Account Takeover Fraud: How Criminals Empty Banks

In 2022, a DOJ operation in Miami broke up a network that had accessed over 2,000 bank accounts using stolen credentials. The network withdrew $4.5 million over 90 days via Zelle, ACH transfers, and ATM cashouts through mule accounts. The attackers never cloned a card. They never physically touched anything. They simply logged in. FinCEN reported $25.9 billion in suspicious activity reports tied to identity theft and account takeover in 2023. That figure represents only the cases financial institutions chose to file, not total losses.

Account takeover fraud does not look like the card fraud most banks have built their fraud teams to detect. It does not trigger alerts for a chip card used in an unusual location. The attacker presents as you. That means valid credentials, sometimes a passed MFA check, correct browser fingerprint, and in some cases a session token the bank issued to you directly. By the time the bank’s fraud systems see an anomaly, the transfer is already queued.

The short answer: Account takeover (ATO) is when a criminal logs into your existing bank account with credentials the bank accepts as valid. They do not need your card, PIN, or physical documents. They get in through stolen passwords, phishing that steals your session cookie, infostealer malware, SIM swaps, or by social-engineering the bank’s phone line. Recovery is hard because the bank’s logs show the transfer coming from an “authorised” session. The best defences are a unique password per financial account, an authenticator app instead of SMS, and login alerts you actually read.

Jump to:

What Account Takeover Actually Is

Account takeover — ATO in fraud industry terminology — is distinct from every other form of bank fraud consumers typically hear about. Card fraud requires access to card numbers and CVVs, either through physical theft, skimming, or data breaches of payment processors. Check fraud requires physical documents. New-account fraud uses your identity to open accounts you did not apply for.

ATO is none of these. In ATO, the attacker is authenticating to your existing account on your actual bank’s actual login page using credentials the bank accepts as valid. They are inside the account. They can see your balance, your transaction history, your registered payees, and your account settings. They can initiate transfers, change the registered phone number or email address, add new payees, set up automatic payments, or download account statements. The bank, at the moment of login, cannot distinguish them from you.

This is what makes ATO categorically harder to detect and to recover from than card fraud. The bank issued the session. The transaction looks authorised. The legal frameworks around “authorised” transfers are far less protective than those around card fraud. In most cases, the recovery burden falls on the account holder to prove they did not initiate the transaction.

Five Paths to Your Bank Account

There is no single method attackers use for ATO. The approach depends on what data they have available and what the target bank’s security configuration looks like. It also depends on how much effort the value of the account justifies.

Credential stuffing is the highest-volume method. Your email and password from the LinkedIn breach of 2012, the Dropbox breach of 2012, or any other large breach of that era are still in circulation. They travel in combolist format. If you used the same password for your bank account, or a simple variation of it, automated credential stuffing tools will find the match. Software like Sentry MBA, OpenBullet, and their successors takes millions of email:password combinations and tests them against bank login pages at scale. It handles CAPTCHAs through API-based solvers and rotates IP addresses through residential proxy networks to avoid rate-limit detection. The success rate per credential is low. At millions of attempts per day across hundreds of financial sites, the volume makes the economics work. Troy Hunt’s HaveIBeenPwned database currently indexes over 14 billion accounts from known breach compilations. A meaningful fraction of those accounts reused passwords across financial sites. Our credential stuffing guide covers this attack in depth.

Adversary-in-the-middle phishing is technically more sophisticated but increasingly accessible via off-the-shelf tools. A phishing email sends a target to what appears to be their bank’s login page. The page is not a static HTML clone. It is a real-time proxy that forwards every request the victim makes to the legitimate bank site, and forwards every response back to the victim. The victim enters their credentials and passes their MFA check, including authenticator app codes or SMS codes. At that point the attacker’s proxy captures the session cookie the bank’s server issues after successful authentication. That session cookie is now in the attacker’s hands. The attacker does not need the password. They do not need the MFA code again. They have what the bank’s server recognises as proof that the legitimate user authenticated. Tools like Evilginx2 and Modlishka automate this entirely. The attacker needs to register a lookalike domain and send a convincing email. The technical barrier is a few hours of setup.

