What Is Account Takeover Fraud?

The foundation for a successful account takeover is access to a user’s account credentials. Here’s how attackers usually compromise legitimate accounts:

Brute-force attacks. The attacker, usually through an automated script, tries a username/password combination across many accounts until one works. These include so-called dictionary attacks, in which attackers use common passwords and dictionary terms to guess passwords.

Breach replay attack (also known as credential stuffing). It’s a bad practice, but many people use the same password for multiple accounts. If one of those passwords is leaked in an unrelated data breach, any other account with the same username (often an email address) and password is at risk.

Phishing. Old-fashioned credential phishing remains an effective way to get a victim’s password. Without controls such as multifactor authentication (MFA), lost credentials can lead to compromised accounts.

Malware attacks. Keyloggers, stealers and other forms of malware can expose user credentials, giving attackers control of victims’ accounts.

Attackers can also download cracked passwords from darknet markets to attempt ATO on the same user accounts on their target site.

After the attacker has a long list of credentials, several ATO applications are available for download. A few notable tools include SentryMBA, SNIPR, STORM and MailRanger. The following image is one of the main windows in SentryMBA:

SentryMBA is one of the more popular tools due to its options and general settings. At the top, an attacker inputs the site where requests will be sent for authentication into user accounts. Other settings include the list of passwords and usernames, the ability to save a list of successful authentication attempts, and timeout settings that help that attacker avoid detection. The entire ATO attack is automated, so most of the effort is in stealing credentials. Tools such as SentryMBA can be run indefinitely on the attacker’s computer until a list of stolen accounts is created.

In some account takeover fraud scenarios, an attacker will not use the initial ATO attack on the main target site. As users often use the same credentials across several sites, an attacker might use a site with weaker cybersecurity defenses and fraud detection to validate credentials.

If a user uses the same credentials across multiple sites, the attacker’s successful authentication into one site might work on the main site. For instance, an attacker might use SentryMBA to authenticate into a popular hotel site, knowing most users have accounts with prominent hotel brands for traveling. If authentication is successful on the hotel site, it could also be successful on a banking site. By validating credentials on a secondary site first, the attacker reduces the number of authentication attempts and reduces the likelihood of detection.

With a list of successfully authenticated accounts, an attacker now has two choices: transfer money or sell the validated credentials online. Attackers can transfer funds out of a targeted user’s bank account to their own accounts. On credit card sites, attackers could order credit cards in a targeted user’s name and send new cards to attacker addresses. If the site does not have proper ATO fraud detection, targeted users are unaware of money being transferred or credit cards being sent to a new address.

Should attackers choose to sell the list of authenticated accounts, they could have a high payout for their efforts. The value of just one hacked account depends on the amount of data stolen and the type of account. For instance, a PayPal account could be worth $1,200, while a targeted user’s personal data could be sold for $40 to $200. Bank cards are worth $800 to $1,000. With hundreds and potentially thousands of accounts, an attacker could have a hefty payday selling on darknet markets and limit detection compared to directly stealing from victims.

ATO fraud is not limited to banking and credit card accounts. Attackers can also use rewards cards and services, including stored points on hotel accounts and airline miles. This fraud is gaining interest because targeted users rarely check reward accounts for fraud compared to credit cards and bank accounts.

Users and website owners should take basic precautions to prevent ATO fraud. Financial and healthcare sites are common targets for attackers. These sites usually have fraud detection systems in place, but most send emails to the registered account holder when data changes.

Users should always read emails sent from financial institutions and call customer service as soon as they receive suspicious alerts. For instance, if new credit cards were sent and the account holder didn’t request them, call customer service to verify that the account was not hacked.

Using the same password across several accounts makes it easy for attackers. Always use unique, strong passwords across several accounts online. To keep track of numerous passwords, use cryptographically secure storage services such as LastPass, 1Password or Bitwarden. Be aware of phishing attacks to avoid being the victim of stolen credentials.