Account Takeover (ATO)

It started on AOL in the United States in the mid-1990s, when the 1995 'AOHell' toolkit, written by a teenager known as 'Da Chronic', let users steal other members' passwords with fake messages, the first known mass account takeovers.

Account takeover began with the first online accounts: in the mid-1990s, AOL users were targeted with fake messages and tools such as AOHell to steal their logins. As banking, email and shopping moved online in the 2000s, stolen passwords were reused across sites, and the term 'credential stuffing' (automated testing of leaked username-password pairs) came into use around 2011. From about 2017, SIM swapping, where criminals get a victim's phone number moved to their own SIM, became a common way to beat text-message security codes, especially to empty crypto accounts. Groups such as Scattered Spider now mix phone-based social engineering, fake help-desk calls and SIM swaps to take over personal and corporate accounts.

Criminals get a victim's login details through phishing, data breaches, malware, or passwords reused from other sites. To beat extra security they may trick the victim into reading out a one-time code, pose as the bank's fraud team, or talk a phone carrier into moving the victim's number to a new SIM. Once inside, they change the email, phone and password so the real owner is locked out, then move money, buy goods, or use the account to scam the victim's contacts.

Billions of leaked username-password pairs and cheap credential-stuffing tools mean an attacker can test millions of logins a day with almost no skill, and Verizon's DBIR finds stolen credentials remain a leading way into breaches. It pays because a hijacked bank, crypto or email account gives direct access to money and to further victims; the FBI logged about $360 million in ATO losses in 2025, plus $262 million from fake bank-support takeovers. Cases are numerous but small, victims often cannot show who was behind a login, and most operators are abroad, so prosecutions focus on large crews such as Scattered Spider.

The FBI recorded about 4,700 account-takeover complaints with $359.7 million in losses in 2025 (IC3), and the SIM-swap variant alone cost over $68 million in 2021. The biggest single case is the theft of over $230 million in crypto from one Washington DC victim by Malone Lam and associates in 2024 (US DOJ, Sept 2024). Victims also lose email, photos and identity, and companies such as MGM Resorts reported a roughly $100 million hit after a 2023 help-desk takeover (MGM SEC filing, Oct 2023).