The Outlier Lab

Account Takeover (ATO)

A third party seizes control of a legitimate account and monetizes its stored value, credentials and payment rails through withdrawals, trades, P2P, redemptions, purchases or payout changes.

What it is

ATO names an outcome. The techniques that produce it have their own notes: Credential Stuffing, Phishing and Credential Harvesting, SIM Swap and Port-Out Fraud, Session Hijacking and Infostealers, MFA Bypass and OTP Interception and Account Recovery Abuse. The most common exit has its own note, Payout Redirection. This hub covers what they share: the account was legitimate, the owner did not authorize the activity, and the loss lands at a transaction.

Three boundaries matter for classification, liability and labels (see Loss Taxonomy and Attribution):

  • ATO vs. authorized scams. In Impersonation Scams and Authorized Push Payment (APP) Scams the customer sends the money. In ATO the attacker does. The hybrid in between is now the norm. A caller posing as the bank's fraud team gets the customer to read back a one-time code, then logs in and moves the funds. Legally that is usually unauthorized (see Regulation E and Unauthorized Transfers). Operationally it looks like a scam, because the customer took part.
  • ATO vs. fake accounts. Synthetic Identity Fraud, Fake Account Creation (Bots) and Account Farming and Resale produce accounts that were never legitimate. A bought "aged account" being handed to a new operator can look exactly like ATO in your logs.
  • ATO vs. first-party claims. "I was hacked" is also a common First-Party Fraud narrative. The same evidence (device continuity, session history, the destination of funds) decides both.

In FinCEN's analysis of 2021 BSA filings, account compromise made up about 18% of identity-related reports but about 32% of the suspicious-activity dollars, and the account-takeover typology alone came to roughly 80,000 reports and $9 billion. Per report, it is the costliest way identity gets exploited. In November 2025 the FBI reported more than 5,100 ATO complaints and over $262 million in losses since January 2025, just from schemes that impersonate financial institution support.

How it works

Every ATO runs through four stages. The gap between gaining control and cashing out is the defender's window, and it is shrinking.

Diagram: Acquire access (credentials, session, phone number, recovery path), Establish control (password, email, phone, device, notifications), Stage value (new payee, bank link, liquidation, limit or payout change), Cash out (wire, ACH, P2P, push-to-card, crypto, gift card, trade), Layer through mules and exchanges
  1. Acquire access. Reused passwords, phished credentials and codes, stolen session tokens, a hijacked phone number, an abused recovery flow, or a support agent who was deceived or bribed.
  2. Establish control. Lock the owner out and make the account stay controllable: change the password, email or phone, enroll a device or factor, turn off notifications. The FBI's 2025 ATO alert says that in nearly all of the social engineering cases it saw, the criminals changed the password and locked out the owner.
  3. Stage value. Add a payee or bank link, change the payout destination, sell positions, raise limits, or start a transfer.
  4. Cash out and layer. Move the value to Money Mules, crypto, gift cards or goods, usually split and quickly re-sent.

Sophisticated actors split these stages across people. Access is bought, the monetizer picks the rail, and the mule herder handles the exit (see Fraud-as-a-Service Ecosystem). Because of that split, a credential-stuffing wave and the losses from it can be days or weeks apart.

Monetization paths by industry

The entry method sets whether the attacker gets in. The account's capabilities set what you lose, so map your exposure product by product.

Brokerage and investing

  • Liquidate, then withdraw. The attacker sells positions, links or swaps in a bank account, and withdraws by ACH or wire. The tell is the sequence: new device, then bank link or contact change, then sell orders on long-held positions, then a first withdrawal to the new destination. FINRA's account-takeover practices notice cites withdrawals to a newly established bank account, and an email change followed by a third-party wire request, as patterns firms monitor.
  • ACATS out. Instead of withdrawing cash, the attacker moves the whole account to another firm, where an account opened in the victim's name (with a stolen or synthetic identity) receives it. The loss lands at the receiving firm's withdrawal, but the decision point is at your transfer review. See ACATS Transfer Fraud.
  • Ramp-and-dump buying. The victim's cash, or the proceeds of selling the victim's holdings, buys thinly traded securities the attacker already owns. The attacker sells into that demand from an account somewhere else. No money leaves the victim account, so withdrawal controls never fire. In Japan's 2025 wave, the FSA said it had not confirmed any cases of money being withdrawn to third parties, even though trading volume was massive. FINRA described an options version as early as 2020: victim accounts buy wide-spread, out-of-the-money contracts at inflated prices from a separate "profiting account." See Ramp-and-Dump via Account Takeover and Trading Pattern Signals.
  • Margin and options as amplifiers. Buying power lets the attacker move more value than the account's cash balance, and turns an ATO loss into a debit balance the firm has to collect.

