Account takeover means gaining control of a real account and acting as its owner, which makes the activity hard to tell apart from normal use.
Account takeover is when a criminal gets control of a real person’s account, like their email, their bank or their work login, and then behaves as if they’re the owner.
Everything they do runs on real credentials and the account’s own history, so it can look like normal use. When money’s the goal, the FBI calls it account takeover fraud, or ATO fraud.
Key takeaways
The steps below come from Retool’s own write-up of its August 2023 breach. It’s one of the clearest first-hand accounts in the library.
Example: Retool reversed all 27. One downstream customer, Fortress Trust, later disclosed a crypto loss of roughly $15 million. That’s an estimate, and it isn’t Retool’s own loss. Read the Retool case.
The attacker grabs an employee login and uses whatever it can reach inside. In July 2020, attackers called Twitter staff pretending to be the IT help desk and collected VPN credentials through a fake login page. With internal admin tools, they then hijacked 130 high-profile accounts for a bitcoin scam that took over $118,000 from the public. Read the Twitter case.
The attacker gets into someone’s online banking and moves the money out. In October 2022, a fraudster spoofed Wells Fargo’s real 800 number, phished a customer’s 2FA code, and a $100,000 wire went out, according to the customer’s lawsuit. Read the Wells Fargo case.
No password needed here. The victim gets talked into installing remote-control software, and the attacker uses it to move money. In 2024, callers pretending to be Barclays’ fraud team got a UK jeweller to install AnyDesk, and GBP 48,451.78 was reported stolen from two business accounts. Read the Barclays jeweller case.
Here it’s a phone account, often so the attacker can order devices. An Australian Federal Police case alleges a Sydney man posed as telecom support to get SMS one-time PINs and buy high-end phones in victims’ names. Investigators found more than 100 Australian victims. Read the Optus and TPG case.
| Pretext | Case | What happened |
|---|---|---|
| Fake IT help desk calling staff | Twitter (2020) | Fake VPN login. 130 accounts hijacked and over $118,000 taken from the public |
| Fake IT support after a prompt flood | Uber (2022) | Stolen password plus repeated prompts, and internal tools reached |
| Fake IT colleague by text and call | Retool (2023) | Fake portal plus a shared code. 27 customer accounts taken over, then reverted |
| Caller posing as an employee | MGM Resorts (2023) | Help desk reportedly reset access. About $100 million profit impact, per MGM |
| Fake bank fraud team | Wells Fargo customer (2022) | Phished 2FA code and a $100,000 wire, per the lawsuit |
| Fake security alert email | DNC and Clinton campaign (2016) | Spoofed Google alerts. 50,000+ of the campaign chairman’s emails stolen |
| Fake login page by SMS | 0ktapus (2022) | Codes relayed in real time. About 9,931 credentials and 5,441 MFA codes captured |
Example: the first four rows all involve workforce logins. Every time, a person opened the door, not a software bug. A login typed into a fake page, a prompt approved, a code shared, a reset granted.
Retool published the text that kicked off its breach, with names taken out. It told the employee their payroll system was “out of sync, which we need synced for Open Enrollment,” and linked to a page that looked like the company’s login portal. Here’s what was wrong with it:
Tip: read a link’s domain from the right. Whatever sits just before the first single slash is the site you’ll actually land on.
| Stage | Control | Case it would have broken |
|---|---|---|
| Pretext | Tell staff and customers that IT and banks never ask for codes, and publish one callback number | Twitter, Wells Fargo |
| Credential capture | Phishing-resistant MFA (FIDO2/WebAuthn) that only works on the real site | Retool, 0ktapus |
| Second-factor bypass | Never share codes by phone, and check identity out of band before any help-desk reset | Retool, MGM |
| Persistence | Alert on new MFA devices and on email or password changes | Retool |
| Cash-out | Hold new payees and unusual wires and call back first, and flag remote-access sessions | Wells Fargo, Barclays jeweller |
Example: Retool said a hardware security key would have left the attacker nothing to collect, since there’s no code to share.
Not always, and the difference affects who ends up with the loss. In some bank-impersonation scams the criminal never logs in at all. The owner gets persuaded to move the money themselves, often to a “safe” account.
In October 2017, callers pretending to be RBS’s fraud team talked Hamilton Academical FC’s banking employee into moving about £989,000 into 26 new accounts. RBS said there was no breakdown in its security procedures. In May 2026, a caller posing as Standard Bank persuaded an 18-year-old to move her R438,900 education fund, and the bank said its findings didn’t support a systems compromise.
Example: compare the Barclays jeweller, whose PC the fraudsters were controlling through AnyDesk. National Fraud Helpline said its solicitors argued Barclays should have flagged the unusual activity, and GBP 25,650 was recovered. See the Hamilton Academical case and the Standard Bank case.
A takeover grabs an account that already exists and belongs to a real person. Identity theft is broader. It uses someone’s personal details to act as them, including opening new accounts in their name. Synthetic identity fraud goes a step further and builds a new identity out of real and made-up details. Takeover is usually where other techniques end up: credential harvesting supplies the password, and MFA fatigue or a help-desk reset gets past the second factor. The FBI notes that full personal details stolen during a takeover can then be used to open loans or new accounts, and that’s where the two overlap.
It’s the money side of it. The FBI defines it as criminals getting unauthorized access to a victim’s online bank, payroll, health savings or social media account to steal money or information. Common routes include phishing, fake bank or tech-support calls, data breaches, malware, and search ads that lead to fake login pages.
Yes. In its November 2025 alert, the FBI describes criminals posing as bank or support staff to get the one-time code itself, then resetting the password. It also warns that MFA “will not protect you if you land on a fraudulent login page.” Phishing-resistant methods like FIDO2 security keys close that gap, because they won’t work on a fake site.
Call your bank straight away and ask for a recall or reversal and a Hold Harmless Letter, the FBI says. Then reset every exposed password and file a complaint at ic3.gov that includes the words “Account Takeover.” The FBI also asks victims to tell the impersonated company how they were targeted, so it can warn others and get phishing pages taken down.
Help desks can reset the very controls that stop a takeover. The FBI and CISA’s November 2023 advisory says Scattered Spider talks help-desk staff into resetting passwords or MFA tokens, then takes over accounts in single sign-on systems. Microsoft’s 2022 report adds that outsourced help desks widen the risk, because the attacker goes after the supplier instead of the company.
No. A data breach is data being stolen or exposed. A takeover is control of one specific account. The two often meet, though. At Twitter in 2020, attackers used internal admin tools to take over 130 accounts. At MGM in 2023, a reported help-desk takeover of one employee account led to customer records being stolen.
Reviewed by SEE Team. Last reviewed 21 Oct 2026. Every case on this page links to its sourced record. See the methodology and about SEE.
Social Engineering Examples