Account Takeover

Account takeover attacks typically begin outside the payment system. Attackers obtain credentials through phishing, credential stuffing (using username/password pairs leaked from other data breaches), brute force attacks on login endpoints, or social engineering. Once they have working credentials, they access the account and either transact directly with stored payment methods or extract card data and session tokens for use elsewhere.

From a payment perspective, ATO fraud presents as legitimate-looking transactions: the payment method is one the cardholder previously used, the shipping address may initially match historical orders before being changed, and the session originates from an authenticated account. Standard card-level fraud signals are less effective because the card itself is not stolen.

Behavioural signals in transaction data are the primary ATO detection layer in payments: account access from an unusual device or location, a password change shortly before a high-value transaction, a shipping address update preceding an order, or a change in purchase pattern (product category, order size, or velocity) all signal potential account compromise.

Device fingerprinting and step-up authentication are the main mitigations. When account activity deviates from established behavioural patterns, new device, unusual IP, changed profile fields, risk-based authentication challenges the user with a step-up (OTP, biometric, or email confirmation) before allowing high-value transactions.

ATO fraud bypasses card-level controls: because the attacker is using a legitimate account with authenticated payment credentials, fraud scoring based purely on card signals misses ATO. Account-level behavioural signals and device consistency checks are required.

Stored credential exposure amplifies losses: accounts with multiple stored payment methods, loyalty points, or store credit give ATO attackers multiple vectors for financial extraction. The value exposed is higher than a single stolen card number.

Chargeback costs are borne by the merchant: chargebacks from ATO fraud that result in unauthorised purchases are typically classified as fraud chargebacks, and liability falls on the merchant unless 3DS authentication was completed. Merchants with no step-up authentication on high-risk account actions have elevated exposure.

Password hygiene and authentication strength are outside merchant control but affect merchant risk: merchants who enforce strong passwords, support passkeys or MFA, and monitor login anomalies reduce their exposure to ATO significantly compared to those relying on email-plus-password authentication only.