What Is Account Takeover (ATO)?

Definition

Account takeover (ATO) is when a criminal gains control of a real account (email, bank, payroll, cloud app, or website admin) and uses it as if they were the owner. The FBI describes ATO fraud as gaining unauthorized access to a financial institution, payroll, or health savings account "with the goal of stealing money or information."

How It Works

Takeovers usually start with getting the credentials, then locking the owner out:

Get the login. Phishing pages, credential stuffing with reused passwords, infostealer malware that copies saved passwords, or social engineering by phone or text. The FBI's November 2025 warning describes criminals impersonating bank staff or tech support to talk victims out of their passwords and MFA or one-time codes.
Get past the second factor. If MFA is missing, the password is enough. If it uses codes, the victim may be tricked into reading it out or typing it into a fake page. The FBI notes MFA "will not protect you if you land on a fraudulent login page."
Take control. The attacker resets the password, changes recovery details, and adds forwarding rules or new devices.
Use it. Wire money, change payroll deposit details, read and send email, or download data.

The FBI also warns about SEO poisoning: criminals buy search ads that imitate a real bank's ad, so a victim who searches for their bank lands on a phishing site. The FBI's advice is to use a bookmark to reach login pages.

Real-World Example

In June 2024, Mandiant (part of Google Cloud) reported a campaign it tracks as UNC5537 that compromised Snowflake customer database accounts for data theft and extortion. Every incident Mandiant responded to traced back to compromised customer credentials, mostly stolen by infostealer malware, some as far back as 2020. Mandiant cited three factors: the accounts did not have MFA enabled, the stolen credentials had not been rotated, and no network allow lists limited where logins could come from. Mandiant and Snowflake notified about 165 potentially exposed organizations.

Why It Matters for a Small Business

The FBI's November 2025 public service announcement reported more than 5,100 ATO fraud complaints to IC3 since January 2025, with losses exceeding $262 million, and says the targets include businesses and organizations of every size. Once an attacker controls the account, money moves fast. The FBI's 2025 IC3 annual report says its Financial Fraud Kill Chain process saw a rise in account takeover cases, which can involve 50 or more simultaneous ACH transfers to different accounts at multiple banks. A taken-over Microsoft 365 mailbox is also the usual starting point for business email compromise.

How to Spot It / How DTS Handles It

Signs: password reset or MFA change emails you did not request; new inbox rules or forwarding; logins from unfamiliar locations; payroll or bank detail changes; and contacts receiving odd emails from you.

If it happens, the FBI advises contacting your financial institution immediately to request a recall, resetting exposed credentials, and filing at ic3.gov. DTS revokes sessions, removes attacker rules and devices, enforces phishing-resistant MFA, and reviews sign-in logs. See our Microsoft 365 security service, or our business email compromise response page.

Related Terms

Multi-factor authentication (MFA): the main control against takeover, if it is phishing-resistant.
Credential stuffing: reused passwords are a common way in.
Phishing: fake login pages that capture passwords and codes.
Session hijacking: stealing a logged-in session instead of the password.
Business email compromise: what a taken-over mailbox is used for.
Infostealer: the malware behind the Snowflake credentials.

Sources

FBI Internet Crime Complaint Center, Account Takeover Fraud via Impersonation of Financial Institution Support, Alert I-112525-PSA (November 25, 2025): https://www.ic3.gov/PSA/2025/PSA251125
Mandiant, Google Cloud Blog, UNC5537 Targets Snowflake Customer Instances for Data Theft and Extortion (June 10, 2024): https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion
FBI Internet Crime Complaint Center, 2025 IC3 Annual Report (Financial Fraud Kill Chain section): https://www.ic3.gov/AnnualReport/Reports/2025_IC3Report.pdf

Last updated October 14, 2026.