You might think of online fraud as someone stealing your credit card number or making a purchase you didn’t authorize. But another growing threat goes a step further: account takeover fraud.
Account takeover happens when a scammer gains access to one of your online accounts and begins using it as if they were you. That could be an online banking account, email account, payroll account or even a social media profile.
How Does an Account Takeover Happen?
Scammers have several ways to get the information they need. They may:
- Send a phishing email or text that leads to a fake login page.
- Pretend to be from your bank, a company’s customer service department or technical support.
- Use usernames and passwords exposed in a previous data breach.
- Take advantage of passwords that are weak or reused across multiple accounts.
- Convince you to provide a one-time security code or multi-factor authentication code.
Once inside an account, a scammer may change the password, transfer money, redirect a paycheck or use information they find to access other accounts.
Protect Your Accounts
A few simple habits can make your accounts much harder to take over:
Use a unique password for every important account. If one password is compromised, scammers won’t automatically have access to your other accounts.
Turn on multi-factor authentication. This adds another layer of protection beyond your password.
Never share a verification code. If someone calls, texts or emails asking for a one-time passcode or security code, don’t provide it.
Be careful where you log in. Instead of clicking a link in an unexpected email, text, online ad or search result, use a saved bookmark or type the website address yourself.
Watch your accounts. Unexpected password-reset emails, unfamiliar login alerts, missing deposits or transactions you don’t recognize can all be warning signs.
If Something Doesn’t Look Right, Act Quickly
If you believe someone has gained access to a financial account, contact your financial institution right away. Change any compromised passwords — including anywhere else you may have used the same password — and continue monitoring your accounts closely.
When it comes to account takeover fraud, catching suspicious activity quickly can make a big difference.