Account takeover is often read as identity theft, but the account is real and open: the criminal logs in as the customer.
What is account takeover fraud?
Account takeover fraud (ATO) is a type of fraud committed through the victim's login. The FBI's Internet Crime Complaint Center (IC3) gives the definition: "In Account Takeover Fraud (ATO), cyber criminals deliberately gain unauthorized access to a victim's online bank, payroll, health savings or social media account, with the goal of stealing money or information for personal gain."
FinCEN separates ATO from other computer intrusion by its target: the customer, "rather than the financial institution maintaining the account, is the primary target" (FinCEN advisory of 19 December 2011). Its signs include unusual ATM activity, sudden wires and "changes to customer and account profiles".
Is account takeover the same as identity theft or new account fraud?
No: in a takeover the account already exists. FinCEN's Financial Trend Analysis of January 2024 defines identity theft as "using identifying information unique to the rightful owner without the rightful owner's permission"; a new account or loan opened that way is new account fraud.
How does an account takeover attack work?
A Justice Department seizure release of 22 December 2025 describes one scheme:
- Bait. Fake ads on Google and Bing imitated banks' sponsored search ads.
- Harvest. Malicious software on fake bank sites captured the logins.
- Store. The logins sat on a backend panel, web3adspanels.org.
- Drain. They used the logins on the real bank sites to drain the accounts.
The FBI identified at least 19 victims. About $28 million was attempted and $14.6 million lost. Sergei Filimonov, a Russian web developer, is accused of building the infrastructure (DOJ, 8 September 2026).
Burçak Aydın, this entry's author: "A consumer who typed a one time code into a fake bank page has not furnished an access device under Regulation E, the CFPB says, so the transfers count as unauthorized and the bank cannot use the consumer's carelessness to raise the consumer's share of the loss."
Table 1. One account takeover, stage by stage.
| Stage | Criminal | What the customer or bank sees | Who can stop it |
|---|---|---|---|
| Bait | Buys search ads that imitate the bank's own | A sponsored result that looks like the bank | The customer, by using a bookmark (FBI) |
| Harvest | Captures the login, and a one time code if the account asks for one | Nothing unusual | The customer |
| Log in | Uses the login on the real site | A login from a new device or place | The bank, with step up checks |
| Change | Edits contact details or payroll direct deposit | Profile changes (FinCEN) | The bank |
| Cash out | Sends wires or ACH payments; one incident can hold 50 or more (IC3) | Payments to new payees at several banks | The bank and the receiving banks |
What are the different forms of ATO attacks?
Table 2. Eight routes into an account.
| Route | What the criminal does | Source |
|---|---|---|
| Brute force | Guesses weak passwords on accounts without multi factor authentication | IC3 |
| Phishing emails | Sends a deceptive email that asks for the login | IC3 |
| Phishing sites | Builds a site that looks like the bank or payroll login | IC3 |
| Social engineering | Poses as bank or support staff, or talks a call center into a password reset | IC3; FFIEC |
| Breach data | Takes logins from past data breaches or from criminal forums that sell them | IC3 |
| Malware | Steals the login from the victim's own device | IC3 |
| SEO poisoning | Buys search ads that send the victim to a fake site | IC3; DOJ |
| SIM swap | Has the victim's number moved to a SIM the criminal holds, then reads the codes | IC3 2025; DOJ |
IC3 lists the first six routes and SEO poisoning. Social engineering here is impersonation fraud: the FBI's alert of 25 November 2025 describes criminals posing as a financial institution's staff by text, call or email.
Phishing, malware and breach data are the online routes in Table 2, so those takeovers are also cyber fraud.
How does SIM swap fraud hijack a mobile number, and how do banks detect it?
Kimionte Bennett's group moved victims' numbers onto its own SIM cards and used the intercepted multi factor codes on their cryptocurrency accounts; he was sentenced to 70 months on 27 February 2026 (US Attorney, Northern District of Texas).
SIM swapping, also called SIM jacking or SIM card hijacking, moves a victim's phone service to the criminal's device. The mechanism is easy to understand. IC3 calls it "unsophisticated social engineering" of mobile providers, and logged 971 complaints and $17,366,758 in losses in 2025 (IC3 2025 report, pages 25 and 26).
Calls and texts to the number then reach the criminal, so SMS 2FA vulnerabilities start here. For that vulnerability, NIST's guideline of August 2025 tells verifiers to weigh a "SIM change" or "number porting" before sending a code over the PSTN.
Carrier side rules set the regulatory direction: the FCC's 2023 CPNI rule, 47 CFR 64.2010(h), tells carriers to authenticate customers securely before any SIM change, eSIM included, and to train staff, but its eCFR text sets no compliance date yet (read 19 October 2026).
Bank teams can check the number. Fintech apps can run a SIM swap check online with the CAMARA SIM Swap API, since "a recent SIM swap may indicate a risk of account takeover fraud"; GSMA lists the networks that support it. CAMARA's example is a scan before a password reset code goes out by SMS. Step up checks can follow a hit. Instead of the code, the failed verification can go to a secondary process.
