Account takeover is a fraud in which bad actors use stolen credentials to possess real credit cards, shopping, or even government benefits account is one of the most known forms of identity theft.
Account takeover fraud (ATO) occurs when a cybercriminal gains access to the victim’s login credentials to steal funds or information. Fraudsters digitally crack into a financial bank account to take control of it and have a variety of techniques at their disposal to attain this, such as phishing, malware, and man-in-the-middle attacks, among others. ATO is a top threat to financial organizations and their clients due to the financial losses and mitigation efforts.
How Does Account Takeover Happen?
The growth of digital communication and data storage means cybercriminals have several entry points when endeavoring to gain access to users’ personal information. Also, people are often bad at using robust passwords. Cybercriminals do not need sensitive information to gain access to an account. They will seek out the simple entry point and build the account takeover. It can start with any piece of personal data used when logging in, such as an email address, full name, date of birth, or city of residence, all of which are found with minimal research.
Once a hacker has taken over a user’s main communication channel, they can change everything the account gives them access to, such as security questions, passwords, encryption settings, usernames, etc. This complete lockout can even make the actual user look suspicious when trying to resolve the problem since they would no longer know the updated information associated with the account.
Methods used in account takeover fraud
The foundation for a successful account takeover is access to a user’s account credentials. The following are the methods used for account takeover:
Phishing: People remain the weakest security link because of their natural tendency to trust, which is essential to successful social engineering attacks. The most familiar form of phishing is email, text messages, and social media messaging services can also be used. In the case of mobile users, they don’t even need to download an attachment. A link within an SMS can direct a user to a web page that automatically installs malware on their device.
Credential Stuffing: Credentials stolen from or leaked from various interchanges (or purchased from the dark web) are tested against numerous websites, in the hopes of acquiring a victim who hasn’t realized their login information is compromised.
SIM Card Swapping: Swapping a SIM card is a fair service offered by mobile phone carriers when a customer buys a new device, and the old SIM card is no longer consistent with it. Fraudsters can abuse this service with a fairly simple hack. In a SIM card swap deception, a fraudster uses social engineering strategies to transfer the victim’s mobile phone number to a new SIM card. The fraudster contacts a customer’s mobile phone carrier and simulates the customer, persuading a call center agent to port the mobile phone number to the illegal SIM card. As a result, the user’s banking application can be started on the fraudster’s phone. If the bank’s authentication mechanism contains text messages as a means of producing one-time passwords, then handling the victim’s number becomes an attractive way for a criminal to perform fraudulent dealings, add payees, or perform other operations during a banking session.
Malware: Malware is another way to take possession of a bank account by installing malicious software or “malware” on the target’s computer or mobile device. This is done by downloading apps from untrusted sources, or it can be in other programs; for example, masquerading as a Flash player update. Some malware, called key loggers, will intercept everything the user types, including their banking credentials.
Mobile Banking Trojans: One typical technique utilized by mobile banking trojans is an overlay invasion in which a fake screen is put on top of a legitimate bank application. The malware then apprehends the victim’s authentication credentials and can remain active while other banking transactions are performed. For example, the malware can modify transaction data by intercepting a funds transfer and redirecting the funds to a fraudulent account. These attacks are destined to grow as smartphone usage continues to grow globally.
Man-in-the-Middle Attacks: In a Man-in-the-Middle attack, fraudsters place themselves between the monetary institution and the user in order to intercept, edit, send and receive communications without being noticed. For example, they can take over the communication channel between the user’s device and the bank’s server by setting up a malicious Wi-Fi network as a public hotspot in a coffee shop and giving it an innocuous but legitimate sounding name, such as “Public Coffee.” Individuals take advantage of public hotspots, not realizing they may be sharing their payment data through a network controlled by a bad actor. A Man-in-the-Middle attack can also take place via a vulnerable mobile banking application that isn’t protected.
Botnets: Hackers will deploy bots to hack into customers’ accounts – bots can plug in commonly-used passwords and usernames to serve high-volume, rapid seizures and take over the maximum number of accounts, all while dwelling hidden from immediate view. Because bots deploy from numerous locations, it’s harder to identify malicious IP addresses logging in.
Brute-force attacks: The attacker, usually via an automated script, tries a username/password mixture across multiple accounts until one works. These include so-called dictionary attacks, in which attackers use familiar passwords and dictionary terms to guess passwords.
How to detect account takeover fraud
ATO can be challenging to detect because fraudsters can hide behind a customer’s positive history and mimic normal login behavior. Constant monitoring of the account will give the ability to sense the signs of account takeover fraud before it begins.
An effective fraud detection system will give financial institutions visibility into a user’s activity before, during, and after a transaction. The best security is a system that monitors all activities on the bank account because before a criminal can steal money, they need to execute other actions first, such as setting up a new payee. Monitoring all activities on an account will help recognize patterns of behavior that suggest the possibility of account takeover fraud. Since criminals need to take actions like this before moving money out of an account, a fraud detection system with continuous monitoring will find patterns and clues to determine that a customer may be under attack.
This scam detection system can also assess risk based on data such as location. For example, if a client first accesses their account in North America and then again in 10 minutes from Europe, it’s clear that is suspicious and could mean that two different individuals are using the same account.
If there is a risk of ATO fraud, the fraud prevention system will challenge the person transacting on the account by requesting additional authentication. That could include utilizing an approach known as adaptive authentication or Intelligent Adaptive Authentication. By asking for a higher level of authentication before the transaction is allowed to be brought out – such as a fingerprint biometric or a facial scan – the bank can help prevent account takeover. If the authentication is successful, the transaction can proceed. In the case of a criminal, they will not meet the biometric challenge, and the fraud attack stops.
How Can You Protect Yourself From Account Takeover?
What else can you do to reduce your risk of account takeover fraud? Following general best practices for reducing the risk of identity theft is the best place to start. Some factors may be out of your control. For example, your information may leak in a data breach without your knowledge. You can, however, take steps to limit the ways bad actors can use your data.
Be meticulous with passwords: Hackers will be more successful with their attacks if they use the same logins and passwords on multiple sites. Ideally, you can have a unique, secure password for every online account. Using a secure password manager to generate and store these passwords across devices could be a great help.
Two-Factor Authentication (2FA): Simply setting up security on your accounts to send a one-time passcode by email or text can help thwart an account takeover. Adding biometrics like face recognition or fingerprints can also be effective. Multifactor authentication may not be available on all accounts, but it is available on many critical ones. Activate it wherever you can.
Safeguard your credit: Even before you fall victim to account takeover, you might want to think about placing a credit report fraud alert or credit freeze with all three credit bureaus. With a fraud alert, credit bureaus will ask creditors to take steps to verify your identity before issuing credit in your name. A credit freeze prevents potential creditors (and others) from viewing your credit report and scores unless you deliberately thaw your credit information.
Security Questions: Users are required to answer pre-determined questions after successfully providing a password. While this is a basic form of increased security, it increases the likelihood of protecting against a malicious login attempt.
AI Detection: WAFs are not always capable of identifying more sophisticated account takeover attacks – static policies can be tricked into thinking malicious logins attempts are legitimate. Recent developments in AI technology have been leveraged to identify complex account takeover attack techniques and monitor the website and web application traffic to detect suspicious activity.
Employee Education: Employees are often the last line of defense against account takeover – properly educating them on the signs and symptoms of a compromised account is essential. Training tools that showcase account takeover interactions or phishing emails can help them save their online identity and avoid social engineering tricks.
Device Tracking: Tracking and displaying login locations can help catch suspicious activity. A login that retains occurring 200 miles away from the user can automatically signal to IT that the account should be frozen.
