October 22, 2026
Account takeover fraud happens when a criminal gains control of a genuine customer's account and uses it to move money, make purchases or open new credit. The account already has a history, trusted devices and approved payees, which is exactly what makes it valuable. Javelin Strategy & Research counted about 6 million account takeover victims in the US in 2025, up 18% from the year before. This guide covers how ATO fraud works, real examples of the attack chain, and how banks, wallets and payment companies detect and prevent it.
1. Account takeover fraud at a glance
2. What is account takeover fraud?
3. How ATO fraud attacks work
4. Real examples of account takeover
5. Warning signs of account takeover
6. Why account takeover is hard to detect
7. How to prevent account takeover fraud
8. Everything you need to know about account takeover fraud
9. FAQs
Account takeover fraud, often shortened to ATO fraud, is when a criminal gains access to an existing account and uses it as if they were the owner. It differs from new account fraud, where the criminal opens a fresh account with stolen or synthetic details. A takeover inherits the victim's history and trust, so the first payments are often clear without friction.
ATO affects bank accounts, card-linked wallets, payment apps, merchant accounts and any service that stores money or payment details. The scale of the problem is covered in our account takeover fraud statistics.
Criminals take username and password pairs leaked in breaches and try them across many services. Because people reuse passwords, a small share work.
A fake login page, sent by email or text, captures credentials and often the one-time code as well, in real time.
The criminal persuades the mobile carrier to move the victim's number to a new SIM, then receives every text-message passcode.
Posing as the customer, the criminal calls the bank or wallet's support line and asks for a password reset or a change of phone number.
Infected devices capture keystrokes or hijack sessions after the genuine customer logs in.
These scenarios reflect the attack chains fraud teams see most often.
The reset chain. A phished email password lets the criminal reset the victim's banking login. They add a new payee, move the balance in several transfers, then delete the alert emails.
The SIM swap drain. The victim's phone loses signal on a Saturday. By the time they reach their carrier, one-time codes have authorised transfers out of their savings.
The wallet top-up. A stolen wallet login is used to add a new card funded with stolen details, buy gift cards, and withdraw before the victim notices.
The support call. A criminal with the victim's date of birth and address convinces a support agent to change the registered phone number, then takes over the account through a standard reset.
Every step can look legitimate on its own. People change phones, reset forgotten passwords and pay new people. A system that checks each event in isolation sees nothing unusual.
The criminal also authenticates successfully. They hold the credentials, and sometimes the one-time code, so login checks pass. Strong authentication raises the bar, but phishing kits that relay codes in real time and SIM swaps get past it.
The signal sits in the sequence and in how far it departs from the customer's normal behaviour. That requires monitoring the account over time, and scoring the final payment with the account's recent history in view.
Strengthen login
Use authenticator apps or passkeys instead of text-message codes where possible. Score each login for risk using device, location and behaviour, and step up authentication when it looks unusual.
Treat changes to email, phone, password and payees as high-risk events. Add cooling-off periods before a new payee can receive large amounts, and notify the customer on a channel the criminal hasn't changed.
When money moves, score the payment against the account's recent events. A transfer that follows a new device, a contact change and a new payee should score far higher than the same transfer from a settled account.
Taken-over accounts are often used to receive and pass on stolen funds. Monitoring inflows and outflows spots accounts behaving as mules. See how money mule detection works on the receiving side.
Require stronger verification before changing contact details over the phone, and flag accounts where changes are requested soon after a suspicious login.
Encourage unique passwords, authenticator apps and carrier PINs. Personal protections are covered in our identity theft guide.
Fraudio scores every payment in real time and profiles accounts over time, tracking inflows, outflows, velocity, counterparties, and device and IP signals. A transfer that follows unusual account activity scores higher, so teams can hold it before it leaves. Its account-to-account transfer monitoring also spots accounts acting as mules. Integration takes 3 to 14 days with pay-per-use pricing.
It is built for banks, digital banks, wallet providers, issuers and payment companies. Device intelligence and identity verification come through partner integrations.
Talk to our team about account takeover detection
Account takeover fraud is when a criminal gains control of a genuine customer's account and uses it to move money, make purchases or open credit. It differs from new account fraud because the account already has history and trust. Javelin counted about 6 million US victims in 2025, up 18% from 2024.
Criminals take over accounts mainly through credential stuffing with leaked passwords, phishing that captures logins and one-time codes, SIM swaps that redirect text messages, and social engineering of support staff. Malware on the victim's device is another route. Password reuse makes credential stuffing effective at scale.
The signs of account takeover are a login from a new device or location, followed by changes to email, phone or password, a new payee added and paid quickly, and transfers larger or faster than usual. Each event can look normal alone. Together, in that order, they form the classic takeover pattern.
Banks detect account takeover fraud by scoring logins for risk, treating account changes as high-risk events, and scoring payments with the account's recent activity in view. A transfer after a new device and a new payee scores much higher than the same transfer from a settled account. Monitoring receiving accounts also catches funds being passed on through mules.
Two-factor authentication stops most account takeover attempts, but it doesn't stop all of them. Phishing kits can relay one-time codes in real time, and SIM swaps redirect text-message codes. Authenticator apps and passkeys are harder to bypass than text messages.
Account takeover is one form of identity theft, where the criminal controls an existing account instead of opening a new one in the victim's name. Identity theft is the broader term for any fraudulent use of someone's personal details. Takeovers are often faster and more damaging, because the account already holds money or credit.
Credential stuffing is an attack where criminals test large lists of leaked username and password pairs against other services, relying on password reuse. Only a small share succeed, but automated tools test millions of pairs. Login risk scoring and rate limits help stop it.
Losses from account takeover are usually covered by the bank or card issuer when the payments were unauthorised and reported promptly. Where the customer was tricked into approving a payment, liability varies by country, and UK rules now require reimbursement for many push-payment scams. Institutions carry more of the cost, which is why detection before money moves matters.
How about trying our solution and experiencing the next generation for yourself?
