Account takeover: when someone else signs in as your customer

The automated routes in are covered on their own pages: credential stuffing and brute force attacks.

• Credential stuffing. Username and password pairs leaked from another site are tried against yours, at scale.
• Brute force and password spraying. Common passwords are guessed against many accounts.
• Phishing. The user is tricked into typing credentials, or a one-time code, into a fake page.
• Session theft. A session cookie or token is stolen, so no password is needed; see session hijacking.
• Weak account recovery. Reset flows that trust guessable answers or an email account that was itself taken over.

The first two are automated and visible in sign-in traffic. The others leave fewer traces until the attacker starts using the account.

• Sign-in from a new device, network or country, followed quickly by a sensitive change.
• Changes to email, phone, password or payout details shortly after sign-in.
• Many failed sign-ins across accounts from the same infrastructure, then a few successes.
• Unusual spending or transfers, especially of stored balances and gift cards.
• Support contacts from users who say they did not make a change.

Single signals produce false alarms; combinations, such as a new device plus an immediate address change, are what matters.

The direct cost is fraud: orders placed with stored cards, balances and loyalty points spent, payouts redirected. Chargebacks follow, and payment processors treat a rising rate as a risk signal about the merchant.

The indirect cost is trust and support. Customers whose accounts were used blame the service, support teams spend hours restoring accounts, and every extra check added in a hurry slows down real users. Preventing takeover is usually cheaper than cleaning up after it.

1. Offer and encourage multi-factor authentication. Phishing-resistant authenticators are strongest; NIST SP 800-63B sets the levels.
2. Check passwords against known breached lists. And refuse the ones that appear.
3. Limit and slow sign-in attempts. Per account and across accounts, as the OWASP Credential Stuffing Prevention Cheat Sheet describes, without locking real users out.
4. Confirm sensitive changes. Re-authentication and a notice to the old address before email, phone or payout changes.
5. Harden recovery. Treat password reset as a sign-in, with the same protections.
6. Protect sessions. Short lifetimes, rotation after sign-in, and cookies marked Secure and HttpOnly.

End all sessions, reset credentials, and roll back the attacker's changes, starting with contact details so the owner gets messages again. Then check what was done while the account was controlled: orders, transfers, messages to other users.

Look for others like it. A takeover through stuffing is rarely alone; the same source has usually tried many accounts, which is what the OWASP Automated Threats project describes as credential stuffing at scale.