TLDR: Account takeover (ATO) fraud is when an attacker gains control of a legitimate user account and operates as that user. It usually starts with stolen credentials from phishing, credential stuffing, or infostealer malware. The reason ATO is so damaging is that everything the attacker does afterward looks legitimate, including the email they send from the compromised account.
Once an attacker is operating inside a real account, they aren’t an intruder anymore (at least not to your systems). They authenticate correctly. They pass MFA because they got past it. Their email sends from a real mailbox with valid SPF and DKIM.
Everything downstream of an account takeover (ATO) looks legitimate because technically it is.
Fortunately, you can do something about it.
Below, we cover everything you need to know about account takeover: how attackers get in, what they do once they’re there, signals to monitor, and the controls that hold up.
What is account takeover fraud?
Account takeover fraud (ATO) is the unauthorized access and use of a legitimate account by an attacker. Rather than creating a fraudulent account or breaching a system directly, the attacker acquires valid credentials and operates as the account holder.
ATO is different from identity theft. Identity theft is the fraudulent use of someone’s personal information to open new accounts or lines of credit. Account takeover uses accounts that already exist. Both are damaging, but ATO is typically faster to execute and harder to spot. That’s because there’s no new account creation event to flag.
In an enterprise context, the accounts that matter most are corporate email, single sign-on identities, and any system tied to payment authorization. A compromised Microsoft 365 or Google Workspace account is often the highest-value target available because it’s the key to nearly everything else.
How attackers take over accounts
The initial compromise almost always comes from one of a handful of methods.
- Credential phishing. The most common entry point. A convincing email drives the target to a fake login page, and the credentials get harvested in real time. Modern phishing kits proxy the login session, which means they capture the MFA code as well as the password.
- Credential stuffing. Attackers take username and password pairs from previous breaches and test them at scale against other services. It works because password reuse is still a problem. Nothing is cracked here, though. The credentials are just already known.
- Infostealer malware. Malware on an endpoint harvests saved browser credentials, session cookies, and authentication tokens. Stolen session cookies can let an attacker skip authentication entirely (MFA included).
- MFA fatigue and prompt bombing. The attacker has the password and repeatedly triggers push notifications until the user approves one out of confusion or irritation. Simple, and it works more often than most teams expect.
- Adversary-in-the-middle (AiTM) attacks. A proxy sits between the user and the real login page, relaying credentials and session tokens in real time. This defeats most MFA implementations because the attacker captures the authenticated session rather than the credentials alone.
- SIM swapping. The attacker convinces a mobile carrier to port the victim’s number to a device they control, intercepting SMS-based one-time codes. This is why SMS is the weakest common MFA factor.
- Help desk social engineering. The attacker calls IT support, impersonates an employee, and talks their way into a password or MFA reset.
What happens after an account takeover
The initial compromise is rarely the objective. It’s the position the real attack runs from.
The attacker starts by reading the mailbox. Vendor relationships, payment processes, approval chains, who’s on holiday, which invoices are outstanding. Corporate email is a detailed map of how a business operates, and a patient attacker will spend weeks studying it before doing anything visible.
Next come hidden inbox rules, a near-universal marker of email ATO. The attacker creates rules that auto-delete or auto-file replies, security alerts, and messages. The legitimate user simply stops seeing the evidence.
Then the attack turns outward. Internal phishing sent from the compromised account arrives from a real internal address, passes every authentication check, and carries the trust an internal sender gets by default. Recipients have almost nothing to evaluate.
From there, it’s usually business email compromise: The attacker inserts themselves into a live payment thread (or opens a new one) matching the tone and format of months of prior correspondence they’ve already read.
The last stage is persistence. Attackers register their own MFA device, create OAuth application grants, or add alternate recovery addresses so access survives a password reset.
Red flags: How to detect account takeover
Detection is where most ATO programs are weakest. The attacker’s behavior looks like user behavior, so the typical signals don’t fit a normal working pattern.
| ATO signal | What it usually indicates |
| Impossible travel between logins | Credentials or session token in use by a second party |
| New inbox rules that delete or forward mail | Attacker hiding replies and security alerts |
| Unfamiliar MFA device registered | Persistence, so access survives a password reset |
| Unexpected OAuth application grant | Mailbox access that outlives a credential change |
| Login from unusual ASN, device, or user agent | Session hijack or credentials used from attacker infrastructure |
| Sent items the user doesn’t recognize | Outbound phishing or BEC already in progress |
| Several colleagues report suspicious mail from one internal sender | Active internal phishing from a compromised account |
| Surge in failed authentications across many accounts | Credential stuffing in progress, ahead of any successful takeover |
Inbox rule creation and OAuth grants are the two highest-signal, lowest-noise detections on this list, and they’re the two most often left unmonitored.