Neobanks and consumer fintech

  • P2P and instant rails. The account balance goes out through P2P, RTP/FedNow or push-to-card to mule accounts, in amounts sized under per-transaction limits. These rails are irrevocable, so the decision has to happen before release. See Real-Time Payment Rail Fraud.
  • Wires to crypto-linked accounts. The FBI's 2025 alert describes funds wired quickly to criminal-controlled accounts, many of them linked to crypto wallets, which makes them hard to trace or recover.
  • Card provisioning. The attacker provisions the account's debit card into a mobile wallet on their own device, then spends or withdraws at ATMs. The money moves on card rails while your app shows a normal session. See Digital Wallet Provisioning Fraud.
  • Credit features. Overdraft, early wage access and instant credit lines are drawn down and then cashed out. This looks like Bust-Out Fraud, but the account holder is a victim.

Cashback, coupons and rewards

  • Redeem or transfer the balance. The attacker cashes out the points or cashback balance to gift cards (instant and fungible), to a PayPal or bank destination, or to partner programs whose transfers can't be reversed. Per-account value is low, so attackers make up for it with volume, which ties this vertical closely to Credential Stuffing.
  • Change the payout destination. Often the only "transaction" is a destination change followed by a routine scheduled payout. See Payout Redirection and Loyalty and Rewards Redemption Fraud.
  • Slow discovery. Many victims rarely open the app, so drained balances can go unnoticed for weeks. Your labels will lag, and loss estimates based on complaints will understate the problem.

Online marketplaces

  • Buyer accounts. Stored cards are used to buy resellable goods or digital goods shipped to new addresses, and stored-value balances are spent. The loss comes back later as card disputes (Card-Not-Present Fraud) or as refunds requested to a new method.
  • Seller accounts. The payout bank is changed to capture pending disbursements, or a seller account with an aged reputation is used to list goods that are never delivered and collect buyer payments before claims mature. See Seller Non-Delivery and Fake Listings and Triangulation Fraud.

Retail and ecommerce, payments and P2P wallets

  • Retail sees stored-card purchases, loyalty point drain, store credit and gift card balances, and order pickup by a third party. See Retail and Ecommerce.
  • Wallets and P2P apps see balance transfers, linked-card funding of transfers out, and instant cash-out to debit cards. See Payments and P2P.

Transaction footprint

By entry method

Use this table to make sure each entry method has a control at the transaction where its loss lands, not only at login.

ATO entry methodFirst visible event in your dataWhere the loss landsStrongest decision point
Credential StuffingSuccess from new device/IP after a cross-account failure burstReward redemptions, stored-card purchases, small P2P, withdrawals where MFA is optionalLogin risk scoring; step-up on first money movement from a new device
Phishing and Credential Harvesting (incl. real-time relay)Login with correct password and MFA from new infrastructure, minutes after the lureWire, P2P, liquidation within minutes to hoursPhishing-resistant authentication; new-payee and new-destination holds
Vishing / OTP social engineering (MFA Bypass and OTP Interception)Code requested and entered while the customer is on a call; often a password changeWire, P2P, crypto purchase, card provisioningTransaction-bound confirmations; callback to number on file
SIM Swap and Port-Out FraudRecent SIM/port change on the phone of record; SMS-based resetHigh-value withdrawal, crypto, ACATSPhone-change recency check before trusting SMS; payout hold after contact change
Session Hijacking and InfostealersNo login at all; existing session continues from new device/networkPayout change, purchases, redemptionsSession binding; re-authentication at sensitive actions
Account Recovery AbuseReset, contact change or support-assisted recoveryPayout redirection, ACATS out, full liquidationPost-recovery cool-off; restrictions on money movement
Insider or deceived support agent (Insider Fraud)Agent-initiated change without customer-side authenticationAnyInsider Access Controls; dual control on contact and payout changes
On-device fraud (remote access, malware)Session from the customer's own device with unusual interaction patternsP2P, wireRemote Access Tool Detection; Behavioral Biometrics

Generic sequence

StageWhat you see in the dataDecision point
AccessNew device, ASN or geography; failed-login bursts; reset or recovery eventsLogin risk, step-up
ControlPassword, email or phone change; new device or factor enrolled; notifications disabledCool-off, notify old contact, block money movement for a window
StagingNew payee or bank link; payout destination change; position liquidation; limit increaseOwnership verification, holds, trading checks
Cash-outFirst payment to a new destination; payments sized under limits; many payments across railsReal-time scoring, payee risk, friction
AftermathCustomer contact, disputes, ACH returns, wallet complaintsRecovery, recall requests, labeling

Common variants

VariantWhat's differentWhere it shows up
Lockout takeoverPassword and contacts changed; owner can't get inBanking, brokerage, crypto
Silent coexistenceAttacker shares the session with the owner and avoids visible changesRewards, retail, marketplaces
Fast cash-outMinutes between access and money movementInstant rails, wires, crypto
Low-and-slowSmall redemptions or purchases over weeks across many accountsRewards, loyalty, gift card balances
Hybrid scam-ATOCustomer is coached to share codes or approve promptsBanking, P2P, brokerage
Trade-based monetizationValue moves through trades rather than withdrawalsBrokerage
Access resaleValidated accounts sold on to monetizersAll; see Account Farming and Resale
Known-person ATOFamily member, partner or caregiverBanking, brokerage; see Elder Financial Exploitation
Payroll and benefit diversionDeposit destination changed in an HR or payroll portalNeobanks receiving diverted pay

Where it shows up

ATO is present at every stage of the Customer Lifecycle Map after onboarding. Loss concentrates where three things meet: high stored value, irreversible rails, and weak checks on account changes. Brokerage and crypto carry the highest loss per incident. Rewards and retail see the most incidents. Neobanks and P2P apps see the fastest cash-out. Marketplaces are exposed on both sides of the transaction.