Infostealer malware bypasses the login entirely for accounts already logged in. Redline, Raccoon, and Vidar stealers spread through pirated software, fake Chrome extensions, malicious YouTube download links, and compromised websites. Once running on an infected Windows device, they exfiltrate everything the browser has stored. That means saved passwords, active session cookies, autofill data, saved payment cards, and crypto wallet seed phrases. An active session cookie proves to a bank’s server that the user has already authenticated. When that cookie is exported and imported into an attacker’s browser, the attacker lands inside the bank account at its current session state, with no login prompt. Banks that use “remember this device” features with 30-day session lifetimes are most exposed to this vector. Banks with 30-minute session timeouts or device fingerprint verification on every new browser instance reduce the window. Our stealer logs explainer shows what one of these dumps contains.

SIM swap transfers the victim’s mobile phone number to a SIM card the attacker controls. The attacker typically calls the mobile carrier’s customer service line with enough personal information to pass knowledge-based verification. Once the swap completes, all SMS messages to that number arrive on the attacker’s device. That includes 2FA codes, one-time passwords, and “verify this transaction” texts. This vector specifically targets SMS-based 2FA, which most retail banks in the US and India still use as their primary second factor. SIM swap is harder than it was in 2018, when carriers had almost no specific controls. The FCC’s November 2023 rules required carriers to add verification steps for SIM changes, and major carriers have added PIN-based verification. But the fraud continues, because social engineering can still defeat PIN verification when a caller is sufficiently prepared. Our SIM swap guide explains how to lock your number down.

Social engineering the bank directly requires no technical access to the victim’s devices or accounts. The attacker calls the bank’s customer service line and works through the bank’s knowledge-based authentication. That means full name, date of birth, last four of Social Security Number, mother’s maiden name, and perhaps the last transaction amount or the account’s opening balance. Every one of these fields is available from a combination of breach databases and data broker records. A fullz package, a complete identity bundle sold on Telegram markets, contains all of them. The attacker passes verification, requests a password reset or a new linked phone number, and takes over the account without ever knowing the original login credentials. This vector is particularly effective against older customers whose full biographical data has accumulated across decades of data broker records. It also works against customers at banks that still lean on static knowledge-based questions rather than device-bound authentication. Getting your details out of those broker records shrinks the pool of answers an attacker can buy.

The session cookie deserves more detailed explanation, because it is widely misunderstood. It is the mechanism that makes both adversary-in-the-middle phishing and infostealer attacks so effective.

When you log into your bank and pass your 2FA check, the bank’s server issues a session token. It is a long, random string stored in your browser as a cookie. On every later request your browser makes to the bank’s site, it sends this cookie. The server checks the cookie against its session database. If it matches a valid, unexpired session, the server treats the request as authenticated. The cookie is the proof of authentication, not your password.

Your password is only used at login. After that, the cookie is doing all the work. This is why stealing a session cookie gives an attacker authenticated access without needing your password at all. When an infostealer exfiltrates your browser’s cookie store, it is taking the active proof-of-authentication that your browser is currently using. When an adversary-in-the-middle proxy captures the session cookie issued after you complete MFA, it captures the same thing.

The session cookie’s validity depends on the bank’s configuration. Some banks issue short-lived tokens that expire in 15–30 minutes of inactivity. Others issue “remember this device” cookies lasting 30 days. Some use additional device fingerprinting, comparing the browser’s characteristics on each request. This detects when a cookie is being used from an unfamiliar device and forces re-authentication. Banks that layer cookie-based sessions with device fingerprinting validation are materially more resistant to this vector.

The Mule Account Pipeline

When attackers access bank accounts, they rarely transfer money directly to their own accounts. A direct transfer to an identifiable attacker-controlled account would trigger bank fraud detection and provide law enforcement with a clear paper trail. Instead, money flows through mule accounts: third-party accounts that receive and forward funds.

Mule accounts are operated by one of two kinds of person. Some are witting participants, recruited through money-mule job scams pitched as “payment processing” or “financial agent” work from home. Others are unwitting victims who were themselves scammed. A romance scam victim who was convinced to receive and forward money, believing it legitimate, becomes an unwitting mule. A “remote work” hire who receives funds and is told to buy gift cards or wire money abroad is a witting or semi-witting mule.

Zelle transfers are the preferred first movement step in US domestic ATO because they settle immediately and are treated as authorised transfers by the sending bank. An attacker who logs into your bank account and Zelles $2,000 to a mule account completes that transfer in under a minute. The mule then withdraws cash or purchases cryptocurrency. By the time you notice and call your bank, the funds have moved at least once and possibly twice. The mule may not be traceable to the actual attacker.

