What is account takeover?

Account takeover is when an attacker gains control of an account that belongs to someone else and uses it as though they were the legitimate owner. The account is occupied rather than broken, and it keeps working normally, which is what makes it dangerous.

A system compromise takes the system. An account takeover takes a person’s standing inside it.

Account takeover, data breach, and identity theft

These three get used interchangeably and they describe different things.

A breach hands attackers the raw material. Account takeover is what they do with it against accounts that already exist. Identity theft creates something new.

The ordering is also the reason ATO keeps rising without any new vulnerability being discovered. The supply of breached personal data grows every year, and the attack it enables does not require anyone to write an exploit.

How accounts actually get taken over

Four routes account for most of it, and they differ in how much work they require.

Credential-based attacks. Credential stuffing replays username and password pairs from earlier breaches against other services, relying on reuse. Password spraying tries a small number of common passwords across many accounts to avoid lockouts. Both are cheap, automated, and defended reasonably well by modern controls.

Phishing and its variants. Email phishing, SMS phishing (smishing), and voice phishing (vishing) persuade a person to hand over credentials or a one-time code. Real-time phishing kits go further and relay a live session, so the attacker inherits an authenticated session rather than a password.

Interception of the second factor. SIM swap and port-out fraud move a phone number to an attacker’s device, delivering SMS codes to them. Push-notification fatigue floods a user with prompts until one is approved.

Asking a human to hand it over. The attacker contacts the IT help desk or a customer support line as the account holder, says they are locked out, and requests a password reset or an MFA rebind. The credential is never defeated, just reissued to the wrong person.

The fourth route is the one that grew. Mandiant found voice phishing involved in 11% of all intrusions, and in 23% of cloud intrusions, where it ranked as the leading vector (Mandiant, M-Trends 2026). Both figures are real and their denominators differ, which is why they are always worth stating together.

Why account takeover is hard to detect

Every other attack type leaves a signature of something that should not have happened. Account takeover produces a session that should have happened, initiated by an account that is allowed to do what it is doing.

Anomaly detection helps only where behaviour genuinely diverges. An attacker who signs in from a plausible location, at a plausible hour, and performs an action the account performs routinely does not diverge. And when the takeover began with a legitimate help desk reset, even the authentication event is clean: the credential is new, valid, and correctly issued.

This is why organizations often learn about ATO from the outside, from a customer or a supplier or a bank, rather than from a control.

What it costs

The FBI’s Internet Crime Complaint Center recorded $20.877 billion in reported losses across 1,008,597 complaints in 2025, a 26% rise year over year (FBI IC3, 2025 Annual Report, p6). Within that, account takeover specifically drew roughly 4,700 complaints and $359.7 million (FBI IC3, 2025, p12), and business email compromise, which usually depends on a taken-over or convincingly impersonated account, accounted for 24,768 complaints and $3.05 billion, averaging about $123,000 per incident, with 86% of losses moving by wire or ACH (FBI IC3, 2025, pp7–10).

Where an account takeover is the entry point to a full intrusion rather than the end of the attack, the reported costs are considerably larger: roughly $100 million for MGM Resorts in the quarter following its 2023 incident (Form 8-K, October 2023), approximately $15 million paid by Caesars (Form 8-K, September 2023), and around £300 million in operating profit for Marks & Spencer in 2025 (M&S trading statements, 2025).

The signals that actually indicate takeover

Because the activity is legitimate, the useful signals sit in the context around the action rather than in the action itself.

A recent change to a recovery method. A phone number, recovery email, or authenticator registered in the last few days, followed by a sensitive request, is the pattern worth watching hardest. Attackers establish their own recovery path early so they can regain access after the first one is closed.

A number that changed hands. A SIM swap or port-out shortly before a reset request or a payment change. This information sits with the mobile carrier rather than in your directory, which is why it is so often missed.

A reset that follows a burst of authentication prompts. Push fatigue and a subsequent “help me get back in” call are the same operation in two parts.

Repeat contact across channels. The same account touched through the help desk, then customer support, then email, over a short window. Each interaction looks reasonable alone; the sequence does not.

New rules that persist quietly. Mailbox forwarding, filters that delete alerts, a new API token, an added delegate. These outlive the session and are how an attacker keeps access after a password change.

Requests that expand mid-conversation. A caller who begins with a password reset and moves on to MFA re-registration, a new device, and a mailbox rule is describing a takeover in progress rather than a lockout.

None of these requires the fraudulent action to look unusual, which is the reason they work where anomaly detection does not.

What to do when an account has been taken over

Order matters here, because most of the damage happens after the initial access rather than during it.

Revoke the sessions, not just the password. Changing a credential leaves existing session tokens valid. An attacker holding a live session keeps working through the reset unless tokens are explicitly invalidated.

