Understanding How Account Takeover Fraud Happens
Within hours of stealing login credentials, a criminal can drain a bank account, lock out the legitimate owner and vanish without a trace. This is account takeover fraud, and it continues to be a growing threat.
This module will walk you through several scenarios involving the use of credential stuffing, social engineering, malware, compromised email accounts and other methods to gain unauthorized access to financial accounts and extract funds.
Increased understanding of how these tactics are used in combination can help financial institutions protect their customers against account takeover.
Watch this video series and read through the resources below for more insights.
Account Takeover Fraud Scenarios
Explore these resources for additional information on account takeover scenarios.
| Resource | Format | Reading Time |
|---|---|---|
| Data Breach + Bank Impostor Scam (PDF) | Document | 3 minutes |
| Data Breach + Bank Impostor Scam Scenario (Off-site) | Video | 2 minutes |
| Malware (PDF) | Document | 2 minutes |
| Personal Email Compromise (PDF) | Document | 2 minutes |
| Social Media Information + SIM Swap (PDF) | Document | 3 minutes |
| Social Media Information + SIM Swap (Off-site) | Video | 2 minutes |
Explore the toolkit modules below for resources to help understand account takeover fraud.
The account takeover fraud mitigation toolkit was developed by the Federal Reserve to help educate the industry about account takeover fraud and outline potential ways to help detect and mitigate this fraud type. Insights for this toolkit were provided through interviews with industry experts, publicly available research, and team member expertise. This toolkit is not intended to result in any regulatory or reporting requirements, imply any liabilities for fraud loss, or confer any legal status, legal definitions, or legal rights or responsibilities. While use of this toolkit throughout the industry is encouraged, utilization of the toolkit is voluntary at the discretion of each individual entity. Absent written consent, this toolkit may not be used in a manner that suggests the Federal Reserve endorses a third-party product or service.