Account takeover (ATO) fraud is on the rise and the statistics are staggering. In 2022 it’s estimated that one in five U.S. adults (nearly 22%) had fallen victim to an ATO attack – that’s over 24 million households!
Global fraud losses are projected to reach well into the billions by the end of 2023, and companies are feeling the sting. A recent digital trust and safety report by Sift revealed a 354% rise in ATO attacks across its global network in Q2 2023 (following a 169% YOY increase in 2022). Of the companies surveyed, nearly 18% had experienced ATO attacks, and 62% of those attacks took place within the past year. Sectors hit hardest by ATO include loyalty merchants (sites and apps that reward consumers for online/offline shopping) and FinTech companies.
What's ATO and why is it common?
Account takeover is a type of identity theft where a fraudster gains access to a user’s credentials, alters their personal identifiable information (PII), and takes over the entire account for malicious gains. While ATO fraud can impact various types of accounts, the most common include banking, email, e-commerce, social media, and loyalty/rewards accounts.
Two factors have propelled ATO attacks forward: an increase in global data breaches and the rise of e-commerce. Many data breaches are responsible for exposing personal and financial information such as credit card details, social security numbers, and addresses. The increase in breaches means more stolen credentials available on the black market, making it easier for fraudsters to take over accounts.
The global e-commerce market continues to grow and expand, with nearly 21.2% of total retail sales expected to take place online in 2024. As consumers spend more time shopping online, it creates more opportunities for fraudsters to execute scams. By the end of 2023, e-commerce losses stemming from payment fraud are projected to exceed $48 billion globally.
How is ATO evolving?
ATO fraud is literally being taken over (and propelled by!) technology. To enhance their attacks — and recruit new fraudsters along the way — online criminals are leveraging:
- Generative AI to create fake images and videos that appear authentic and genuine. Fraudsters are also using popular speech systems and programs to clone vocal patterns and produce audio that’s indistinguishable from real humans.
- Social media. Fraudsters aren’t just using social sites to promote fake investment opportunities or bogus profiles. They’re also using them to advertise ATO schemes and recruit “want-to-be” fraudsters to their organized crime sectors.
- Automation platforms and digital services to help speed up and enhance malicious ATO efforts. Fraud-as-a-service (FaaS) is an online business model gaining traction within the crime industry. Fraudsters can subscribe to the tool or service and leverage it to streamline their efforts. For instance, a fraudster who doesn’t want to hack and take over an account manually could use a FaaS provider to do it for them. Atlantis AIO is a common credential-stuffing tool that many fraudsters are currently utilizing.
What are the consequences of ATO fraud?
For businesses and consumers, the consequences of ATO fraud are vast. Aside from ATO being costly — average financial losses exceed $12,000 per incident! — nearly 73% of consumers believe a company is accountable for ATO attacks and should be responsible for protecting account credentials. And 76% are even willing to walk away from a company after experiencing an ATO attack.
How to protect consumers from ATO attacks
ATO fraud is devastating for your organization and its customers. It not only drains company funds, leads to legal ramifications, and taints your reputation — it also dissolves the trust and loyalty of consumers and customers.
The best way for companies to stop ATO fraud and malicious fraudsters in their tracks is to leverage an advanced fraud prevention solution. A multi-layered fraud defense combines first-party data capture with real-time identity resolution, machine learning, and advanced bot detection to fight evolving fraud.
Advanced fraud solutions leverage these five elements to spot and stop ATO fraud in its tracks:
1. Identity Graph: Spotting account takeover starts with understanding real consumer activity. A first-party identity (ID) graph maps and links consumer identities across all channels, devices, domains, and over time to build a digital footprint of individual consumers - both anonymous and known. Persisting identity across digital properties delivers a 360-degree view of consumers and their normal behaviors. Once you understand the behaviors of normal consumers, it’s easier to detect malicious activity and behaviors that deviate from the norm. Capturing, stitching, and relaying all data in real time is critical so fraud intervention can happen in-the-moment to halt ATO fraud before it starts.
2. Behavioral biometrics: In fraud prevention, behavioral biometrics are used to either confirm identity or detect anomalies in a consumer’s behavior. From mouse movements to typing speeds and swipe patterns, every consumer behaves differently in a digital environment.
When a company tracks a consumer’s typical behaviors and movements, it’s easier to spot atypical behavior (aka fraudster behavior!). Behavioral biometrics work alongside a first-party identity graph by capturing and tracking consumer behaviors and interactions in real time. This comprehensive identity profile can be compared against activity happening in real time to verify the identity of consumers — especially those who are attempting to open a new account or update an existing one. In the fight against ATO fraud, behavioral biometrics is uniquely equipped to compare “me vs. me” and detect ATO fraud when behaviors don’t match.
3. Anomaly detection: Fraudsters are sneaky, agile, and great at flying under the radar. Anomaly detection uses advanced data modeling, behavioral biometrics, and time series analysis to pinpoint even the smallest inconsistencies and abnormalities in a consumer’s behavior. It runs behind the scenes to flag suspicious data patterns (like bot attacks and password harvesting) and can be set to a customized criteria to sound the alarm at the first sign of fraud.
4. Machine learning and AI: To stay ahead of evolving fraud, a defense solution must leverage machine learning (ML) and artificial intelligence (AI) capabilities that scale accordingly. Advanced ML techniques effectively identify and prevent fraud by analyzing vast amounts of data from various sources to detect unusual activity quickly and accurately. ML also adapts to new types of fraud as it appears, ensuring organizations get a leg up on evolving ATO schemes and activities.
5. Advanced bot detection: Today’s fraudsters use bad bots to automate their ATO attacks. Credential stuffing bots use stolen passwords and other sensitive information to gain unauthorized access to user accounts. Once inside, bots can be programmed to steal personal data, perform transactions, manipulate account details, and steal money.
Bot detection in fraud is the process of identifying and distinguishing between bot and human activity — and it’s critical to fighting ATO fraud. When a company can effectively understand human behavior versus bot behavior, it can respond promptly while reducing false positives.
Stop ATO fraud before it starts
Forecasts are predicting global fraud losses to be 20% higher than last year. While account takeover attacks and fraudulent activities continue to rise and evolve, so do consumer expectations.
Today’s consumers expect a lot from the businesses they interact with, and this includes security. Without a fraud defense solution in place, organizations not only risk losing revenue — they risk the trust and loyalty of their consumers.
