Account takeover (ATO) is a form of fraud in which cybercriminals gain unauthorized access to online personal or business accounts using stolen credentials.
Once a malicious attacker gains access to the targeted account, it can transfer funds, use stored credit card information, deplete gift card balances and loyalty points, redeem airline miles, submit fraudulent credit applications, plant ransomware or other malware, steal corporate data, and perform acts of cyberterrorism.
The basis of an ATO attack is relatively simple, but it can be difficult to detect. Let’s break down the basic steps in taking over an unsuspecting user’s online account:
Cybercriminals often employ various techniques to gain access to the account of an unsuspecting user. If an attacker has a list of usernames for a targeted site, but not the passwords, it may employ the technique password spraying in which an attacker tries a common default password, such as “Password1,” against a large number of usernames. The attacker uses the brute force of bot automation to systematically try the guessed password against as many usernames as possible until the attacker identifies one that works.
If an attacker has a valid username and password combination for a targeted site, they may try to scale the attack to take over the user’s accounts on additional sites. This technique is called credential stuffing. Again, an attacker will employ the brute force of bot automation to quickly try the credentials across e-commerce, banking, travel and other popular websites in the hopes that some users have reused the same usernames and passwords for multiple sites.
For cybercriminals, an account takeover is easy to accomplish and profitable. Bots continuously evolve to evade detection mechanisms, so account takeover attacks get through and website owners are none the wiser. Bots can mimic user behavior and hide inside a validated user session by running as malware on actual user devices.
As with many cyberattacks, financial services companies were the original targets for ATO as criminals attempted to access the funds in a user’s account or open lines of credit in a user’s name.
Today, any organization that maintains user accounts that can be exploited for profit is a potential target. This can include taking over e-commerce or travel accounts to make fraudulent purchases or cash in loyalty points. It can also include targeting business accounts such as email or network logins to gain a foothold for a larger data theft or ransomware attack.
Account takeover attacks can have severe consequences. These include:
This can result in financial losses, damage to brand reputation and consumer trust, resource costs for remediation and recovery, as well as lawsuits and fines.
Even if attacks take over a small percentage of user accounts, the damage can be substantial when user account values are high. Theft of stored credit card numbers or loyalty points, for example, could easily net millions of dollars for a cybercriminal. And theft also negatively affects end users.
The speed and evolution of today’s attacks present significant challenges for businesses. Unfortunately, some of the most commonly used techniques aren’t enough to stop ATO.
HUMAN Account Takeover Defense combats account takeover attacks at every step of the user journey. The solution take a layered approach:
Account Takeover Defense stops ATO attacks with unparalleled accuracy. By combining proactive, real-time, and reactive detection methods, the solution protects digital organizations and their users from this growing threat.
Learn more about HUMAN Account Takeover Defense.