Quick answer
Account takeover (ATO) fraud is when criminals gain unauthorised access to your online bank, payroll or similar account to steal money or information[1]. They usually trick you into revealing passwords or one-time codes. Because the payments are unauthorised, US and UK rules cap most consumers' losses if they report quickly.
Key points
- Account takeover means a criminal controls your account and makes payments you did not authorise.
- In an alert about criminals impersonating bank support, the FBI said it had received more than 5,100 ATO fraud complaints between January and late November 2025, with losses over $262 million.
- Text-message and app codes can be phished; CISA calls phishing-resistant authentication the gold standard.
- In the US, reporting a lost or stolen access device within two business days caps liability at $50 under Regulation E.
- In the UK, payers can usually be asked to bear at most £35 of unauthorised losses, unless they acted fraudulently or with gross negligence.
On this page
#What exactly is account takeover?
The US Federal Bureau of Investigation (FBI) describes account takeover (ATO) as cyber criminals gaining unauthorised access to a targeted online financial institution, payroll or health savings account, with the goal of stealing money or information[1]. Once inside, a criminal can change your contact details, add a new payee and send money away, all while looking like you to the bank.
ATO is different from authorised push payment fraud. In ATO the criminal presses 'send'; in APP fraud you do, after being deceived. The difference matters because most consumer protection laws are written for unauthorised payments, the ATO kind. If you want to understand how banks verify logins in the first place, start with strong customer authentication.
#How do criminals take over accounts?
In a November 2025 alert warning about criminals impersonating financial institution support, the FBI said it had received more than 5,100 complaints reporting ATO fraud since January 2025, with losses exceeding $262 million[1]. It described three main techniques:
| Technique | What happens | What the criminal gets |
|---|---|---|
| Impersonation | A text, call or email poses as bank staff and asks you to 'verify' details | Your login details and one-time codes, then a password reset[1] |
| Phishing website | A fake site copies your bank's login page | Whatever you type into it[1] |
| Search engine ads | Paid ads push the fake site above the real one in search results | Visitors who think they clicked the real bank[1] |
| SIM swap | Your mobile carrier is persuaded to move your number to the criminal's phone | Calls and texts meant for you[2] |
The common thread is that a password alone, or a password plus a code sent by text, can be handed over by a person who has been fooled. The US Cybersecurity and Infrastructure Security Agency (CISA) says text-message and voice codes are vulnerable to phishing and SIM-swap attacks, that app-based one-time codes are vulnerable to phishing, and that push notifications without number matching are open to 'push bombing', where the criminal floods you with approval requests until one is accepted[3].
How an impersonation takeover typically unfolds
- Fake alert — text or call 'from the bank'
- Codes handed over — password + one-time code
- Password reset — criminal now controls login
- Details changed — new phone, email or payee
- Money sent — unauthorised transfers
#How common is account takeover?
UK Finance, the UK banking trade body, counts 'remote banking fraud', which covers criminals getting into online, mobile and telephone banking. It reported losses fell by 27% to £104.4 million in 2025, while cases rose 11% to 37,646[4]. These are different measures from the FBI's, so they should not be compared directly.
#Who pays when a takeover empties your account?
In the United States, Regulation E covers electronic fund transfers from consumer accounts. If you tell your bank within two business days of learning that your access device (for example, a debit card or login) was lost or stolen, your liability cannot exceed the lesser of $50 or the amount of unauthorised transfers before notice[5]. If you wait longer, the cap rises to $500, and transfers appearing on a statement must be reported within 60 days of the statement being sent to avoid liability for later transfers[5].
In the UK, the Payment Services Regulations 2017 let a provider make a payer liable for up to £35 of losses from a lost, stolen or misappropriated payment instrument[6]. The payer is liable for all losses if they acted fraudulently or, with intent or gross negligence, failed to meet their obligations, which include taking all reasonable steps to keep personalised security credentials safe and reporting misuse without undue delay[7]. A payer is not liable for losses arising after notifying the provider, except in cases of fraud[6].
Worked example
Worked example: US liability under Regulation E
A criminal takes over Sam's account and makes $1,200 of unauthorised transfers. In scenario B, $300 is taken in the first two business days after Sam learns of the problem and $900 afterwards, and the bank shows the later $900 would have been stopped by timely notice. Figures were computed with code.
