Account Takeover (ATO).

An attack in which a criminal gains unauthorised control of a legitimate user account and uses it to steal funds, data, or commit further fraud. It belongs to the Attacks & Threats category of cybersecurity.

An attack in which a criminal gains unauthorised control of a legitimate user account and uses it to steal funds, data, or commit further fraud.

Account takeover happens when an attacker obtains valid credentials, session tokens, or recovery channels for a victim's account, then logs in as that user. Common entry points include phishing, info-stealer malware, credential stuffing using leaked passwords, SIM swapping to intercept SMS codes, OAuth consent abuse, and weaknesses in account-recovery flows. Once inside, criminals exfiltrate data, drain wallets, redirect payroll, send phishing from trusted addresses, or pivot to other systems. Mitigations include phishing-resistant MFA (FIDO2/passkeys), device binding, anomaly-based login analytics, step-up authentication for risky actions, breached-password screening, and rapid session and token revocation when abuse is detected.

Defences for Account Takeover (ATO) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: ATO, Account compromise.