Account takeovers represent a multi-billion dollar threat… and it’s only getting worse with time. From cardholders and merchants to the banks that back them, virtually everyone in the payments space is harmed. In this article, we’ll examine how this single type of fraud can create a painful ripple effect across the entire industry.
An Overview of the Impact of ATO Attacks
Roughly 29% of US adults have been a victim of account takeover attacks. To put that in perspective, that’s about 77 million people, or nearly double the population of California, the nation’s most populous state.
83%
of Fortune 1000
companies have experienced at least one account takeover attack
Fraud losses stemming from account takeovers are on the rise. 62% of businesses say account takeover attacks are costing them more money than in the past. But, that’s not to say that account takeover fraud was ever a trivial issue.
Back in 2020, US merchants lost $25.6 billion to account takeovers; up 500% from 2017. And, by 2028, merchants are expected to lose a staggering $91 billion to account takeover fraud.
In this article, I’ll provide a closer look at the financial impacts of account takeovers and discuss how this type of fraud harms merchants, banks, and cardholders.
The Dollar Total of Account Takeover Losses
It’s little secret that account takeovers are a significant and growing threat. As digital life and fraud tactics both getmore complex, account hijackings are becoming more common. These statistics offer some food for thought:
Impact:
$38
billion
was lost by merchants to account takeover attacks in 2023.
The average business maintains 87 online accounts. This, combined with the fact that merchants often have more financial resources than individual cardholders, makes businesses those prime targets for account takeover attacks. Every time an attack occurs, merchants may experience:
Chargebacks
When a fraudster uses a compromised account to make a purchase, the merchant — not the cardholder — is often the one who ultimately pays the price. After the legitimate accountholder regains access to their account, they can file a criminal fraud chargeback with their issuing bank. When this happens, the merchant loses out on revenue from the sale as well as the value of any products shipped. To add insult to injury, the merchant is also hit with a chargeback fee, which can range from $20 to $100 per incident.
Reputational Damage
Trust is difficult to build and easy to break. Even a single account takeover attack can destroy the confidence customers have in a merchant. Following the incident, cardholders may take their business elsewhere and spread negative word-of-mouth, which can deter new customers and damage the merchant’s brand.
Higher Operational Costs
An account takeover attack can do damage even after the fraudsters are long gone. In the aftermath of an attack, merchants will have to investigate the attack and invest in more robust security measures. The business’s customer service team may have to handle inquiries from distressed customers. These unforeseen expenses can strain a merchant's resources and elevate operating costs.
How Account Takeovers Impact Financial Institutions
Account takeover attacks can also directly impact banks. When this happens, financial institutions can experience substantial fallout, including:
Significant Financial Liability
In many cases, banks are legally obligated to reimburse customers for any unauthorized transactions. This direct financial liability — especially in the case of large-scale or high-value account takeovers — can mean substantial losses for the financial institution.
Loss of Customer Confidence
Most customers might think twice about keeping their money at a bank that was just targeted by a high-profile series of account takeover attacks. That’s why this type of fraud is so damaging: even if the actual financial losses are limited, the subsequent loss of customer confidence — and with it, deposits and revenue — can be severe.
Higher Security Costs
Like merchants, financial institutions will have to do a significant amount of cleanup work every time they experience an account takeover. At a minimum, a bank will have to investigate the attack, deploy additional fraud detection and prevention tools, handle customer inquiries, and potentially even respond to queries from banking regulators.
How Account Takeovers Impact Cardholders
Of course, cardholders are impacted too. Even though individuals may be protected by $0 fraud liability guarantees by their banks, they’re still harmed in other ways. Negative impacts include:
Financial & Data Loss
Fraudsters who lose money as a result of an account takeover can usually petition their financial institution for some form of financial relief, but the process can be slow and stressful. That doesn’t account for the loss of personal data, though. Every account takeover attack enables fraudsters to gain access to a treasure trove of personally identifying information, which can be used for further identity theft, taking out loans, or opening new lines of credit. It could also be sold on the dark web.
Time & Effort to Resolve
Reclaiming a compromised account isn’t a walk in the park. On the contrary, it’s a time-consuming, frustrating, and stressful process for cardholders. Individuals may have to make multiple phone calls to their bank, get in touch with the merchant’s customer service team, file lengthy police reports, change passwords for dozens of online accounts, and monitor their credit reports for any further suspicious activity.
Anxiety About Future Attacks
Being the victim of an account takeover can be an emotionally taxing experience. Whether physical or digital, theft can leave cardholders feeling violated, create fear and anxiety about future potential attacks, and erode a cardholder's sense of security.
