The attack can lead users to lose trust in the FI and can impact consumer confidence and growth. The FI’s need to move fast to reduce the likelihood of the attack continuing / scaling and recover from the attack itself. These attacks can result in identity theft, credentials / OTP’s for attacking a login / recovery process and or personal information to increase the success of social engineering we cannot ignore the threat this poses.įrom a user perspective, these attacks might result in fraudulent payments to new beneficiaries and thus the loss of their savings, losing access to the account, as the attacker changes the authentication method such as registering a new device or changing the password.Īlso the attacker may apply for a new product using the customer’s personal data.įor financial institutions (FI’s), the impact of account takeover attacks can go well beyond financial losses. The attackers were able to perfectly emulate devices, breaking security relying on device fingerprinting and intercept the SMS OTP without the victim knowing. This results in personal data being available to attackers on demand, who can put it to use in an account takeover.Īttacks are becoming more advanced and automated, for example an emulation attack with malware which was executed in December 2020 resulting in millions of users accounts being attacked in hours, despite the bank using SMS one time passwords. They have more data to utilise, due to a record breaking 37 billion personal data records compromised in 2020 and more potential victims, companies and users that are new to digital services. lower risk of consequence and a fast movement by companies to try and offer digital services in reaction to the pandemic.Īdditionally, attackers have more tools than ever available from the underground market. These include obtaining data from data breaches, malware, phishing, and other social engineering attacks such as phone scams ( read more on common fraud techniques).Īccount takeover is increasing due to lower barriers of entry, high rewards.

The methods and techniques attackers use to fraudulently obtain access to a customer’s account credentials are continually evolving.

An account takeover occurs when a customer’s bank account is digitally ‘broken into’ and acted on by an attacker.

Financial Institutions (FI’s) can detect and prevent account takeover attacks using continuous monitoring and adaptive multi-factor authentication.Īccount takeover (ATO) fraud is one of the top causes of fraud losses for banks and financial institutions.

Fluid app fintech