{"id":18054,"date":"2021-02-04T06:00:24","date_gmt":"2021-02-04T14:00:24","guid":{"rendered":"https:\/\/www.trulioo.com\/?p=18054"},"modified":"2023-08-01T16:27:05","modified_gmt":"2023-08-01T16:27:05","slug":"account-takeover-fraud","status":"publish","type":"post","link":"https:\/\/www.trulioo.com\/blog\/fraud-prevention\/account-takeover-fraud","title":{"rendered":"Account takeover fraud \u00ad\u2014 Protecting your accounts and your customers"},"content":{"rendered":"\n
\"Account<\/figure>\n\n\n\n

Our economic lives are increasingly digital. Bank, credit and crypto accounts are often online, as are numerous other services. Research from NordPass indicates the average person has over 100 passwords<\/a> for various sites and services. Unfortunately, these accounts are prime targets for fraudsters who use different account takeover fraud techniques to gain access to funds or to obtain the personal information needed to commit other fraudulent activity.<\/p>\n\n\n\n

Considering the value of online accounts, the number of global accounts and the speed that an ATO can access funds, account takeover fraud is one of the most severe forms of fraud today. According to Sift, account takeover attempts are up 228% <\/a> from Q2 2019 to Q2 2020, while NuData noted $6.8 billion was lost to account takeover fraud<\/a> in 2019 in the U.S. alone.<\/p>\n\n\n\n

Ensuring your organization has effective fraud prevention measures<\/a> to protect your corporate accounts and customer accounts from account takeover attacks is essential to avoid financial losses, reputational damage and customer churn.<\/p>\n\n\n\n

What is account takeover fraud?<\/h2>\n\n\n\n

Account takeover fraud involves fraudulently taking control of an account to access funds, perform unauthorized transactions, or gain entry to other accounts.<\/p>\n\n\n\n

If not stopped, funds in a compromised online account are often quickly drained. As many people use repeat passwords, the fraudster can also try to take over other accounts. Or, the account itself might provide access to other linked services, like an email account. For example, SIM-swap fraud<\/a> enables fraudsters to access a mobile device, providing access to email and other personal accounts and allowing the fraudster to takeover other accounts.<\/p>\n\n\n\n

Businesses are also vulnerable. Corporate account takeovers amplify the fraud risk, as these accounts can hold significant funds and provide access to numerous customer profiles and confidential information. In one case, a global hotel brand had a data breach that exposed over five million customer records<\/a>; the hackers were able to get hold of information by attaining employee credentials.<\/p>\n\n\n\n

Preventing account takeover attacks<\/h2>\n\n\n\n

As with all fraud prevention measures, proper tools, training and ongoing diligence will help protect your organization. As there are many ways that fraudsters can get hold of accounts, there\u2019s no one \u201cmagic\u201d solution. Rather, layering in various social and technological processes helps reduce fraudsters\u2019 opportunities and mitigate any damage if they gain access.<\/p>\n\n\n\n

Effective onboarding<\/strong><\/p>\n\n\n\n

The onboarding stage, when you gather initial account information, is an opportunity to prevent fraud before it even starts. Verifying that a customer is who they say they are helps limit the opening of illegitimate accounts. The same applies to employees, suppliers, business partners and anyone with whom you\u2019re doing business.<\/p>\n\n\n\n

The information can also be analyzed at different points of the relationship to revalidate<\/a> the account. Does the information they provided sync with information on record? If not, is there a good reason for any discrepancies? Depending on the type and quantity of data collected at onboarding, there are many ways to determine legitimacy.<\/p>\n\n\n\n

\"Account<\/figure>\n\n\n\n

ID document verification<\/a> can gather evidence of government-issued identity, as well as biometric information. The customer should be able to provide this evidence again if requested. It\u2019s important to note that storing biometric data is especially sensitive and might not be permissible, depending on the jurisdiction.<\/p>\n\n\n\n

MobileID<\/a> information such as device, geolocation, usage and billing data provide numerous data points that are difficult for fraudsters to produce. This information is metadata, so it doesn\u2019t require the user to provide it, enabling a more friction-free check.<\/p>\n\n\n\n

If you need to verify an organization, you can use business verification<\/a> to verify information like:<\/p>\n\n\n\n