Account takeover
Taking control of someone else's account, by someone who is not its owner. Why the term names a result rather than a method, what routes lead to it, and how it differs from fraud at signup.
In short
An account takeover is taking control of an existing account by someone who is not its owner. The account is legitimate, opened by a real person who was verified at the time: what changed is who operates it.
The term names the end state, not the technique. That is why "detecting account takeover" does not describe a concrete control until you say which route led to it.
A result reached by three different routes
This is the confusion that costs the most in a project conversation: it gets treated as an attack with its own defense, and it is not. Each route gets cut off in a different place.
- [Phishing](/fraude/phishing-y-smishing) — the account holder hands over the credential or the code, convinced by a message impersonating the organization.
- [Credential stuffing](/fraude/credential-stuffing) — the attacker tries, at scale, credentials already leaked from another service, with no contact with the account holder.
- [SIM swapping](/fraude/sim-swapping) — the attacker takes over the phone line and receives the code meant to confirm the account holder's identity.
There is a fourth route growing with biometrics: access recovery resolved with a face. When an account is recovered by comparing the face of whoever is claiming it against the one from signup, the vector is a deepfake, not a password.
It is not the same as fraud at signup
Both end with an attacker operating an account, and they stop at different points along the way.
- Account takeover — the account exists, has a real owner and a legitimate history. The attacker inherits that reputation, which is exactly what makes it valuable.
- Fraud at signup — the account is opened from scratch with an impersonated identity or with a synthetic identity. There is no victim with prior access and no history to inherit.
The distinction defines where to put the control. Fraud at signup is fought at identity verification. Account takeover is fought at authentication and in session signals, because signup already happened, and happened correctly.
Where it shows up in an identity journey
- Access — the moment when who is returning gets validated.
- Access recovery — the most exposed flow, because it exists precisely to let in someone who lost their factors.
- Contact information change — the step that consolidates control: when the email or phone changes, the account holder stops receiving alerts.
- High-value operation — a transfer, adding a new payee, changing limits. It is where the control taken turns into loss.
The contact-information-change step is what separates an attempt from a completed takeover, and it is the one most often left without a control of its own.
Frequently asked questions
It is taking control of an existing account belonging to someone else, by someone who is not its owner. The account is legitimate and was verified at the time; what changes is who operates it. It is named after its result and not its technique, because it is reached through different routes: phishing, leaked credentials, taking over the phone line, or an access recovery resolved with a face that is not the account holder's.
Through three common routes. Phishing gets the account holder to hand over their credential or code. Credential stuffing tries already-leaked credentials until one works. SIM swapping takes over the account holder's phone line to intercept the codes sent by SMS. A fourth is added: access recovery through biometrics when there is no presence control.
In that the account already existed. In account takeover, the attacker inherits a real account, with history and reputation built by its owner. In fraud at signup, the account is created with an identity that does not belong to the applicant or that does not correspond to anyone. The first is fought at authentication, the second at identity verification.
