Account Takeover: Threats to Digital Accounts

Account takeover poses significant threats to organisations, individuals, and financial institutions alike. Cybercriminals may alter payee details, monitor sensitive communications, or even initiate unauthorised payments - all under the veil of trust associated with the compromised account. Compared to traditional hacking, the primary purpose of account takeover lies in achieving fraud-centric outcomes such as monetary theft, data exploitation, or even supplier impersonation.

Account takeover occurs through several attack vectors:

Credential Theft

Cybercriminals often use phishing, smishing, and vishing tactics to trick victims into sharing passwords and usernames. Credential stuffing—repeatedly attempting stolen passwords on multiple accounts—is another method enabled by leaked credential databases from previous breaches.

Social Engineering and Impersonation

Fraudsters rely on psychological manipulation to gain access. Examples include SIM-swap attacks where control over a registered mobile number is achieved or fake 'support' calls asking users to "verify their login credentials."

Weak Authentication

Absence of multi-factor authentication (MFA), reliance on weak and reused passwords, or insecure recovery flows creates vulnerabilities that attackers exploit easily.

Session and Device Compromise

Stolen session cookies, malware installations, or unauthorised remote access tools capture authenticated sessions, handing attackers direct access without requiring credentials.

Cybercriminals target various industries using customised strategies:

• Retail & E-Commerce: Attackers use details saved in compromised accounts to exploit stored credit card information, modify shipping details, or redeem loyalty points fraudulently.
• Banking & Financial Technology: Adding fraudulent payees, increasing transfer limits, and initiating high-value transactions are methods employed in bank account takeover fraud.
• Corporate Accounts: Manipulation of supplier bank details to divert payments is common in B2B relationships.
• Email Takeover: Monitoring sensitive communications or launching invoice fraud and payment redirections are significant risks to individuals and businesses.
  

Detecting account takeover early is critical. Common warning signs include:

• Login Anomalies: Suspicious logins from unrecognised devices, unusual locations, or impossible travel scenarios may indicate unauthorised access.
• Behavioural Changes Within Accounts: Abnormal transaction patterns or increased transfer volumes following logins could raise alarms.
• Unusual Account Changes: Modifying account passwords, updating contact details (email/phone), or adding new payees could be symptoms of a takeover attempt.
• Payment Signals: Beneficiary account modifications or rapid cash withdrawals should trigger monitoring systems.
  

Detecting and preventing ATO effectively requires advanced systems, such as those offered via LSEG Risk Intelligence:

• Authentication Intelligence: Solutions employ behavioural biometrics, device fingerprinting, and real-time risk scoring to spot irregularities during login attempts.
• Transaction Monitoring: Employing anomaly detection technologies, systems track irregular payment behaviours and velocity rates to identify fraud patterns.
• Alert Triage: Linking the sequence of events (e.g., login + payment initiation) holistically helps paint a clearer picture of suspicious activities.
• Reducing False Positives: Using machine learning algorithms tuned against thresholds and incorporating customer-reported feedback enhances fraud detection accuracy.
  

Preventive mechanisms typically include:

1. Enhanced Login Security
   Implement multi-factor authentication (MFA) for risky transactions.
   Enforce strong password creation and integrate compromised credential monitoring to safeguard user accounts.
2. Hardened Recovery Flows
   Avoid social-engineering vulnerabilities through secure reset processes.
   Provide notifications for recovery actions to users promptly.
3. Controlled Payment and Profile Changes
   Add multi-layer verification for high-risk profile changes or bank detail updates. Introducing cooling-off periods may further reduce exposure risks.
4. User Awareness Training
   Equip users, especially financial services personnel, with training on phishing and impersonation scams.

LSEG Risk Intelligence solutions can support organisations by offering customised fraud detection solutions tailored for these controls.

Responding effectively to account takeover involves multiple steps:

• Containment: Lock the affected account, revoke session access, and prompt credential reset for users.
• Investigate: Trace the origins of the breach and evaluate the impact, especially focusing on financial transactions involving the compromised account.
• Recovery & Notification: Inform impacted users about questionable activities performed under their credentials while assisting recovery processes.
• Strengthen Controls: Rectify vulnerabilities exploited during the takeover, such as improving MFA practices or implementing sophisticated monitoring strategies.