Victim recovery starts at the bank: ask at once for a recall or reversal, reset exposed credentials, file at ic3.gov with the words "account takeover" and distrust caller ID, IC3 says.
What is the impact of ATO fraud on customers and firms?
IC3's 2025 report counts about 4,700 complaints and $359.7 million under "Account Takeover (ATO)" (page 12). FinCEN counted about 80,000 BSA reports of account takeover for 2021, with $9 billion in suspicious amounts (the same analysis, page 13).
The UK Finance Annual Fraud Report 2026 puts 2025 remote banking fraud losses (internet, telephone and mobile banking) at £104.4 million, down 27 percent, across 37,646 cases, and card account takeover at £37.8 million (pages 31 and 26). Firms are targets too. Organizations of varied sizes appear in the FBI's alert.
How do firms detect and prevent ATO fraud?
Detection reads the login, the profile and the payment for signs of someone else; prevention makes the login harder to steal.
What are the red flags of an account takeover?
- Profile changes (FinCEN): review the next payment.
- A recent SIM change (NIST): no SMS code until it is checked.
- An unusual device or an abnormal location (EU rules, Article 18): strong customer authentication.
- Malware signs in the session (EU rules, Article 2): monitoring counts them.
- A call center password reset (FFIEC): enhanced authentication.
- Sudden wires or clustered ACH payments (FinCEN): hold for review.
Before a first payment to a new payee, check the payee against sanctions lists, the US SDN list included, free.
How fraud detection works covers scoring and review; transaction monitoring rules lists rules behind the payment flags.
What do authentication rules require?
Authentication with a single factor, alone or with layered security, is "inadequate in many situations", the US banking agencies said in August 2021 (FFIEC guidance, page 3). In the EU, Delegated Regulation (EU) 2018/389 requires strong customer authentication on "two or more elements" from knowledge, possession and inherence. Its Article 2 adds monitoring for stolen credentials and malware.
The FBI names the limit: "MFA will not protect you if you land on a fraudulent login page."
What does the law say about account takeover fraud?
Table 3. Account takeover rules by jurisdiction.
| Jurisdiction | Rule | What it covers | Maximum or liability | Who it binds |
|---|---|---|---|---|
| US | 18 U.S.C. 1030(a)(4) | Accessing a protected computer without authorization to further a fraud and obtain something of value | 5 years, first offense ((c)(3)(A)) | Anyone |
| US | 18 U.S.C. 1343 | Wire fraud | 20 years; 30 if it affects a financial institution | Anyone |
| US | 18 U.S.C. 1028A(a)(1) | Using another person's means of identification during a listed felony | 2 years added | Anyone |
| US | Regulation E, 12 CFR 1005.2(m) and 1005.6(b) | Unauthorized transfers from consumer accounts | Consumer pays at most $50 with notice within two business days of learning of the loss, else up to $500; more if a statement goes unreported for 60 days | Financial institutions |
| US | 47 CFR 64.2010(h) | Secure authentication before a SIM change; staff training | No compliance date in the eCFR text, read 19 October 2026 | Mobile carriers |
| UK | Computer Misuse Act 1990, s1 | Unauthorized access to computer material | 2 years on indictment | Anyone, UK wide |
| England, Wales and Northern Ireland | Fraud Act 2006, s1 | Fraud, including false representation (s2) | 10 years on indictment; s15(2) limits it to England, Wales and Northern Ireland | Anyone |
| UK | Payment Services Regulations 2017, reg 76 and reg 77 | Refund of an unauthorized payment by the end of the business day after the provider learns of it, unless it suspects the user of fraud and reports it | Payer pays up to £35; all losses if the payer acted fraudulently or, with intent or gross negligence, broke reg 72 | Payment service providers |
| EU | Delegated Regulation (EU) 2018/389, Articles 2, 4, 18 | Strong customer authentication and transaction monitoring | Applies from 14 September 2019; no penalty in the text | Payment service providers |
The payment rules decide who carries the loss, and in the US a consumer's negligence cannot raise that share, the CFPB says.
Where does ATO fraud sit in AML compliance?
ATO sits where fraud meets AML. Stolen money leaves as payments the bank must monitor and, when suspicious, report. In a suspicious activity report on account takeover, FinCEN asks for the words "account takeover fraud" in the narrative. The receiving account may belong to a money mule who moves the funds on. After recovery, refresh the KYC record.
complead, formerly Sanction Scanner, runs fraud and AML work, from onboarding to investigation, on one engine, so a customer whose account was taken over carries one risk score for both. Device and behaviour analysis, the platform's solution for this, reads the device fingerprint and the session, from before login to the payment.
This week:
- Review last month's payments sent within a day of a contact change.
- List logins and resets that send SMS codes without a SIM change check.
- Add "account takeover fraud" to your SAR narrative template.
Related terms
- Impersonation fraud. Pretending to be someone the victim trusts.
- Money mule. A person whose account passes on stolen money.
- APP fraud. Authorized push payment fraud, where the victim makes the transfer.
