Everything about Account Takeover

What is account takeover?

Account takeover or ATO is an attack where fraudsters gain unauthorized access to digital accounts of genuine users through stolen usernames and passwords. In addition to stealing the money and the information from the compromised accounts, fraudsters use them for money laundering, money muling, seeking loans, redeeming reward points, launching phishing campaigns, disseminating spam, and several other criminal activities.

‍

Is account takeover a type of identity theft fraud?

Yes, account takeover is a type of identity theft fraud as fraudsters use stolen consumer credentials to compromise genuine user accounts and use them for illegal activities.

Are identity theft and account takeover the same?

Account takeover is a subset of identity theft as it is limited to compromise of a user’s digital account. Identity theft, on the other hand, affects the entire life of the compromised user as it can result in the user being barred from digital transactions, opening new lines of credit, or even being jailed for criminal activities executed from their compromised account.

‍

How does account takeover work?

There are three key steps in an account takeover attack, as described below:

Credential harvesting: Fraudsters use a number of techniques such as data breach, scraping, phishing, malware, and so forth to harvest user credentials which include emails, usernames, and passwords. This is the most important and time-consuming step and requires some level of technical skill. Fraudsters may choose to sell these unverified lists many times over before the data begins to lose value or refine them further to fetch more money.

Account validation: Using automation, fraudsters refine the unverified lists to arrive at valid username-password combinations. Automation allows fraudsters to scale up validation and get verified results in no time. The monetary value of these refined lists is more than the simple dumps of data.

Account takeover: Once verified lists are obtained, fraudsters may choose to monetize them by selling them to third parties or launch account takeover attacks by filling in login forms on websites, outsourcing ATO attacks to low-cost human attackers, or completing high-value attacks themselves.

‍

How do fraudsters scale up their account takeover attacks?

Fraudsters use automation, botnets, and scripts to scale up their attacks, at times launching thousands of attacks simultaneously. They also use low-cost human attackers to launch these attacks, especially when fraud defense mechanisms deployed need some level of human interaction to clear verification.

‍

How do fraudsters monetize compromised accounts?

Account takeover attacks open the opportunities for a wide range of downstream attacks. In addition to monetizing the credentials’ lists – raw and verified – by selling them to third parties, fraudsters can exploit compromised accounts to steal funds, make fraudulent payments, and transfer funds. These accounts can also be used for more sinister crimes such as money laundering and money muling, which expose the real account holders to possible legal action.

Using information stolen from the taken over accounts, fraudsters can open new lines of credit, redeem the loyalty points, trick people into transferring money using social engineering, and disseminate spam.

Account takeover attacks across industries

There is no industry that remains untouched by account takeover attacks. However, banks and other financial institutions, fintechs, crypto platforms, e-commerce, social media and gaming accounts are the most attractive for fraudsters.

Financial institutions: With the highest monetization potential, financial accounts are the most valuable for fraudsters. In addition to the ability to steal funds and redeem credit card points from these accounts, fraudsters can also access personal information such as national identity numbers, addresses, and fund transfer details. Usually, security measures to protect financial accounts are stringent and fraudsters use phishing campaigns to extract information from users.

E-commerce: eCommerce platforms are a hotbed for account takeover fraud. Fraudsters use compromised seller accounts to dupe unsuspecting buyers in ‘buying’ non-existent items that are never delivered. Further, fraudsters use compromised customer accounts to make expensive purchases and get them shipped to different addresses. When genuine customers card owners dispute the purchase and raise refund claims, merchants have to bear the losses and chargebacks. However, if merchants decline suspicious activity, they run the risk of increasing false negatives and customer churn.

Social Media: According to a study, social media account takeover rose by a staggering 1000% in 2022. Despite holding no evident monetary value, compromised social media accounts play a key role in facilitating phishing scams and disseminating spam. They can also be used to spread disinformation or to increase superficial followers on social media platforms.

