method that would normally verify the caller is, by their account, unavailable. Security questions can be answered from breached and public data. In a June 2024 survey of more than 300 security professionals, 83% said their organization had been hit by at least one account takeover attack in the prior year, and 45.5% by more than five (Abnormal Security, 2024).

How can we reduce contact center fraud from social engineering and account takeover?

Stop checking a signal and start checking the person. Email access, phone possession and self-reported personal data are all things an attacker can acquire, so none of them answers the question the workflow is actually asking. Verifying a government-issued ID against the authority that issued it removes the part of the exchange an impersonator can rehearse. Apply it where the loss would be: account recovery, help desk access requests, privileged actions and financial changes, rather than everywhere.

How do I use identity proofing during account recovery to stop social engineering attacks?

Put the proofing step before access is granted rather than after misuse is detected. ATO Protect verifies a government-issued ID against the issuing authority in real time in the user’s mobile browser, checks telecom records for SIM swaps and port-outs before trusting a phone number, and runs no selfie or liveness check, because generative AI can now defeat those methods. Nothing needs to be pre-registered, so it works for a caller who never enrolled anything.

What does an account takeover identity check actually verify?

That the person on the line is the individual the account belongs to, checked against an authoritative record rather than against something they know. In the US that means a government-issued ID checked against state DMV records over the AAMVA network. It is a different question from authentication, which only establishes that whoever is present holds a valid credential.

What do published figures show about account takeover and breach costs?

The FBI’s Internet Crime Complaint Center logged approximately 4,700 complaints in 2025 for account takeover fraud through impersonation of financial institution support, carrying $359.7 million in reported losses (FBI IC3, 2025). At the organizational level, IBM put the global average cost of a data breach at $4.44 million in 2025, and phishing was the most common initial attack vector in that study, behind 16% of the 600 breaches examined, at an average of $4.80 million each (IBM, 2025). For individuals, the typical victim lost about $180, though individual losses ran as high as $85,000 (Security.org, 2025).

How much of social engineering is now AI-generated?

KnowBe4 found that 82.6% of the phishing emails its filters analyzed between September 2024 and February 2025 showed some use of AI (KnowBe4, 2025). IBM found that 16% of the breaches it studied involved attackers using AI, most often for AI-generated phishing and deepfake impersonation (IBM, 2025). The tooling is getting cheaper as it improves: Accenture’s threat intelligence researchers recorded a 223% rise in the trade of deepfake-related tools on major dark web forums between Q1 2023 and Q1 2024 (Accenture, 2024).

Final takeaway

Account takeover is not a login problem. It is an identity problem. Social engineering works because systems trust what a user knows or what a device holds, and an attacker can obtain both. Verifying who someone is against a record they cannot forge is what closes it.

Sources: FBI Internet Crime Complaint Center, 2025 and 2024 Internet Crime Reports · IBM, Cost of a Data Breach Report 2025 · Security.org, Account Takeover Annual Report (December 2023 fieldwork, published 2025) · KnowBe4, phishing threat trends research (September 2024 to February 2025) · Accenture Cyber Intelligence, Beyond Illusion (July 2024) · Cifas, Fraudscape 2025 · Abnormal Security, 2024 State of Cloud Account Takeover Attacks (June 2024)