Account takeover (ATO) is a form of fraud in which an attacker gains control of a legitimate user's account — email, banking, corporate identity — and operates it as that user. In corporate environments, ATO increasingly begins not with stolen passwords but with a phone call that talks a helpdesk into resetting them.
How account takeover happens
- Credential attacks: stuffing breached passwords, phishing, malware.
- The recovery route: impersonating the user to support and triggering a password or MFA reset — no credentials needed, and voice cloning made the impersonation convincing.
- Session and token theft: hijacking authenticated sessions to skip login entirely.
- SIM swapping to intercept codes — see the adjacent spoofing pattern in spoofed numbers.
Account takeover vs identity theft
Identity theft creates or misuses an identity broadly (new accounts, loans, documents); ATO seizes one existing account. ATO is often a component of identity theft, but its defenses are account-level: recovery-flow verification, session protection, and action gating.
Preventing corporate ATO
The recovery flow is the control point: verify identity out-of-band before resets execute, gate high-risk actions after login, and log verification per action. See account takeover prevention and the Scattered Spider playbook.