Audit what was added rather than what was changed. Look for forwarding rules, filters, delegates, OAuth grants, API tokens, and enrolled authenticators created during the access window. These are the persistence mechanisms, and they survive a password reset.

Check the recovery path. If the attacker registered their own recovery phone or email, they can simply repeat the takeover.

Trace outbound requests. Corporate takeovers usually end in a request to someone else: a payroll change to HR, a bank detail update to finance, a message to a colleague. Those requests may already be in flight.

Then work out how they got in, because the answer determines whether other accounts are exposed. A credential-stuffing hit implicates password reuse. A help desk reset implicates a process that will be used again tomorrow.

Consumer and corporate takeover are different problems

Both are called account takeover and they behave differently enough that the defenses diverge.

A consumer takeover targets an individual’s own account and money, and the fraudulent action usually looks different from that person’s normal behaviour. A corporate takeover targets an employee’s access, so the attacker inherits organizational authority and the fraudulent action looks exactly like the employee’s job: a payroll change submitted by the person whose payroll it is, a vendor bank detail updated by someone who updates vendor bank details.

The corporate case, and the payroll, wire, and privilege paths it runs through, is covered in full in corporate account takeover.

Where to prevent it

Most ATO prevention advice addresses the credential routes, and it is worth doing: phishing-resistant authentication, credential monitoring, rate limiting, and anomaly detection all raise the cost of the first three routes.

None of them addresses the fourth. If an attacker can reach a person who is permitted to reset a credential, the strength of the credential stops being the deciding factor.

So there are two chokepoints, and they are both moments when a human takes an identity claim on trust:

Before a credential is reset or rebound. Password resets, MFA re-registration, and account recovery.

Before an action that moves money or grants privilege. Bank detail changes, payment release, beneficiary updates, privileged access grants.

At both points the useful control is to verify the person rather than the credential, against something the requester does not control. Verifying a government-issued ID against the authority that issued it — in the US, state DMV records over the AAMVA network — checks a record the caller cannot alter. SIM swap and port-out detection surfaces a number that changed hands recently, which is the most useful single fact on a reset call. Man-in-the-middle and anti-replay detection confirm the session is live and direct rather than relayed or replayed; Trusona’s implementation is patented (US Pat. 10,601,859).

Two practical constraints decide whether this works in production. The verification has to function for someone who enrolled nothing, because “I can’t use my MFA” is both the most common genuine support request and the standard attack pretext. And it has to produce a result an agent can act on rather than a judgment they have to defend, because the person making this call is usually early in their career and measured on handle time.

For the full attack sequence and the operational program around it, see how to stop social engineering account takeovers.

ATO Protect verifies the person behind a request against the authority that issued their ID, in real time, with no pre-registration and no app to install. It runs no selfie or liveness check, because generative AI defeats those. See ATO Protect use cases and ATO Protect for IT Help Desk.

Frequently asked questions

What is account takeover? Account takeover is when an attacker gains control of an existing account belonging to someone else and operates it as the legitimate owner. The account continues to function normally, which is what makes the activity difficult to detect.

What does ATO stand for? ATO is the common abbreviation for account takeover.

What is the difference between account takeover and identity theft? Account takeover is the capture of an account that already exists. Identity theft is the use of someone’s identity to open new accounts or obtain credit in their name. A data breach is usually the source of material for either.

What is an account takeover attack? Any attack whose objective is control of someone else’s account. The main routes are credential stuffing and password spraying, phishing in its email, SMS, and voice forms, interception of a second factor through SIM swap or push fatigue, and social engineering a help desk into resetting the credential.

Why is account takeover hard to detect? Because the resulting activity is legitimate in every way a control can measure. The session is properly authenticated and the actions are ones the account is permitted to perform. Where the takeover began with a help desk reset, even the credential is new and correctly issued.

How much does account takeover cost? The FBI’s IC3 recorded roughly 4,700 account takeover complaints and $359.7 million in 2025, within $20.877 billion of total reported losses. Business email compromise, which typically depends on a compromised or impersonated account, added 24,768 complaints and $3.05 billion.

How do you prevent account takeover? Harden the credential routes with phishing-resistant authentication and monitoring, then close the human route separately by verifying identity before any credential reset and before any action that moves money or grants privilege. Verification should check the person against an authoritative external source rather than against knowledge, a voice, or a code.

Does MFA prevent account takeover? It prevents the credential-based routes and does not address the reset route. In many current attacks the second factor is not defeated at all; it is reissued to the attacker by a help desk, or transferred to a device they control.

An account takeover does not look like an attack from the inside. It looks like an employee having an ordinary day, which is exactly why the control has to sit before the account changes hands.