How account takeover works
The attacker first finds a way in, then changes the account so that the owner is locked out or not told, then takes the value. The usual ways in are:
- Credential stuffing: passwords leaked from one site tried on another
- Phishing pages and calls that collect passwords and one-time codes
- SIM swap: the victim's phone number moved to the attacker's SIM
- Malware or a remote-access app on the victim's device
- A support agent talked into resetting access
Signs of an account takeover
The pattern after entry is consistent: a new device, a changed email address or phone number, a new payee or withdrawal address, then a payment soon after. Each step looks ordinary alone, so detection relies on the sequence and on how far the session differs from the customer's usual ones.
Why account takeover matters to a payments or crypto product
Onboarding checks do not help, because the customer who was verified is not the person now logged in. The defence sits at login and at each sensitive action: strong authentication, device binding, and risk scoring of the session.
An account takeover usually ends as a claim for an unauthorised transaction, which the customer brings to the provider. Crypto withdrawals and instant payments raise the stakes, since neither can be recalled once sent.
Account takeover, new account fraud or APP fraud?
- New account fraud
- A criminal opens a fresh account with a stolen or invented identity. In account takeover the account already exists and belongs to a real customer.
- APP fraud
- The customer makes the payment themselves after being deceived. In account takeover the criminal gives the instruction.
- SIM swap fraud
- One method of getting in, by capturing the codes sent to a phone number. Account takeover is the result, whatever the method.
Where account takeover shows up in a platform
Modules that do the work
- AuthenticationSign-in, passkeys and second factors for customers and staff, on your identity provider or ours.
- Fraud & riskReal-time fraud scoring, limits and case management, with the risk engines you already trust.
- NotificationsEmail, SMS, push and in-app messages in your brand, through the providers you choose.