Why Zelle Recovery Is Hard

Regulation E of the Electronic Fund Transfer Act covers unauthorised electronic fund transfers. If someone takes your Zelle credentials and transfers money without your knowledge or consent, that is an unauthorised transfer under Regulation E. Banks are required to investigate and refund it.

The problem is how “authorised” gets defined. When an attacker logs into your account through ATO and initiates a Zelle transfer, the bank’s transaction log shows the transfer originating from an authenticated session. The bank argues the transfer was authorised by you, in your authenticated session, even if the authentication was obtained fraudulently. Senate Banking Committee hearings in September 2022 and May 2023 highlighted this pattern. JPMorgan Chase, Wells Fargo, and Bank of America reported receiving hundreds of thousands of ATO-related Zelle complaints. Their reimbursement rates for these cases were extremely low.

Pressure from the Senate Banking Committee and the Consumer Financial Protection Bureau (CFPB) led the major US banks to voluntarily expand their Zelle reimbursement policies in 2023. The expansion applied specifically to impersonation fraud, where the account holder was manipulated into initiating the Zelle transfer themselves. But pure ATO cases, where the attacker initiated the transfer from an authenticated session, remain contested. In a January 2025 compliance aid, the CFPB set out its position on these transfers. A peer-to-peer transfer made by a fraudster using stolen credentials is an unauthorised transfer under Regulation E, which banks must investigate. That guidance is interpretation, not a new rule. As of mid-2026, there is no active CFPB rulemaking targeting Zelle account takeover. The Bureau’s late-2024 enforcement lawsuit against the three banks over Zelle handling is the live front. How individual disputes resolve still varies bank to bank.

The practical consequence is that recovering Zelle losses from ATO is a dispute process that can take weeks and frequently results in denial. This is a structural difference from credit card fraud, where the Fair Credit Billing Act gives consumers much stronger dispute rights.

UK Consumer Protections

The UK provides substantially stronger consumer protection here. The mechanism is the Payment Systems Regulator’s mandatory reimbursement rule for Authorised Push Payment (APP) fraud, which came into force in October 2024.

APP fraud covers situations where the account holder initiates a payment. That includes cases where an attacker accessed the account and initiated a payment the bank processed, and it covers most ATO-driven bank transfers. Under the rule, UK banks must reimburse victims of APP fraud up to £85,000 per claim for most cases. The cost is split equally between the sending and receiving banks. Victims must report promptly and cannot have acted with gross negligence. Even so, the bar for reimbursement is significantly lower than under comparable US frameworks. As of mid-2026 the £85,000 cap remains in force, though the PSR has opened a review. A formal consultation on the cap and other terms is scheduled for December 2026.

The rule explicitly covers cases where the account holder was manipulated or deceived and does not require the victim to prove they exercised unreasonable caution. UK banks lobbied heavily against the rule during its consultation phase, arguing the cost burden was excessive. The PSR implemented it over those objections.

If you bank in the UK and believe you have been a victim of ATO-related fraud, start with the APP fraud mandatory reimbursement framework. It is the relevant starting point for your complaint. Your bank is required to handle the complaint and, if not satisfied with the outcome, you can escalate to the Financial Ombudsman Service.

Recognising That ATO Has Happened

ATO attacks vary in speed. Some attackers move money within minutes of gaining access; others spend time inside the account surveilling, adding payees, and preparing a larger transfer. The window before you notice ranges from minutes to weeks.

Several signals indicate ATO in progress or recently completed. Unexpected login alerts or “new device recognised” emails are the earliest indicator. Most banks now send these, but they are only useful if you receive them before the attacker changes the notification email address. A changed recovery email or phone number on your account is a strong signal. Attackers change these to prevent you from resetting your own access. Other signs include new payees you did not create and outgoing Zelle or ACH transfers you did not initiate. Watch too for password reset requests on email accounts you did not make. Attackers who want persistent access often try to lock you out of your email. An unexpected logout from your bank’s app can also mean someone changed your credentials.

The subtler signals matter too. A series of small test transactions, $1 or less, often precede larger withdrawals. Attackers test whether an account is being watched before moving larger amounts. Watch also for statements showing purchases at retailers you have never used, and balance notifications that do not match what you expected.