Impact

  • Direct loss. Exposure is set by how fast and irreversibly money can leave. For consumer electronic fund transfers, Reg E caps the customer's liability for unauthorized transfers: generally $50 if reported within two business days, up to $500 after that, and potentially more for transfers not reported within 60 days of the statement. Most of the remaining loss falls on the institution. See Regulation E and Unauthorized Transfers.
  • Remediation beyond legal minimums. In May 2025, the Japan Securities Dealers Association and 10 securities firms announced a policy to compensate victims to a certain extent, case by case and regardless of their terms of service, which the rules did not strictly require. There was no common formula: SBI and Matsui disclosed a flat 50%, while others set amounts by circumstances.
  • Downstream loss. Disputes on stored-card purchases, ACH returns, recall costs, and goodwill credits.
  • Operations. Spikes in recovery and lockout contacts. Japanese brokerages' call centers were overwhelmed after they tightened login security.
  • Regulatory. Broker-dealer identity theft and safeguarding obligations (see Broker-Dealer Obligations (FINRA and SEC)), SAR filing (BSA-AML and SAR Filing), and Nacha's 2026 fraud-monitoring requirements for receiving institutions (Nacha Rules and ACH Risk).
  • Industry-wide. The FBI's 2025 Internet Crime Report recorded more than 1 million complaints and $20.9 billion in losses across all crime types. ATO doesn't have a row in the report's crime-type tables. The report covers it in its cyber-enabled fraud and Recovery Asset Team sections instead: about 4,700 ATO complaints and $359.7 million in losses. In 2025, ATO and tech-support cases grew as a share of Financial Fraud Kill Chain referrals, which had been dominated by BEC. The FBI notes that a single ATO incident can involve 50 or more simultaneous transactions to different recipient accounts at multiple banks. That makes recovery a multi-bank race. ATO is also the hidden enabler behind losses booked under other categories.

Red flags

Prevention and detection at a glance

LayerControl or signalWhat it does here
PreventPasskeys and Phishing-Resistant AuthenticationRemoves reusable and relayable secrets from the login
PreventBreached Password Detection, Bot Management and CAPTCHA, Rate Limiting and ThrottlingCuts credential-stuffing yield
PreventSecure Account Recovery Design, Customer Support Verification ProtocolsCloses the side doors
DetectRisk-Based Authentication and Step-UpSteps up at login and at money movement
DetectReal-Time Transaction Risk Scoring, Transaction MonitoringScores the transaction with the session context attached
RespondContact Change Cooling-Off Periods, Withdrawal and Payout Controls, Velocity and Exposure LimitsHolds value after risky changes
RespondFraud Incident Response, Case Management SystemsContains waves; manages recalls and customer restoration

Emerging variants and adversary adaptation

  • MFA pushed attackers toward sessions and real-time relays. Microsoft reports that more than 97% of identity attacks are still password spray or brute force, and that modern MFA cuts compromise risk by more than 99%. The losses now concentrate in the small share of attacks that steal tokens or relay logins in real time. In April 2026 Microsoft described a relay-phishing campaign that captured authentication tokens from more than 35,000 users across 26 countries, mostly in healthcare and finance.
  • Lures arrive through search ads. The FBI highlighted purchased search ads that impersonate financial institutions. In December 2025, the DOJ seized a backend that stored bank credentials harvested through such ads. It was linked to about $14.6 million in actual losses and $28 million attempted.
  • Monetization without withdrawal. Japan's 2025 brokerage wave moved value through trades. The FSA's interim January–April 2025 tally, as reported in May 2025, was about 6,380 unauthorized accesses and about 3,505 unauthorized trades, worth roughly ¥161 billion in sales and ¥144 billion in purchases. Its current full-year 2025 data, revised as more cases were reported, counts 17,717 unauthorized logins and 9,861 unauthorized trades, about ¥395 billion in sales and ¥347 billion in purchases (trading totals, not customer losses). In October 2025 the FSA amended its supervisory guidelines to require phishing-resistant MFA, with implementation due in principle by the end of June 2026. See Case Study - Japan Brokerage Account Takeovers (2025).
  • Generative AI has erased language barriers. Researchers tied the rise in phishing in Japan partly to AI-written, localized lures (see Generative AI and Deepfake Fraud).
  • What's next. As passkeys spread, expect pressure to move to account recovery, device enrollment, support channels and fallback factors. Expect it also to move to delegated credentials held by AI agents acting on a customer's behalf (see Agentic Commerce Fraud). A risk decision at the transaction still applies in every one of those cases.

Real-world examples

Sources and further reading