What is account takeover (ATO)? How the fraud works

Account takeover, usually shortened to ATO, is when someone other than the owner gets into an online account and uses it as if they were the owner. The break-in is the takeover, and ATO fraud is what follows: a saved card spent, a balance moved, loyalty points redeemed or the account itself sold.

The FBI's Internet Crime Complaint Center issued a public service announcement on 25 November 2025 saying it had received "more than 5,100 complaints reporting ATO fraud, with losses exceeding $262 million" since January 2025, from one scheme in which criminals pose as bank support staff. That figure only counts complaints to the FBI about that scheme, so it is a floor rather than a total.

This article covers how attackers get in, what they do once inside, the signals that show it happening, and whether bot management can stop it. If you already know the background and want to stop it on your own login, see account takeover prevention.

Five routes into an account

1. Credential stuffing. Bots replay username and password pairs leaked in other sites' breaches against your login, counting on people reusing passwords. It is the route that produces takeovers in bulk: Roku disclosed about 576,000 accounts taken this way in a single incident in 2024. The full explanation is in what is credential stuffing. Password spraying, which tries a few common passwords against many accounts, is its close relative.

2. Phishing. The customer is tricked into typing their login details into a fake page. The FBI notice above describes criminals contacting victims by text, call or email, claiming fraud on the account, and sending them to a phishing site or a fake login page bought as a search ad, where they are tricked into giving away "their login credentials, including multi-factor authentication (MFA) code or One-Time Passcode (OTP)". A one-time code read out or typed into the attacker's page is as good as the real thing for the few minutes it lasts.

3. SIM swap. The attacker persuades the victim's mobile carrier to move their number to a SIM the attacker holds, then receives every SMS code sent to that number. In the US, the FCC adopted rules in November 2023 requiring carriers to authenticate customers before a SIM change or port-out and to notify them when one is requested.

4. Session or cookie theft. Once someone has logged in, the site trusts a session cookie rather than asking for the password again. Malware on the victim's computer that copies that cookie lets the attacker skip the login, and the MFA check with it, until the session expires.

5. Password reset and account recovery abuse. Reset and recovery flows often accept less proof than the login: access to the email inbox, a code by SMS, or answers to security questions. An attacker who controls the inbox or the phone number, or who can guess the answers, resets the password and takes the account. Bots also hammer reset endpoints to find which email addresses have accounts.

What attackers do after a takeover

Spend stored payment methods. In the Roku incident, attackers used saved payment methods in fewer than 400 of the 576,000 accounts to buy subscriptions and hardware, according to BleepingComputer.

Drain stored value and loyalty points. Balances, points and gift cards are attractive because they can be spent or transferred without a card check. The New York Attorney General's 2020 settlement with Dunkin' concerned credential stuffing against accounts holding stored-value cards, and required Dunkin' to refund stolen funds. Points farming and fake-account abuse of the same programmes is covered in loyalty programme automation.

Sell the account. Working logins are a product in their own right. BleepingComputer reported compromised Roku accounts being sold for as little as 50 cents.

Take the data. Some accounts are valuable for what they can see rather than what they can spend. Through about 14,000 accounts taken over by credential stuffing, the attacker in the 2023 23andMe incident reached profile data on about 6.9 million people who shared data with those accounts.

Lock the owner out. Changing the email, phone number and password keeps the real owner from recovering the account or noticing the theft until it is too late. The FBI notice describes attackers resetting the password and then wiring funds to accounts, "many of which are linked to cryptocurrency wallets".

Account takeover signals at login and after

Takeover shows up in two places, and each needs watching separately.

At login:

• The ratio of failed to successful logins rises across the site, even if no single IP address crosses a limit.
• Logins arrive through residential proxies, datacentre networks or VPNs that your real customers rarely use.
• One device or connection logs in to many different accounts.
• Logins for accounts that have been dormant for months appear in a burst.
• The same account is reached from two distant places in a short time.

After login:

• Email, phone number or password changes soon after a login from a new device.
• A new delivery address, followed by an order paid with a saved card.
• Points, gift card balances or stored value redeemed or transferred all at once.
• Account recovery or password reset requests for many accounts from the same source.

Bot management stops the automated routes, not phishing or SIM swap

The question "can bot management stop account takeover?" has a two-part answer.

Bot management stops the automated routes in. Credential stuffing and password spraying only pay off at scale, so they depend on sending large numbers of login attempts, and stopping that automation at the login, the auth API, password reset and account recovery removes the routes that produce takeovers in bulk. It also cuts off account-checker tools that sort a combo list into working and failed logins, and automated probing of reset forms to find which emails have accounts.

Bot management does not stop the attacks that target one person:

• a customer phished into typing their password and one-time code into a fake site, then a person logging in with them
• a SIM swap at the customer's mobile carrier, which lets the attacker receive SMS codes legitimately
• malware on the customer's own computer stealing a session cookie

For those, the defences are phishing-resistant authentication such as passkeys, which will not sign in to a look-alike domain; avoiding SMS as the only second factor; and checks after login, such as notifying the owner of every change to contact or payment details and asking for re-authentication before high-value actions.

The useful signals for stopping the automated attacks are network and connection based, because takeover tools run through residential proxies and anti-detect browsers that report whatever browser details the operator chooses. IP reputation, whether the connection comes through a proxy, the TLS fingerprint of the client and how the visitor interacts with the page are much harder to fake than what the browser claims about itself.

Account takeover checklist

1. Offer MFA, and prefer passkeys. See multi-factor authentication for the options. Roku and 23andMe both turned on two-factor authentication for all users after their incidents.
2. Check new passwords against breach lists, as NIST SP 800-63B requires of verifiers.
3. Rate-limit by account, device and network, not only by IP address, so attempts spread across a proxy pool still add up.
4. Detect bots on every way in: login form, auth API, password reset and account recovery, not only the login page.
5. Notify the owner of every change to email, phone, password or payment details, using the old contact details as well as the new ones.
6. Add a check before high-value actions on a session that has just changed contact details or logged in from a new device, such as redeeming points, adding a delivery address or transferring a balance.
7. Monitor the login success ratio and alert when it shifts.
8. Make recovery as strong as login. A reset flow that asks for less than the login is the easier way in.

How Prosopo fits

Prosopo covers step 4. It checks each request to login, password reset and account recovery, and blocks the automation before a password is checked, while real users and password managers pass without a challenge. Prosopo Protect does this at your edge on Cloudflare Workers or AWS Lambda@Edge, so it also covers auth APIs that never load a form, and its residential proxy detection checks the TCP connection against the device the browser claims to be. Every block names the reason it fired, so your fraud team can see why a login was stopped.