Account takeover fraud happens when someone other than the owner gains control of an existing account and then uses it as the owner.
The account already existed, which separates this case from a brand new account opened under a false identity.
How it works
After a mailbox password is reused on a bank site, the intruder changes the recovery email and orders a transfer to a new beneficiary.
The real customer still sees the old balance until the bank statement or a failed login reveals the change.
Savings can leave the account, loyalty points can be spent, and the mailbox can be used to reset still more services.
The customer then spends days proving ownership while bills and messages go to the intruder.
Concrete examples
- A streaming account is taken over and the recovery address is changed before the family notices new devices.
- A marketplace seller finds payouts redirected to a bank account they do not recognize.
- A webmail login from another country is followed within minutes by password resets at the energy supplier and the shop.
Protective measures
- Turn on a second sign in check for the bank and the mailbox, and do not reuse the same password on both.
- Send the customer an alert when the recovery address, the phone, or the payout account changes.
- Freeze transfers to a new beneficiary for a waiting period that a real customer can cancel from a known device.
- Give the support desk a way to restore the original owner without trusting only the email address that the intruder now controls.
How CDPCaptcha helps
A browser proof of work check requires computing work before each automated sign in attempt is accepted, which raises the cost of trying many passwords against one bank login.
CDPCaptcha is a self-hosted proof of work check in the browser, with no cookies, no tracking, and no picture puzzles.
It is made and hosted in the EU, in Germany, and the service is described at https://cdpcaptcha.com/.
Related articles
Readers who want more on an existing bank login should open What is ad fraud? next.
For day to day work on an existing bank login, add What is an OTP bot? to the same reading list.
People who look after an existing bank login compare this explanation with What is anti botnet defense?.