What is account takeover?
Account takeover (ATO) is fraud in which someone other than the legitimate customer gains control of an existing account—usually through stolen passwords, OTP interception, malware, or reused sessions—and then changes payout details or moves funds.
Signals that usually precede ATO
New device on a quiet account, impossible travel, password reset plus payout change, credential-stuffing velocity on login, or a previously blocked fingerprint returning with a valid password. None of these alone proves takeover; together they justify REVIEW or step-up.
How Naiza evaluates ATO-shaped events
Send login, password-reset, and payout-change events with customer, device, IP, and session ids. Rules can REVIEW or BLOCK based on device novelty, velocity, and lists. Store the event id so support can explain why a session was challenged.
ATO vs first-party fraud
ATO is an attack on a real customer. First-party fraud is the customer disputing their own activity. Mixing the two in one rule creates messy cases. Keep reason codes separate so operations know whether to restore access or file a dispute pack.
Frequently asked questions
Short answers written so search and answer engines can cite them.
What is account takeover fraud?
It is unauthorized use of a legitimate account, typically after credential theft or session hijack, followed by a high-risk action such as a payout change.
How do you detect ATO in an API?
Evaluate login and account-change events in real time with device fingerprinting, IP reputation, velocity, and lists, then route uncertain cases to REVIEW.
Does MFA stop all ATO?
No. MFA reduces risk but SIM-swap, fatigue attacks, and malware still succeed. Device and velocity signals remain useful after authentication.