Gaming: Although less attractive than financial accounts, users’ gaming accounts are less protected, which makes them easier to compromise. Gaming accounts are sought after for the virtual currencies, avatars, digital game accessories, and to skew the game results. Accounts that have been in existence for long are valuable as they enjoy higher credibility and therefore attractive for account takeover attempts.

‍

Why are account takeover attacks on the rise?

In recent times there has been a prolific rise in account takeover attacks. There are several factors abetting this crime, the prime reason being frequent incidents of data breach.

Fraudsters can supplement their databases of users’ personally identifiable information (PII) by buying additional data from the dark web. As a result, they have easy access to large volumes of user information which they can leverage to hack into users’ digital accounts.

The dark web also provides fraudsters with easy access to commoditized tools, expertise, and support services that further enable them to launch account takeover attacks at scale and with the least possible investment.

Account takeover attacks are also rising due to consumers recycling and reusing their usernames and passwords across several online accounts that are needed to access online services and products. To avoid the hassle of creating and remembering so many passwords, often consumers resort to creating easy-to-crack passwords and repurposing them, which makes it easier for fraudsters to compromise these accounts.

How are businesses fighting account takeover attacks?

Account takeover attacks are difficult to detect and are often discovered only when the financial losses have already incurred. This is because fraudsters have studied the common defense mechanisms and created ways to bypass them.

Some of the common methods that businesses use to fight account takeover attacks are:

Risk assessment: Businesses use data-driven solutions to assess risks associated with incoming users and define rules for user verification. However, digital identities have been manipulated which makes it difficult for businesses to accurately identify fraudsters from good users.

Multi-factor authentication: This adds an additional layer of protection as it requires a user to input a code or a piece of information known only to them. MFA is expensive and with fraudsters able to intercept the codes and OTPs sent through SMS, does not guarantee full protection.

Manual review: Manual reviews cost man-hours and are prone to human errors and biases. They are also time-consuming which cause delays in processing user requests. Today, customers expect instant results and such delays can cause resentment, and in worst cases customer churn.

Increasingly businesses are finding it difficult to balance fraud prevention with user experience and often end up compromising one for the other, which results in financial and reputational damage. 

Most of the solutions available on the market are not able to provide the level of protection against account takeover attacks that have become targeted and more sophisticated. Therefore, to ensure long-term protection against account takeover attacks, businesses need powerful, technology-driven identity verification solutions that can improve their fraud prevention capabilities without compromising on user experience.

‍

Why work with Caf for account takeover prevention?

Caf’s user-friendly yet powerful identity verification solutions enable businesses to quickly identify the telltales and take timely action to foil account takeover attempts. Our industry-leading identity verification solutions deliver long-term protection from account takeover attacks, so that businesses can convert more users at lower operational costs.

Caf combines the latest technologies including artificial intelligence, machine learning, facial biometrics, facial authentication, device fingerprint, OCR, computer vision, facematch with liveness, and more, to deliver unparalleled protection against account takeover attacks. Our AI-enabled solutions are non-invasive and work in the background to eliminate unnecessary friction for good users and make identity verification seamless and user-friendly, yet highly secure.

Using Caf’s suite of identity verification solutions, businesses can keep a continuous vigil on in-platform user activities. This enables them to detect and stop account takeover attempts in real-time, without impacting the digital journeys of other users. Access to a shared and secure biometric database further supplements faster, safer, more accurate and cost-efficient ongoing identity verification.

Caf’s enables businesses to reduce abandonment, maximize conversions, and comply with prevailing regulations, while elevating customer experience. This is made possible through a flexible identity proofing platform where businesses can orchestrate custom workflows to validate identities, manage new and old users, enhance risk-decisioning and monitor results. An intuitive dashboard simplifies review and analysis of all activity to help create new rules and manage user permissions to elevate protection against account takeover attempts.

To learn how Caf’s path-breaking identity validation solutions empower businesses to fight account takeover attacks, without disrupting user experience, talk to a Caf expert and book a demo now. 

‍