Account takeover

Account takeover refers to the situation where a third party gains control of the account of an existing, legitimate customer. There is therefore no fake customer to detect at onboarding: the holder is real, the account is long standing, the history is good. Access is obtained through phishing, through the reuse of a password from a data breach, through SIM swap to intercept validation codes, or through manipulation of the customer themselves. Once inside, the attacker adds a payee, changes contact details or the notification address, then transfers the funds. The useful signals are therefore breaks in pattern: an unknown device, a payee never seen before, a change of contact details followed by a transfer.