Common Account Takeover TacticsWhat Maneuvers are Scammers Using to Separate You From Your Revenue?
In a Nutshell
A strong password is better than nothing. But, that’s often not enough. Using a deep bag of tricks, ranging from sophisticated malware to simple social engineering tactics, fraudsters can steal your credentials and crack open your accounts, even as you remain blissfully unaware. This article pulls back the curtain on the varied tactics attackers use, showing you exactly how they get their hands on your login credentials.
Why Passwords are Not Enough to Stop ATO Tactics
A robust username and an eight-to-twelve character password with a combination of numbers, symbols, and uppercase and lowercase letters must be safe…right?
Worryingly, the answer is no; especially if you re-use your usernames and passwords. As an unfortunate example, consider this: it’s likely that every single American’s social security number (SSN) has been leaked in some form or another.
If your most sensitive personally identifying information isn’t safe, you shouldn’t assume that any of your other accounts are under secure lock and key.
Why? The simple answer is that fraudsters have so many ways they can steal login credentials. And, once in possession of just a single username and password combination, they can go on a rampage and potentially compromise dozens of accounts. In this article, we’ll examine how attackers take over accounts.
How do Fraudsters Take Over Accounts?
Every account takeover attack begins with stolen login information. Attackers have plenty of dirty tactics up their sleeves; some of which these bad actors can use in combination with one another to carry out more sophisticated data heists.
Common account takeover tactics include:
How it Works:
Phishing refers to any practice by which a fraudster tries to trick individuals to reveal personal information, such as passwords and credit card numbers. This can be done through emails purporting to be from reputable sources, dummy sites, etc.
Best Defense:
Merchants should require users to complete two factor authentication when they log in from a new device or add a new payment method. Consumers can protect themselves by adding similar methods (see the “Layer Up” subsection below).
How it Works:
A fraudster contacts a user’s mobile carrier, telling them they have a new device. The fraudster then uses stolen credentials to gain access to accounts they wish to use, but is able to subvert the two-step authentication process by tricking device fingerprinting methods.
Best Defense:
If a cardholder’s personal details are accessed by someone in another region, or they are suddenly unable to access certain accounts, they should change their credentials immediately. Never reuse credentials on multiple sites. If the device they typically use to access sites is no longer recognized, they should contact their mobile provider immediately.
How it Works:
Most often, malware is injected into a user’s computer through faulty apps, unsecured sites, or through hardware that is inserted into a drive. The malware then tracks keystrokes or other activity to capture login credentials.
Best Defense:
Cardholders should ensure their systems are secure and that they follow security best practices online. For merchants, your employees should only access necessary data through secured networks.
How it Works:
Most often, malware is injected into a user’s computer through faulty apps, unsecured sites, or through hardware that is inserted into a drive. The malware then tracks keystrokes or other activity to capture login credentials.
Best Defense:
Cardholders should ensure their systems are secure and that they follow security best practices online. For merchants, your employees should only access necessary data through secured networks.
How it Works:
This attack is a lot like eavesdropping. A fraudster will position themself between your data and its reception point on a network in order to redirect that information or payment elsewhere.
Best Defense:
Cardholders should never transmit sensitive information via public Wi-Fi. Also, savvy merchants provide secured Wi-Fi networks for all in-house use, including any that might be consumer-facing.
How it Works:
Brute force attacks involve a fraudster bombarding your firewalls and system checks with a bevy of passwords all at once. The goal is to gain a keyword that might crack the whole system. The attack will often persist until the password is accepted or the keyword is revealed.
Best Defense:
Merchants should budget for strong anti-virus and password management software.
