Account takeover fraud is what happens when a criminal gains access to an online account you already own — your bank login, email, brokerage, or retail account — and uses the trust that account carries to move money, make purchases, or harvest more of your information. It’s different from a scam that tricks you into sending money yourself. Here, the attacker becomes you. How much you ultimately lose depends less on what the attacker does and more on how fast you catch it: federal law caps your liability at $50 on a consumer debit card if you report within two business days, and lifts the cap entirely if you wait too long.
How Attackers Get In
Almost every takeover starts with stolen credentials. The four common routes are worth recognizing because they shape what you need to lock down afterward.
Credential stuffing is the biggest one. When a company gets breached, the leaked usernames and passwords are run against hundreds of other sites by automated tools. If you reused a password on your email, your bank, and some retailer that got hacked, the attacker now has all three.
Phishing arrives as an email, text, or phone call warning you about suspicious activity and pointing you to a convincing fake login page. Urgency is the whole trick.
Malware and keyloggers installed on your phone or computer record what you type, including passwords and security answers, and send it back to the attacker. Antivirus software doesn’t catch every variant.
SIM swapping targets your phone number. The attacker calls your mobile carrier, impersonates you, and gets your number moved to a SIM they control. Every text-based verification code then goes to them, which is why SMS two-factor authentication is weaker than it used to be.
What to Do in the First Hours
Change Passwords, Starting With the Compromised Account
Reset the password on the account you know was hit, then reset every other account that shared the same or a similar password. Make each new one long, unique, and random. A password manager is the practical way to do this without falling back on patterns.
Recover Your Email Before Anything Else If It’s Been Taken
If the attacker got into your primary email, every other account linked to it is exposed, because password resets flow through email. Google, Microsoft, and Yahoo each have dedicated recovery workflows that work even after an attacker has changed the password and recovery information. Once you’re back in, check the recovery email addresses and phone numbers on the account and remove anything you don’t recognize.1Federal Trade Commission. How To Recover Your Hacked Email or Social Media Account
Call Your Bank’s Fraud Line Directly
Use the fraud hotline, not general customer service. Ask the bank to lock the account, reverse unauthorized transactions, and open an investigation. Get a fraud case number in writing. You’ll need it later, and the timestamp on that report is what controls your legal liability.
Freeze Your Credit at All Three Bureaus
A takeover often means the attacker has enough of your personal information to open new credit accounts in your name. A security freeze at Equifax, Experian, and TransUnion blocks new creditors from pulling your report, which stops most new account applications. Freezes are free. Online and phone requests have to be processed within one business day, mail requests within three.2Office of the Law Revision Counsel. 15 US Code 1681c-1 – Identity Theft Prevention; Fraud Alerts and Active Duty Alerts
File With the FTC and Your Local Police
Report the incident at IdentityTheft.gov. The FTC system generates an Identity Theft Affidavit, which is formal proof you reported the crime. Pair that affidavit with a police report from your local department and you have a complete Identity Theft Report — the document creditors and banks require when you dispute fraudulent accounts.3Federal Trade Commission. Identity Theft – What To Do Right Away
Bring the FTC affidavit, a government-issued photo ID, proof of your address, and any evidence of the fraud (unauthorized transaction notices, IRS letters) when you file the police report.3Federal Trade Commission. Identity Theft – What To Do Right Away
How Much You’ll Owe
Your financial exposure depends on which type of account was hit and how quickly you reported. The rules for debit cards, credit cards, and business accounts are not the same, and the differences can easily run into thousands of dollars.
Consumer Bank Accounts and Debit Cards
The Electronic Fund Transfer Act caps your liability for unauthorized debit card charges and electronic transfers from a personal bank account, but the cap depends on timing:
- Report within two business days of learning about the fraud, and your liability is capped at $50 (or the actual amount taken, whichever is less).
- Report after two business days but within 60 days of receiving the statement, and liability can rise to $500 for transfers that happened after the two-day window.
- Wait longer than 60 days from the statement date, and the bank is not required to reimburse any loss it can show would have been prevented by earlier reporting. In practice, that’s unlimited exposure.
