A Guide to Account Takeover Fraud Recovery in 2024

If your business has never suffered from an account takeover (ATO), it can be hard to fully understand the fallout. When an ATO attack affects your business, you’ll likely feel uncertain about what to do next. This article will explain why protecting your business against ATO is crucial, how account takeover fraud recovery works, how you can recover from an ATO attack, and how you can prevent it from ever happening again.

• What are the impacts of not addressing account takeover fraud?
• How Account Takeover Fraud Recovery Works
• 5 Steps to Recover from an Account Takeover Attack
  • Identify the Attack
  • Isolate the Accounts
  • Notify the Right People
  • Investigate the Attack
  • Implement Additional Security Measures
• How to Protect Your Business Against Future ATO Attacks
  • Implement ATO Detection Software
  • Use Strong Passwords and Multi-Factor Authentication
  • Improve Your Access Controls
  • Be Cautious with Third-Party Applications
• Start Protecting Your Website Against Account Takeover Fraud with DataDome
• FAQs

What are the impacts of not addressing account takeover fraud?

You can’t let account takeover fraud go unresolved. Even if you have millions of users and employees, and even if it’s only one user or corporate account that’s been hacked, you want to recover the account and understand how the attack happened. The longer you wait to address the attack, the worse these will get:

• Financial damage: The average cost of a data breach in the US was $9.44 million in 2022 (the highest ever since recordings began in 2006). Whether the affected account is a simple user account or a corporate bank account, ATO fraud can lead to financial losses in the form of stolen money, fraudulent transactions, chargebacks, regulatory fees, and operating fees. The losses add up to millions of dollars faster than you think.
• Reputational damage: Not all damage is purely financial; much of it is reputational too. If a user account has been hacked and the user notices, they will almost certainly blame you—even if they had a weak password and no multi-factor authentication. They may never shop with you again, and may tell their friends and family to avoid your company.
• Legal damage: Almost all companies are under some regulatory framework that protects the data security and privacy of consumers. These frameworks levy hefty fines on companies that suffer from a data leak or account takeover. For example, the Luxembourg National Commission for Data Protection hit Amazon with a $886.6 million fine in 2021 for breaking the EU’s GDPR rules.
• Operational damage: Hackers that break into a corporate account can seriously damage the systems and software your business relies on. Imagine a hacker breaking into your Customer Relationship Management (CRM) software and deleting all your contacts and accounts. This could be a nightmare for any company, even if you manage to recover everything.

How Account Takeover Fraud Recovery Works

Account takeover fraud recovery starts by identifying the attack, isolating the affected accounts so no further damage can happen, and notifying the affected people (users or employees). Once the account has either been frozen indefinitely or recovered, you should investigate the attack to find out how it succeeded, then implement security measures so it never happens again.

5 Steps to Recover from an Account Takeover Attack

When you’re in the midst of an ATO attack, things will likely be stressful and chaotic. That’s why account takeover prevention works best when you have a set number of steps to systematically recover from an attack:

1. Identify the Attack

First and foremost, you have to know you’re under attack. This won’t always be immediately obvious. Fraudsters often benefit from companies not knowing their accounts have been hacked because it gives them more time to defraud your business. It’s particularly hard to notice hacked user accounts, because if the user doesn’t notice and notify you, actions coming from the account usually seem entirely within business logic.

That’s not to say it’s impossible to identify hacked accounts. Dead giveaways are often changed login details, password resets, unauthorized transactions, an increase in chargebacks, and unusual network activity from suspicious IPs. The signs may be small, but the sooner you catch them, the better you’ll be able to mitigate the damage.

2. Isolate the Accounts

Once you’re aware of the attack and which accounts have been hacked, you should immediately isolate them to prevent further damage. This may involve deactivating the accounts, changing passwords, and implementing access controls to limit any more unauthorized access.

3. Notify the Right People

If an ATO attack has affected your users, you have a responsibility to tell them as soon as possible. This isn’t just a moral responsibility; you’re likely under a regulatory framework like GDPR or CCPA where that responsibility is legal too. Tell your customers about the nature of the attack, what they should do now (if anything), and what your business will do so this won’t happen again.

