Account takeoverATO

A criminal getting into an existing customer's account.

The account is real and belongs to a genuine customer, but someone else has taken control of it, for example by logging in with the customer's stolen password.

Unauthorized access to an established account via credential compromise, session hijack, or social engineering. Credential compromise means the attacker obtains the login details, session hijack means the attacker takes over an active login session, and social engineering means the attacker tricks a person or a help desk into granting access.

Attackers use several common routes:

• Credential stuffing, which replays leaked username and password pairs against many sites.
• Phishing, which tricks the customer into entering their login on a fake page.
• SIM swap, which moves a victim's phone number to a SIM card the attacker controls so that text codes go to the attacker.
• Help desk social engineering, which persuades support staff to reset a login.

An account takeover often unfolds like this:

1. The attacker gets valid credentials or a session.
2. They log in and look around, often changing contact details or recovery settings.
3. They move money, make purchases, or steal data.
4. The real customer finds out when something goes missing.

Account takeover sits next to terms that are easy to mix up:

• Third-party fraud often opens a new account in the victim's name, while takeover hijacks an existing one.
• Credential stuffing is one method of taking over accounts.
• Re-verification re-checks the real person before a risky action, which helps stop takeover.

For more, see When Your Help Desk Becomes the Front Door: How Scattered Spider is Weaponizing Human Trust.