- A: Sam reports within 2 business days
- Liability is the lesser of $50 or $1,200 = $50
- B: Sam reports on day 5
- Lesser of $500 or ($50 + $900 = $950) = $500
- Same situation in the UK (no fraud or gross negligence)
- Provider may ask the payer to bear at most £35
#Which defences actually stop takeovers?
The FBI recommends limiting the personal details you share on social media, monitoring accounts regularly, using unique and complex passwords with two-factor authentication, using a bookmark rather than search results to reach your bank's login page, and staying sceptical of unsolicited contacts claiming to be your bank[1].
The strongest technical defence is phishing-resistant authentication. CISA calls it the gold standard for multi-factor authentication and says the only widely available form is FIDO/WebAuthn authentication[3], the technology behind passkeys. NIST's digital identity guidelines explain why: in a phishing-resistant protocol the authenticator's output is cryptographically bound to the identity of the service being accessed, so a fake login page has nothing reusable to collect[8]. Phone carriers have also been told to tighten up: in November 2023 the Federal Communications Commission (FCC) adopted rules requiring wireless providers to use secure methods to authenticate customers before moving a phone number to a new device or provider, and to notify customers of SIM change requests[2].
Common beginner mistakes about account takeover
Reading a one-time code out to a caller
A code that arrives by text or app is meant only for you. Anyone who asks you to read it out, even 'the bank', is trying to log in as you.
Searching for your bank's login page
Criminals buy search ads that lead to fake login pages; use a bookmark or the official app instead.
Reusing a password
If one site leaks a reused password, criminals can try it on your bank and email accounts.
Ignoring 'your details have changed' messages
A sudden change of phone number, email or new payee you did not make is a classic sign of a takeover in progress.
If your stolen details are used to open new accounts rather than take over existing ones, that is identity fraud rather than ATO. A related crime that mixes real and fake details is covered in synthetic identity fraud explained.
The bottom line
Account takeover turns your own login into the criminal's tool, usually after you are tricked into handing over a password or code. US and UK rules cap most consumers' losses for unauthorised payments, but the caps depend on how fast you report. Phishing-resistant sign-in, such as passkeys, removes the thing criminals most often steal.
Frequently asked questions
Is account takeover the same as identity theft?
It is one form of it. Account takeover uses your existing accounts; other identity fraud opens new accounts in your name. The FBI defines ATO as unauthorised access to existing online accounts[1].
Are text-message codes still worth using?
They are better than a password alone, but CISA warns they are vulnerable to phishing and SIM swaps, so phishing-resistant options are stronger[3].
Will my US bank refund unauthorised transfers?
Regulation E caps consumer liability for unauthorised transfers, at $50 if you report within two business days of learning of a lost or stolen access device[5].
What if I gave the criminal my code myself?
Rules differ. In the UK, a payer who failed to protect security details with intent or gross negligence can be liable for all losses[6], so report quickly and explain exactly what happened.
Sources
- Account Takeover Fraud via Impersonation of Financial Institution Support (Alert I-112525-PSA) — Federal Bureau of Investigation, Internet Crime Complaint Center, 2025 Primary
- FCC Adopts Rules to Protect Consumers' Cell Phone Accounts (SIM swapping and port-out fraud) — Federal Communications Commission, 2023 Primary
- Implementing Phishing-Resistant MFA (fact sheet) — Cybersecurity and Infrastructure Security Agency, 2022 Primary
- Fraud remains a national security threat as criminals steal almost £1.3 billion (Annual Fraud Report 2026 press release) — UK Finance, 2026
- 12 CFR 1005.6 — Liability of consumer for unauthorized transfers (Regulation E) — eCFR (US Code of Federal Regulations), 2026 Primary
- The Payment Services Regulations 2017, regulation 77 (Payer's liability for unauthorised payment transactions) — legislation.gov.uk, 2017 Primary
- The Payment Services Regulations 2017, regulation 72 (Obligations of the payment service user in relation to payment instruments and personalised security credentials) — legislation.gov.uk, 2017 Primary
- NIST Special Publication 800-63B (online version of SP 800-63B-4) — National Institute of Standards and Technology, 2025 Primary
_01.jpg){kind=link}
.jpg){kind=link}