Immediate Response Steps

Speed matters. The faster you respond, the more likely you can interrupt money movement before it completes further transfers in the mule pipeline.

Call the bank’s fraud line using the phone number on the back of your physical card, or from the bank’s official website that you type in manually. Never use a number from a suspicious email or text message. Explain that you believe your account has been accessed without your authorisation, and ask for an immediate freeze on outgoing transfers. Request that they lock the account against new payee additions or changes to registered contact details while the investigation is open.

File a police report. Many banks require a police report or crime reference number to process fraud claims. In the US, file with your local police department. In the UK, file at actionfraud.police.uk or call Action Fraud at 0300 123 2040. In India, file at cybercrime.gov.in or call the 1930 cybercrime helpline. The report creates an official record and the reference number is necessary for insurance claims, bank dispute escalation, and credit bureau fraud alerts.

File with the Federal Trade Commission at identitytheft.gov if you are in the US. The FTC generates a personalised recovery plan and documents the incident in its national fraud database. This record supports dispute letters to banks and credit bureaus.

Contact the major credit bureaus to place a fraud alert. In the US, Equifax (equifax.com), Experian (experian.com), and TransUnion (transunion.com) each accept fraud alerts. You only need to file with one, and it notifies the others. A standard fraud alert lasts one year and requires creditors to take extra verification steps before opening new accounts. An extended alert lasts seven years. In India, use CIBIL (cibil.com), Equifax India, Experian India, and CRIF High Mark. A fraud alert does not stop someone already inside your existing accounts from transacting, but it prevents new credit being opened. Our credit freeze vs fraud alert guide explains which one to use when.

Change the password for your bank account and your primary email account from a device you trust. Ideally, use one that has not been on the same network as any device you suspect was compromised. Change them to long, random strings generated by a password manager.

Prevention That Actually Works

The most effective single change is a unique, randomly generated password for every financial account, stored in a password manager. Bitwarden is free, open-source, and audited annually. 1Password and Dashlane are paid options with extra features. A unique password per account means a credential breach of one service cannot cascade to your bank account. This addresses the entire credential stuffing vector. Our password manager guide walks through setting one up.

Use an authenticator app instead of SMS for 2FA wherever your bank allows it. Google Authenticator, Authy, and Microsoft Authenticator generate time-based one-time codes locally on your device. They are not delivered over SMS, so SIM swapping does not intercept them. They also resist SS7 network attacks that can intercept SMS on some carrier networks. Hardware security keys are stronger still, and Yubico’s YubiKey is the most widely used. A key requires physical possession and cannot be phished through an adversary-in-the-middle proxy, because it uses challenge-response cryptography bound to the legitimate domain. Our two-factor authentication guide compares each option, and passkeys go further still.

Set up login alerts and transaction alerts on every financial account. Most banks send email or SMS notification for logins from new devices, password changes, and transactions above a threshold you set. Review these settings in your bank’s security page and ensure the notification email address is one you actively monitor. An alert you receive within minutes of an attacker accessing your account gives you time to call the fraud line before a transfer settles.

Freeze your credit proactively at all three US bureaus. A credit freeze is free and prevents any creditor from accessing your credit file to approve new accounts. It does not affect your existing accounts or your ability to use existing credit. It prevents the new-account fraud that often accompanies ATO, where attackers who gain access to your financial identity also open new lines of credit. Unfreezing to apply for credit yourself takes minutes online. Leaving your credit unfrozen when you are not actively applying for credit is unnecessary exposure.

Audit the active sessions on your bank’s security page. Most major retail banks now show this under “Security” or “Account Settings” — a list of devices or sessions currently authenticated to your account. Review this periodically, and immediately after receiving any suspicious email or notification. Revoke sessions associated with devices you do not recognise or have not used recently.

Finally, regularly review your linked accounts and payees. An attacker with a medium-term strategy sometimes adds a payee or linked external account weeks before initiating a transfer. Letting the relationship age reduces fraud scoring risk. A quarterly review of every registered payee, linked account, and authorised application takes ten minutes and catches changes you did not make.

KnytX Vigil is built to watch breach databases and stealer logs for your credentials, so you get early warning before ATO attackers reach your bank. Vigil isn’t live yet; join the waitlist to turn it on at launch.