The gap between $50 and unlimited is why checking your statements and alerts matters so much.4Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
Credit Cards
Credit cards are simpler and more protective. Under the Truth in Lending Act, your maximum liability for unauthorized credit card charges is $50 regardless of when you report. If you notify the issuer before the card is used, you owe nothing. Most major issuers voluntarily waive the $50 as a matter of policy.5Office of the Law Revision Counsel. 15 USC 1643 – Liability of Holder of Credit Card
Business Accounts Are Not Covered
This is where owners get blindsided. The consumer protections above apply only to accounts opened for personal, family, or household purposes. Business checking, corporate accounts, and accounts held by LLCs, partnerships, or sole proprietorships are not covered by Regulation E.6eCFR. 12 CFR Part 1005 – Electronic Fund Transfers (Regulation E)
Business wire transfers fall under Article 4A of the Uniform Commercial Code. Under those rules, a bank that used a commercially reasonable security procedure to verify whoever initiated a transfer can push the loss onto you, the account holder, even if the transfer was completely unauthorized. What counts as commercially reasonable turns on the size and frequency of your usual transactions and what security options the bank offered. If the bank offered multi-factor authentication for wires and you declined it, that cuts against you. If you own a business, ask what security procedures are available on outgoing transfers, turn all of them on, and consider requiring in-person authorization for large wires.
If Your Social Security Number Was Exposed
One common follow-on crime after an account takeover is a fraudulent tax return filed in your name to steal your refund. You usually find out when the IRS rejects your real return because one has already been filed under your SSN, or when you get an IRS notice about income you didn’t earn.
File IRS Form 14039, the Identity Theft Affidavit, online or on paper. It tells the IRS your taxpayer identity has been compromised and opens an investigation.7Internal Revenue Service. When To File an Identity Theft Affidavit
To block future tax-return fraud, enroll in the IRS Identity Protection PIN program. The IP PIN is a six-digit number that changes every year and must be included on any return filed under your SSN. Without it, a fraudulent return gets rejected before processing. Any taxpayer with an SSN or ITIN can enroll through their IRS Online Account. If you can’t verify your identity online and your adjusted gross income is below $84,000 (or $168,000 for married filing jointly), you can apply using Form 15227.8Internal Revenue Service. Frequently Asked Questions About the Identity Protection Personal Identification Number (IP PIN)
Preventing the Next One
Use Stronger Authentication Than SMS
Multi-factor authentication is the single most effective defense, but the kind matters. SMS codes can be stolen through SIM swaps. Authenticator apps that generate time-based codes on your device are better because the code never travels over the cellular network.
The strongest option available is a passkey. Passkeys use a cryptographic key pair tied to your specific device instead of a shared secret like a password. When you log in, the site sends a challenge and your device signs it with a private key that never leaves the device. There’s nothing to type, nothing to intercept, and nothing on the site’s servers for an attacker to steal in a breach. The FIDO Alliance designed passkeys to resist phishing and credential stuffing by default, since even a convincing fake login page can’t fake the cryptographic handshake.9FIDO Alliance. FIDO Passkeys: Passwordless Authentication PayPal, Robinhood, and a growing number of banks and credit unions now accept passkeys. Where passkeys aren’t yet available, a hardware security key supporting FIDO2 gives you the same phishing resistance.
Stop Reusing Passwords
A unique, randomly generated password for every account makes credential stuffing worthless. A password manager handles generation, storage, and autofill, so you never have to memorize or type any of them. This one change kills off the most common attack vector.
Lock Down Your Phone Number
Most carriers let you set a PIN or passcode that must be given before any account change, including SIM transfers and number ports. Many also offer a “number lock” or “port freeze” that explicitly blocks transfer requests until you remove it. Call your carrier and turn on both. So many accounts rely on your phone number for recovery that it’s worth treating as a security asset rather than a convenience.
Watch Your Accounts
Review bank and card activity at least weekly, and pay attention to small charges you don’t recognize. Attackers often test stolen credentials with tiny transactions before attempting larger ones. Most banking apps let you set real-time alerts above a dollar threshold you choose, which effectively turns your phone into an early-warning system. The point is to catch unauthorized access inside that first two-business-day window and keep your liability at its lowest tier.4Office of the Law Revision Counsel. 15 USC 1693g – Consumer Liability
Keep copies of every fraud report, case number, and communication with your bank and card issuers. If a creditor later tries to hold you responsible for a debt you didn’t incur, the Identity Theft Report built from your FTC affidavit and police report is the document that proves the account wasn’t yours.3Federal Trade Commission. Identity Theft – What To Do Right Away