Chances are that your customers will be upset, particularly if their information has been stolen. Keep lines of communication open, stay transparent, and answer their questions with empathy and patience to minimize reputational damage.

4. Investigate the Attack

How did the attack happen? Was it a disgruntled employee? Was it an external threat? How did they gain access? Could you have noticed sooner? These are all good questions that executives, employees, users, and other stakeholders will ask. You should take time to fully understand, in technical detail, how the attack happened. The better you understand, the better you’ll be able to fix this leak—and future leaks of a similar kind.

5. Implement Additional Security Measures

Security incidents are a good opportunity to strengthen your existing security architecture. Don’t just strengthen the security of the particular type of account where the ATO attack happened. Consider how well you can defend yourself against ATO attacks across all your accounts. That’s what we’ll discuss in the next section.

How to Protect Your Business Against Future ATO Attacks

1. Implement ATO Detection Software

Account takeover prevention software is one of the easiest ways to immediately strengthen your protection against ATO attacks of any kind. Because hackers don’t like doing things manually (it takes too much time), they rely heavily on automation to identify and infiltrate their targets.

ATO detection and prevention software stops that from happening. It recognizes bots and scripts that don’t come from allowlisted providers and stops them dead in their tracks before they can even render your website. This is enough for most hackers to move on to easier targets.

2. Use Strong Passwords and Multi-Factor Authentication

Password breakers can now break into accounts with an eight-character complex password in less than an hour. Seven characters? Less than a minute. Six characters? Immediately. On the other hand, complex passwords that are closer to 20 characters are still entirely unbreakable. Every corporate account should have passwords over 15 characters long at least.

It’s a little harder to enforce password length for user accounts, but not impossible. Nudge your users toward good password hygiene with user prompts and notifications to change their password every few months. Similarly, encourage them to enable multi-factor authentication (MFA), which is an extra security layer that will drastically improve the security of any account.

3. Improve Your Access Controls

The more people have access to an account, the bigger the security risk. Be strict about who can access an account. Be even stricter about who you give admin access to. Employees will often ask for access when they just want some information they can obtain in other ways. Try to find the right balance between convenience and security.

This also means you need good employee onboarding, and especially offboarding. When an employee leaves an organization, have a process in place where they are logged out of all corporate accounts and have given back or destroyed all corporate material (offline and online).

4. Be Cautious with Third-Party Applications

Some corporate accounts will be a little out of your control, because they’re accounts you have with a third-party provider. Particularly when it comes to software providers, be cautious about signing up. Consider whether you really need the particular third-party application. Security vulnerabilities in third-party software are often easy gateways for hackers to attack you.

Before you sign up with a third-party vendor, always consider their security features. How secure is their software? How will they protect you against ATO attacks? Don’t avoid asking these questions when you’re evaluating them. Once you’ve signed up with them, keep their software up-to-date with the latest patches as best you can.

Start Protecting Your Website Against Account Takeover Fraud with DataDome

DataDome is account takeover protection software that detects and prevents ATO attacks, as well as any other attacks that use automated means (which are most types of online fraud). DataDome protects your websites, mobile apps, and APIs by blocking bots in real-time without impacting the user experience.

DataDome is easy to install, fits neatly into existing architecture, and runs on autopilot. It has a 0.01% false positive rate, allows you to create allow and block lists, and has a 24/7 SOC team at your disposal. If you want to see how it works, try DataDome free for 30 days or book a demo today.

FAQs

How does account takeover protection work?

Account takeover protection software will defend you most efficiently against ATO attacks, because hackers rely on automated means to gain access to your accounts. ATO protection software will stop their bots and scripts, and the hackers will move on to easier targets.

What occurs during an account takeover?

Depending on the type of account, many things can happen during an account takeover. Often, you’ll notice password resets, changes to account information, fraudulent transactions, or unusual network activity. These are often signs that one of your accounts has been hacked.