Account takeover rate tracks how often existing accounts are successfully seized, using a denominator such as attempts or active accounts that the team defines.
It is a measurement of outcomes, not a description of any single method used to enter an account.
How it works
Leaders use the rate to see whether identity defenses are improving or slipping over a chosen period.
Comparing the rate across products only helps when each team states the same kind of denominator and the same success rule.
A rising rate can reflect more stolen passwords in the wild, weaker checks, or simply a broader way of counting.
Pair the number with loss amounts and customer harm so a small rate on high value accounts is not ignored.
Concrete examples
- A bank reports how many online banking logins were fully taken over during a quarter, divided by active customers.
- A retailer compares successful account seizures this month with the same count from the month before.
- A fraud team sets a target rate and investigates when the weekly figure moves above that agreed line.
Protective measures
- Publish the exact denominator beside the rate so leaders do not compare unlike measurements.
- Split the rate by channel, such as web and mobile, when the controls on those channels differ.
- Investigate spikes together with loss value, because a low rate can still hide a few very costly takeovers.
- Keep the counting rule stable for several periods before you judge whether a control change worked.
Related articles
The article What is corporate account takeover? describes takeover of a business login rather than the rate itself.
The article What is credential stuffing? explains replaying stolen password pairs against other sites.
The article What is authentication in security? covers the identity check that takeover attempts try to defeat.