Account takeover — where a thief gains access to your existing bank, email, or social media accounts — is growing faster than any other form of identity fraud. Here's how it happens and how to stop it.
Account takeover fraud — where a criminal gains unauthorized access to your existing bank account, email, brokerage, or social media account — grew by 354% between 2019 and 2023 according to Javelin Strategy & Research. Unlike new account fraud, which requires a thief to build a fraudulent identity from scratch, account takeover exploits credentials you've already established. The thief doesn't need to be clever — they just need your username and password.
The most common method is credential stuffing: automated attacks that test username/password combinations stolen in data breaches against hundreds of websites simultaneously. Because most people reuse passwords across multiple sites, a single breach can unlock dozens of accounts. The 2021 RockYou2021 compilation contained 8.4 billion unique password entries — the largest credential database ever assembled, and it's freely available to anyone who wants it.
Other methods include phishing (tricking you into entering credentials on a fake site), SIM swapping (convincing your carrier to transfer your phone number to a thief's SIM, bypassing SMS two-factor authentication), and social engineering (calling customer service and impersonating you to reset account credentials). High-value targets — people with significant financial assets or large social media followings — are often targeted with custom attacks rather than automated credential stuffing.
Signs your account has been taken over: login notifications from unfamiliar locations or devices, password reset emails you didn't request, transactions you don't recognize, contacts receiving messages you didn't send, or being locked out of an account you were just using. If you see any of these, act immediately — every minute of delay gives the attacker more time to drain funds, change recovery information, or use your account to attack others.
Prevention starts with unique passwords for every account — a password manager makes this practical. Enable two-factor authentication on every account that offers it, preferring an authenticator app (Google Authenticator, Authy) over SMS codes, which are vulnerable to SIM swapping. Set up login alerts on financial accounts so you're notified of every sign-in. Review your accounts' connected apps and revoke access to anything you don't recognize or no longer use.
If your account is taken over: contact the company's fraud department immediately — most have dedicated account takeover teams. Document everything: screenshots of unauthorized transactions, timestamps of when you noticed the problem, and records of every communication with the company. File a report with the FTC at IdentityTheft.gov. For financial accounts, your liability for unauthorized transactions is limited by law if you report promptly — the faster you act, the better your recovery outcome.
Safety 1st Editorial Team
This article is credited to Safety 1st Editorial Team. Safety 1st Consumer Protection has republished this content with attribution.