Account takeover (ATO)

Account takeover is an attacker gaining control of a legitimate user's account, typically by stealing or resetting its credentials rather than exploiting software. Modern ATO chains combine leaked passwords, SIM swaps, and recovery-flow abuse so that every individual step looks like a normal user action; the fastest observed chains complete in under two minutes.

The chain structure is what defeats per-event detection. Each step, a login with valid credentials, a profile update, a recovery request, is unremarkable in isolation, and the signal is the sequence rather than any member of it. Systems that score events independently see nothing until the withdrawal.

It is also why response time matters more than detection accuracy past a point: a correct alert delivered after the transfer has settled changes nothing.

Because the chain is assembled from ordinary actions, the detection surface that works is the relationship between events rather than the events themselves. A login, a contact-detail change and a recovery request are each common; the same three inside ten minutes, following a change to the account's phone line, is a pattern with very few innocent explanations. Systems that evaluate each event against its own threshold cannot express that.

The economics also explain the shape of the defence. Attackers work at volume against many accounts and pick off the ones where a step succeeds, so the goal is not to make any single step impossible but to make the chain fail early and cheaply. A control that adds friction at the recovery step, where account recovery fraud concentrates, removes more chains than one added at login.

Speed is the constraint that decides what a response can be. When the interval between first access and completed transfer is measured in minutes, a queue that a human reviews is not part of the response path, and the revocation cascade has to run without waiting for anyone.