By Sarah Beldo, Sift Science
You may have heard that account takeover (ATO) is on
the rise for all types of companies, from e-Commerce merchants to SaaS
businesses. The first step to protecting your business is understanding the
problem. Let’s take a look at why ATO is growing.
What Is Account Takeover?
ATO, also known as account compromise, is just what it
sounds like: a bad actor getting access to a good user’s account. Once that
access is achieved, the fraudster can use the account for all kinds of
opportunistic and malicious ends. As part of the ATO, the fraudster may change
the user’s password to lock them out, and change their email address so the
good user doesn’t receive any additional communication about activity on their
account.
Advertisement
Some of the ways fraudsters profit from ATO include: using
up stored credits or rewards points, making high-value
purchases, buying digital goods, scamming other users and
phishing, creating fake listings, spamming, selling the
credentials on the black market, extorting money from the legitimate
account owner and assuming the identity of the real user.
Why Are Fraudsters Attracted
To ATO?
ATO can be more profitable than credit card fraud. First of
all, many businesses do not have a robust solution in place for stopping ATO,
so the window of time for exploiting the information before detection is
typically longer. Furthermore, a credit card can only be used until it’s
canceled. But even once an ATO is discovered, the fraudster still has access to
the credentials or personal information, which can be used to create a new fake
account or a synthetic identity.
ATO also provides fraudsters with the advantage of built-in
trust. New accounts are more likely to be flagged for fraud or given more
scrutiny. If the account already exists and is connected to a legitimate user,
the fraud is more difficult to detect and the fraudster has more time to
operate before they are discovered.
The Era Of Data Breaches
According to the Sift Science Fraud-Fighting Trends report, 48% of
online businesses observed a rise in ATO last year. How did ATO gain such
traction over the past few years? You need only look at the big cybersecurity
headlines to get a clue. We’ve entered the era of the data breach.
From Equifax to Yahoo, from eBay to Tesco Bank, the scale
and sophistication of breaches is growing. Some 554 million records were
compromised in the first half of 2016 alone, according to the Gemalto Breach
Index. The downstream effect of more data breaches? A rise in ATO. With 59%
of people reusing passwords on multiple sites, it’s easier than ever for
criminals to leverage all of the data available on the dark web to cash out.
Latest Trends In ATO
Like so many other types of fraud, ATO is increasingly
committed at scale by bots, as well as manually. Hackers write scripts that
test various combinations of stolen usernames plus potential passwords across
multiple web sites and apps, until they find a way in. These brute force
attacks are helping fraudsters move as quickly as possible and focus on
maximizing the value of each successful ATO. Researchers at Shape Security
found that criminals can have as much as a 2% success rate by using these
automated attacks.
Want to learn more about how to prevent ATO? Download our
free e-book, The
Complete Guide to Preventing ATO.
Sarah Beldo is the
Communications Manager for Sift Science, a trust platform that offers a full suite of fraud and abuse
prevention products designed to attack every vector of online fraud for
industries and businesses across the world.
