Account takeover is an access problem and a fraud problem

How access is gained

Common paths include phishing, password reuse, credential stuffing, malicious account recovery, session-token theft, malware, and social engineering against support staff. The initial login may look valid because the attacker is using real credentials or a still-valid session.

What the attacker changes

Useful signals often appear in sequence: a new device, an unusual recovery action, contact-detail changes, a new payee, high-risk purchase, rapid profile edits, or attempts to suppress notifications. No single signal proves fraud. The combination, timing, customer history, and requested action matter.

Recovery has more than one step

Resetting a password may not end access if sessions, tokens, linked applications, recovery methods, or email accounts remain compromised. A sound response restores the real user, invalidates unauthorized access, reviews changes and transactions, preserves evidence, and improves the control that failed.

Separate access evidence from fraud outcome

A new device, location or payee can be useful context without proving that the real customer was absent. Review the sequence, corroborating signals and customer report under the organization’s policy. The goal is to restore the legitimate user, stop unsafe actions and preserve enough evidence to explain the decision—not to turn one anomaly into a permanent identity judgment.

Example: the password reset did not end access

A user changes a password after noticing an unfamiliar purchase, but the attacker continues through a stolen session and adds a new recovery address. The case requires session revocation and review of recovery and delegated access, not another password change alone. The sequence also shows why a fraud outcome can be the first visible symptom of an earlier access event.

Restore the person as well as the account

A safe recovery path confirms the legitimate user with proportionate evidence, removes attacker-controlled changes and explains what actions were reversed or remain under review. Collect only the information the organization is authorized to use. High-friction recovery can compound the harm, while weak recovery can reopen access; the control needs measured outcomes on both sides.