What is account takeover (ATO)?

One of the most concerning forms of cyber attacks is an account takeover (ATO), where hackers gain unauthorized access to an individual's or organization's account for personal gain or malicious purposes. 

What is an account takeover?

An account takeover occurs when a hacker successfully infiltrates and gains control over someone's account. The ultimate objective is to misuse the account for personal gain or to cause harm to the account holder or the organization. 

Motives behind account takeovers

Fraudsters have different motives when executing account takeover attacks. By gaining unauthorized access to an account, they can assume the account holder's identity and engage in various malicious activities. These can include financial fraud, identity theft, vandalism, or even leveraging the account as part of a broader cyber attack campaign.

Related: What is an impersonation attack?

Targets of account takeover attacks

While anyone can become a victim of an account takeover attack, certain types of accounts are more frequently targeted by hackers:

Financial accounts

Financial accounts, such as bank accounts and credit cards, are prime targets for hackers. Fraudsters can steal money, make unauthorized purchases, or manipulate investment portfolios by gaining control over these accounts.

Travel accounts

Hackers may attempt to take over travel accounts, particularly those associated with frequent flyer programs. They can exploit accumulated rewards or sell them for profit by gaining access to these accounts.

Retail accounts

Hackers often target online retail accounts to make fraudulent purchases using stolen payment information. They may use the compromised account to buy products for personal use or sell them to other fraudsters.

Government benefit accounts

Accounts that provide government benefits, such as Medicare or Social Security, can be lucrative targets for fraudsters. By taking control of these accounts, they can redirect benefits to their own accounts or sell the account information on the black market.

How does an account takeover happen?

Account takeover attacks typically follow a series of steps, which include:

Compromising user credentials

Hackers often exploit weak passwords or reuse passwords across multiple accounts. They may obtain stolen password lists from data breaches or employ phishing techniques to trick users into revealing their login credentials.

Testing credentials

Once hackers obtain a set of credentials, they will test them to determine their validity. This can be done manually, but automated bots are increasingly used to rapidly test multiple accounts simultaneously.

Utilizing or selling credentials

Once hackers confirm the legitimacy of credentials, they can use them for personal gain or sell them to other cybercriminals. The price of credentials varies based on the type of account and its potential value.

Accessing higher-value accounts

In some cases, hackers may use compromised credentials to access accounts with greater value. For example, gaining control over an email account can enable them to request login credentials or change usernames and passwords across various platforms.

Account takeover techniques

Fraudsters employ a variety of techniques to execute account takeover attacks. Some of the most common methods include:

Credential stuffing

Credential stuffing is a brute-force attack where hackers use different combinations of usernames and passwords until they find a valid set. This technique relies on users reusing passwords or using weak passwords across multiple accounts.

Phishing

Phishing attacks often serve as the starting point for account takeovers. Hackers trick users into revealing their account credentials by posing as legitimate entities through emails, websites, or messages.

Malware

Malware, such as keyloggers or Trojans, can be used to capture login credentials. Keyloggers track user keystrokes, while Trojans masquerade as harmless files but install malicious software to steal personal data.

Mobile banking trojans

Mobile banking trojans employ fake screens overlaid onto legitimate banking applications, capturing users' login information. These Trojans can also alter transaction data, redirecting funds to the hacker's account.

Man-in-the-middle (MITM) attacks

In a man-in-the-middle attack, hackers intercept the communication between a user and their intended destination. This allows them to collect sensitive information, such as login credentials, from unsuspecting users on insecure networks.

Account takeover prevention and protection

Implementing the following measures can significantly reduce the risk of account takeover attacks:

Education

Educating users about account takeover techniques and the importance of strong, unique passwords is paramount. Encourage regular password changes, particularly after data breaches, to prevent attackers from exploiting compromised credentials.

Two-factor authentication (2FA)

Enabling two-factor authentication adds an extra layer of security to user accounts. It requires users to provide a second form of identification, such as a unique code sent to their mobile device, in addition to their password.

Sandboxing

Sandboxing is an effective technique to prevent malware from spreading within a network. It isolates potentially harmful files or applications, restricting their ability to cause damage.

Real-time fraud detection

Implementing a real-time fraud detection system provides visibility into user activity before, during, and after transactions. It enables immediate identification of suspicious behavior and proactive measures to prevent account takeovers.

In the news

A coalition of 41 US state attorneys general demanded Meta address a rise in Facebook and Instagram account takeovers. Since 2022, user complaints about account takeovers and lockouts have surged, with New York reporting a more than tenfold increase by the end of 2023. The AGs suggest this spike may be linked to Meta's layoff of 11,000 employees in November 2022. Issues like phone number recycling, where old numbers linked to accounts are reassigned to new users, exacerbate the problem. The AGs indicated financial risks, including fraudulent charges on linked credit cards, and urged Meta to enhance its security measures and customer response. While Meta acknowledges the issue, it attributes responsibility to telecom providers and states it invests heavily in account security and user education.

FAQs

What is account takeover and how does it relate to healthcare security? 

Account takeover occurs when an unauthorized individual gains control of a legitimate user’s account, often through phishing, credential theft, or other malicious activities. In healthcare, account takeover can lead to unauthorized access to protected health information (PHI), disruption of healthcare services, and breaches of patient confidentiality.

Why is account takeover a concern for HIPAA compliance in healthcare settings? 

Account takeover is a concern because it can result in unauthorized access to PHI, data breaches, and operational disruptions. These outcomes can lead to HIPAA violations, financial penalties, and damage to the organization’s reputation for failing to safeguard patient information.

What are the potential risks associated with account takeover under HIPAA? 

• Data breaches: Unauthorized access to and theft of patient records and sensitive medical data.
• Fraudulent activities: Conducting unauthorized transactions or sending fraudulent communications from compromised accounts.
• Service disruption: Interruption of healthcare services and access to medical systems.
• Data corruption: Alteration or deletion of healthcare information.
• Financial losses: Costs associated with breach remediation, legal penalties, and potential restitution for affected patients.

See also: HIPAA Compliant Email: The Definitive Guide