Account takeover prevention playbook
There’s no one-size-fits-all approach to account takeover prevention. If there was, there’d likely be the scammers equivalent to overcome it. Instead, we’re going to talk about principles and fundamentals you can implement to protect your business.
Layer these. No single control covers ATO, and most programs fail by over-investing in one layer while leaving another wide open.
- Deploy phishing-resistant MFA. FIDO2 security keys and passkeys are cryptographically bound to the legitimate domain, so they won’t authenticate against a proxy or a fake login page. This one change defeats AiTM attacks, credential phishing, and MFA fatigue at once. Push and SMS-based MFA don’t. If you make a single change from this list, make it this one.
- Enforce conditional access. Gate authentication on device compliance, network location, and risk score. A login from an unmanaged device in an unexpected country should trigger step-up authentication or a block.
- Shorten session lifetimes for sensitive applications. A stolen session token is only useful while the session is valid. Long-lived sessions hand attackers a much wider window.
- Monitor for credential exposure. Track breach corpora and infostealer dumps for your domain. Force resets on exposed accounts before anyone else gets to them.
- Alert on inbox rule creation and OAuth grants. High signal, low noise, and frequently unmonitored. Email ATO usually leaves fingerprints here first.
- Harden the help desk. Require identity verification that can’t be talked around before any credential or MFA reset. Call-back to a number on record, manager approval, or in-person verification for privileged accounts.
- Cut off the phishing that starts the chain. ATO tends to begin with credential phishing, and most of that phishing impersonates a trusted domain. DMARC at enforcement blocks messages spoofing your domain outright, removing one of the most effective pretexts attackers use against your employees, customers, and partners. Pair it with monitoring for lookalike domains.
- Train for behavior. Content-based phishing detection is losing ground as AI-generated phishing improves. Teach people to verify unusual requests out of band no matter how legitimate a message looks.
- Write the response playbook before you need it. Revoke all passwords, sessions, and tokens. Audit and remove attacker-created inbox rules, MFA devices, and OAuth grants. Review sent items for outbound phishing and notify affected recipients. Check for lateral movement into connected systems.
What DMARC does and doesn’t do for ATO
What DMARC does: It stops attackers from sending email that appears to come from your domain when they don’t control it. That’s the mechanism behind a large share of credential phishing, aimed at your own employees and at your customers and partners. At p=reject, those messages never arrive. Fewer credential phishing messages reaching inboxes means fewer successful harvests, and less ATO downstream.
What DMARC doesn’t do: It doesn’t stop a compromised account from sending. When an attacker controls a real mailbox, their mail is legitimately authenticated. It passes SPF, passes DKIM, aligns correctly, and satisfies DMARC completely. From a protocol standpoint it’s genuine mail from an authorized sender, and no email authentication standard is designed to catch that.
That gap is why ATO needs identity controls, session management, and behavioral detection sitting alongside authentication. DMARC reduces the inflow, but it has nothing to say about the account that’s already compromised.
Start protecting your business from ATO attacks
Start with the inflow. It’s measurable, and it’s usually the least-defended layer.
Valimail Monitor is free and shows every service sending email as your domain, by name. It’s how you find out whether your domain is currently being used in the phishing that leads to takeover. Check your domain for your current authentication status.
Then work the identity layer:
- Phishing-resistant MFA
- Conditional access
- Alerting on inbox rules and OAuth grants
Those changes close most of the realistic attack paths.
Frequently asked questions
What is the difference between identity theft and account takeover?
Identity theft uses stolen personal information to open new accounts or lines of credit in someone’s name. Account takeover uses accounts that already exist, with the attacker gaining access to a legitimate account and operating as its owner. ATO is typically faster and harder to detect, since no account creation event triggers a review.
What are the red flags for account takeover?
The strongest signals are impossible travel between logins, newly created inbox rules that delete or forward mail, and logins from unusual devices or hosting-provider IP ranges. Also, check multiple colleagues reporting suspicious emails from the same internal sender.
Does MFA stop account takeover?
It depends on the factor. SMS and push-based MFA are bypassable through SIM swapping, MFA fatigue, and adversary-in-the-middle proxies that relay codes in real time. Phishing-resistant factors like FIDO2 security keys and passkeys are cryptographically bound to the legitimate domain and won’t authenticate against a proxy—this makes them much more effective against ATO.
