Protecting Yourself Against Account Takeover Fraud Attempts

Account Takeover, ATO, and Corporate Account Takeover, CTO, fraud is a type of identity theft where hackers assume unauthorized control of a person’s or a business’s online accounts, including banking, email, or social media, utilizing stolen credentials. Frequently, this fraud will involve making illegal purchases and locking the owner out of their accounts.

Both ATO & CTO cyber-attacks are serious and include financial loss and reputational loss. Key indicators of ATO & CTO account holders should be aware of include unexpected password change notifications, 2FA change notifications, log in from unknown devices, unexpected transactions, and missing emails.

Account takeovers can involve data breaches & credential stuffing, malware, SIM swapping, and phishing. In order. Staying vigilant is the best way to protect against Account Takeover. Below is a list of tips designed to help you stay safe in cyberspace.  

1.)   Be careful about the information you share online or on social media. Sharing information like a pet's name, schools you have attended, your date of birth, or information about your family members can give scammers the information they need to guess your password or answer your security questions.

2.)   Monitor your financial accounts regularly. Watch for irregularities, such as missing deposits or unauthorized withdrawals, wire transfers, or expenditures. Always use unique, complex passwords and make sure each account has its own unique password. Do not use family birthdays, pets' names, or other easy-to-obtain personal information. Ideally, a password should be at least 12-15 characters in length, include at least one capital letter, one number, and, where permitted, a symbol.

3.)   Enable two-factor authentication or Multi-Factor-Authentication (MFA) on any accounts possible and never disable it.

4.)    Use Bookmarks or Favorites for navigating to login websites. Avoid clicking on Internet search results or advertisements. MFA will not protect you if you land on a fraudulent login page. Carefully examine any email address, URL, or spelling in unsolicited correspondence.

5.)   Be aware of phishing attempts. Be suspicious of unknown "banking" or "company" employees who call you; do not trust the caller ID. Hang up, verify the correct number, and call it yourself. Companies do not contact you to ask for your username, password, or One-Time Password (OTP). Never give out your identifying information, passwords, or Social Security numbers to callers you do not know or have not verified.

The use of these best practices will help protect you from account takeovers.