What is account takeover?
Definition
Account takeover is when a criminal gets into your online account, such as email, social media or banking, using stolen login details, and locks you out or uses it to commit fraud.
- Category
- Attacks
- Also called
- ATO, account hijacking, hacked account
- Last updated
Account takeover (often shortened to ATO) means someone other than you is now logging in to your account. The FBI's Internet Crime Complaint Center (IC3) tracks it as a fraud type, and the FTC covers the recovery steps for hacked email and social media accounts.
How it happens
Most takeovers start with a password the attacker already has. It may have leaked in a data breach, been tricked out of you by a phishing message, or been guessed because you reuse it on several sites. Attackers also pose as a company's support team and ask for a one-time code, which lets them get past two-step verification. Related methods include credential stuffing and SIM swapping.
A typical case: your email password appears in an old breach, you use the same one for a shopping account, and someone logs in there, changes the email address and orders goods to a new address.
What the attacker does next
The FTC points to the usual signs: auto-forwarding rules you didn't create, messages in your sent folder you didn't write, and posts or new contacts you don't recognize. Hijacked accounts are often used to message your friends with links or requests for money, which is why a takeover rarely stays your problem alone. If the account is tied to money, the attacker may also move funds or open new credit.
Account takeover vs. related terms
- Identity theft is using your personal details to pose as you, often to open new accounts. A takeover is control of an account that already exists, though it can lead to identity theft.
- A data breach is how a password gets out. The takeover is what happens when someone uses it.
- Phishing is one way to steal the login. The takeover is the result.
How to protect yourself
- 1
Use a different password everywhere
A leaked password only opens one door if it isn't reused. A password manager makes this practical.
- 2
Turn on two-step verification
Use an authenticator app or security key where you can. Never read a code out to someone who contacts you first; companies don't ask for them.
- 3
Check recovery details and forwarding rules
Make sure the recovery email and phone number on your key accounts are yours, and look for forwarding rules you didn't set up.
- 4
Act fast if you're hit
Change the password, sign out of all devices, tell your contacts, and change any reused passwords. If money or identity details were involved, call your bank and report it at IdentityTheft.gov and ic3.gov.
- 5
Keep your details off people-search sites
The less an attacker can find about you, the easier it is to resist support-impersonation tricks. Serus finds where your address and phone number are listed and removes them.
See where your personal data is exposed
Serus finds it on data brokers and people-search sites and removes it.
Frequently asked
How do I know if my account has been taken over?
Common signs are a password that stops working, security alerts for logins you didn't make, sent messages you didn't write, forwarding rules you didn't create, and changed recovery details.
Can I get a hijacked account back?
Often, yes. Use the provider's account recovery process. The FTC advises scanning your device for malware first if you're locked out, then following the provider's steps.
Is account takeover the same as being hacked?
People use the words interchangeably. Account takeover is the specific case where an attacker controls one of your accounts, usually with a stolen or guessed login rather than any break-in to your device.
Sources
Something wrong or out of date? Tell us and we'll re-check it.