Accessibility links

Facebook   X   LinkedIn   Email

It’s on the Rise—And More To Know About ATO Fraud

By: Jim Stickley and Tina Davis
November 15, 2025

If you’re not able to login to an account, you might be victim to an account takeover (ATO). According to Spy Cloud, 22% of adults in the U.S. have experienced an ATO. And globally in 2023, ATOs grew by 155%. With this crime on the rise, it’s a smart idea to learn more about them.

ATO’s target individuals and organizations. But bringing ATOs home, Spy Cloud finds they affected more than 24 million households. Financial theft is the undisputed goal of an ATO. Attackers steal a victim’s identity to pilfer funds, open loans to buy cars and homes, and otherwise live large on a victim’s dime.

ATOs Made Easy Peasy

Compared to other types of cybercrime, ATOs are easier to pull-off since only a username and password are needed to steal an account. They’re often found for sale on the dark web, posted for free, or hijacked via phishing and malware.

With a basic ATO, the fraudster armed with login information, changes the password and username, locking the victim out of their account. Once done, the fraudster transfers funds out of the account into an intermediary account set up for the crime. Then, they siphon the funds into something that can’t be traced, and their account is closed.

ATO Cyber-Smarts

Make no mistake, an ATO is identity theft and financial fraud. The tips below help avoid this devastating crime.

  • Always use two-factor authentication. It’s an added layer of identity assurance during account logins. This may be a one-time code sent to your phone or email. However, if you have other options, such as using an authenticator app, use those.
  • Never respond to an unknown sender or caller, follow links, or open attachments, no matter what file type they may be.
  • Call a message sender directly to verify if the message you received is legitimate. Don’t use information in the suspect message.
  • Never respond to pressure tactics or alarming messages. You always have time to check into the concern.
  • Never provide PII in an email, text or phone call, no matter who the requestor claims to be. Email and text are not generally considered secure forms of communication.

Being vigilant online is a requirement these days, and using common sense along with your Spidey-sense and cyber-smarts can help you save the day.



This Cunning Account Takeover Robbed A “Cybersmart” User’s Account

Scams & Phishing

This Cunning Account Takeover Robbed A “Cybersmart” User’s Account

While banking online, this person received a message saying her account had been compromised and provided her a phone number to call. A woman in New York learned the hard way that even those who know the tell-tale signs of a cyberattack can be fooled. She fell victim to an account takeover (ATO) of her financial accounts – to the tune of over $30,000. Know that all types of accounts are vulnerable to ATOs, and not just those that are financial. READ FULL STORY
Coming Up! Fraud Trends On The Horizon

Scams & Phishing

Coming Up! Fraud Trends On The Horizon

With AI-enabled fraud making its way around the world, organizations and their customers should expect to see even more incidents of fraud. It has become a challenge between an organization’s identity verification measures and those who find ways to exploit them for financial gain. With help from Sumsub’s 2023 Identity Fraud Report, here’s a look around the corner at trending fraud attacks, and those we can expect to see more of today including the new "favorite," AI-enabled fraud. READ FULL STORY
New Tycoon 2FA Phishing Kit Evades MFA

Scams & Phishing

New Tycoon 2FA Phishing Kit Evades MFA

A new upgrade to a phishing kit is getting around MFA, and that's a big security concern. Multi-Factor Authentication (MFA) is a widely used tool many of us rely on for our authentication security. The phishing kit is called "Tycoon 2FA" and it's currently stealing Microsoft 365 and Gmail email accounts. Cybersecurity experts at Sekoia.io have been following it and their report sheds light on this Phishing-as-a-Service (PaaS) kit. Tycoon 2FA is being sold on the dark web, but there is a defense and it is something we should all know how to do. READ FULL STORY
AI ChatGPT And PaaS Merge, Further Weaponizing Email Phishing Campaigns

Your Security

AI ChatGPT And PaaS Merge, Further Weaponizing Email Phishing Campaigns

Hold on to your login credentials! A recent look at email phishing campaigns uncovered a 61% spike in attacks over the second half of last year. However, security pros find AI (artificial intelligence) is now accelerating these campaigns, and the number of attacks will significantly increase going forward. With the release of the AI ChatGPT platform coupled with PaaS (phishing-as-a-service) kit upgrades, email phishing is slated to be more pervasive and destructive than ever before. READ FULL STORY
Creative Hacking Underscores The Need For MFA

Your Security

Creative Hacking Underscores The Need For MFA

Attackers are getting more creative by the day. It's more important than ever before with so many bad actors out there to make all of your accounts ultra-secure. That means that using some method of multifactor authentication (MFA) is in order. Case in point: Recently, there was an elaborate scheme targeting unsuspecting users that would perhaps not have been victims, had MFA been enabled. The attackers sent spam email promoting fake sweepstakes where recipients were encouraged to put their credentials into a form. READ FULL STORY




We use cookies to give you a more relevant browsing experience and improve our website. Using this site means that you agree with our use of cookies policy.