FEATURED ARTICLES

Digital banking, including web-based portals and mobile banking apps, has made it even easier for people to stay connected with their finances. Unfortunately, these conveniences also make it even easier for cybercriminals to steal money and personal information.

One growing threat is account takeover fraud, also referred to as “ATO.” This type of attack causes online banking users to lose access to their accounts, leaving them vulnerable to unauthorized transactions, stolen personal information, and increased risk of additional scams and fraud attempts.

Worse, ATO attacks can occur undetected until it is too late.

Understanding how account takeover fraud works and knowing how to reduce your risk can help protect your peace of mind. Learn about account takeover fraud and what you can do to guard your finances.

What Is Account Takeover Fraud?

Account takeover fraud (ATO) is a practice where a criminal gains access to someone else’s account. When an unauthorized party controls it, they can use it as if it were their own.

ATO is particularly risky for financial accounts because it contains two things: a person’s money and their personal information. Someone who falls victim to ATO fraud can lose their finances and be set up for further instances of identity theft and fraud.

Account takeover fraud can occur over several different channels, including online banking accounts, mobile banking apps, email accounts linked to financial services, and payment platforms.

Once a cybercriminal can access someone else’s account, they may attempt to:

• Transfer money to external accounts
• Change passwords or security settings
• Update contact information
• Add new payees or linked accounts
• Access sensitive, personal information
• Apply for loans or credit products using stolen credentials

Because fraudsters often appear to be legitimate account holders once they gain access, account takeover attacks can be difficult to detect until unauthorized activity has already occurred.

The Federal Bureau of Investigation released a public service announcement last November about ATO attacks, which you can read here.

How Does Account Takeover Fraud Happen?

Criminals use several methods to obtain account credentials and personal information, including phishing, smishing, social engineering, and malware distribution. Often, thieves will use multiple methods at once to steal accounts. We’ll go over some of the most common ATO tactics below.

One of the most common methods is phishing. Fraudsters will send emails that appear to be from trusted organizations, such as financial institutions or online shopping platforms. The messages will take on the look and feel of the sender’s branding and may include links to fake websites designed to collect usernames, passwords, and other account information.

Another common ATO tactic is smishing, or the sending of fake text messages. These messages may take the form of a fake alert claiming the recipient’s account has been compromised, and they must act by submitting login information or MFA codes. Smishing messages may also include links to fake websites that also collect user account data.

Fraudsters may also use social engineering or impersonation. Thanks to voice cloning and AI-assisted technology, thieves can impersonate government officials, employees, and even friends and family members. They can call their targets under these fake identities and convince individuals to share account information, verification codes, and passwords.

Know the Warning Signs of a Potential Account Takeover

The first step in responding to an account takeover attack is to be familiar with what one might look like. Detecting the warning signs of an ATO early is one of the best ways to mitigate the damage it could cause.

If you have a financial account, whether it be from your preferred financial institution, investment brokerage, or any other place that handles your money, pay attention to signs of unauthorized access:

• Password reset notifications you did not request
• Unexpected login alerts
• Changes to contact information you did not make
• Unrecognized transactions
• Missing account statements or emails
• Security codes arriving unexpectedly
• Locked accounts after failed login attempts

If any of these occur, it is important to act quickly. Contact the support center of the affected account and report the activity. Afterward, you may be advised on the next steps to regain your account and re-secure it.

How To Reduce Your Risk of Account Takeover Fraud

There are several steps you can take to minimize your risk of an account takeover. A combination of best practices can significantly reduce the likelihood of losing control over your accounts.

First, use strong, unique passwords and reinforce them with multi-factor authentication (MFA). Avoid using the same password across multiple accounts. If a platform offers to enable MFA, take advantage of it – even if a thief gets your login information, an MFA-enabled account means an extra security step that further discourages unauthorized access.

Next, monitor accounts regularly. It can be tempting to have a “set and forget” mindset when it comes to online platforms, and finances are no exception. Be on the lookout for suspicious activity. Set up transaction alerts, as these notifications can provide early warnings of suspicious activity.

Combining multi-factor authentication and transaction alerts creates a multi-layered “warning system” that helps you track suspicious login attempts and unauthorized transactions simultaneously.  

Finally, exercise healthy skepticism when receiving emails, texts, and phone calls. Never rush to act, especially if requests involve your finances or login credentials. Verify every sender by contacting them directly through a phone number or email you know.

Stay Vigilant Against Account Takeover Fraud

Learning how account takeover fraud works will allow you to adopt strategies that will discourage thieves from accessing your money and sensitive information. Adopting strong security habits, regularly monitoring your accounts, and staying aware of common scams can go a long way toward protecting your finances.

Staying informed and adopting a proactive mindset regarding account security will reduce your risk of fraud. It will also help you build confidence in recognizing scams and shutting down ATO attempts before they start.

First Florida empowers you with the knowledge you need to protect your finances. Visit our Scam and Fraud Education page to learn how you can minimize your exposure to cybercrime.