# What is Access Acquisition?
Source: https://arsen.co/en/resources/access-acquisition
Summary: Access Acquisition is an F3 resource development technique. Fraud actors buy or steal access to accounts and systems instead of gaining entry themselves.

**Access Acquisition maps to the Resource Development tactic in the [MITRE F3 Framework](https://ctid.mitre.org/fraud). Rather than breaching a system from scratch, fraud actors bypass the initial attack phase entirely by purchasing pre-existing access from underground brokers.**

## What forms does purchased access take?

| Access Type | Example |
|---|---|
| Compromised credentials | Online banking or payment account logins |
| MFA artifacts | OTP bypass tokens, session cookies |
| Administrative access | Merchant portal logins, back-office remote access |
| API keys and tokens | Programmatic access to financial services |
| Pre-installed tooling | "Loads", malware or bots already deployed on target systems |

## Why do fraud actors prefer Access Acquisition?

Buying access eliminates the reconnaissance and initial intrusion phases, letting attackers focus immediately on high-value fraud: fund transfers, payroll manipulation, account takeover, or credential harvesting for third-party victims.

Attackers prioritise access to accounts with high transaction limits, weak monitoring, or privileged roles. Service providers, fintechs, and BPOs are particularly targeted because a single access point can reach multiple downstream victims through trusted business relationships.

## What is the link between Access Acquisition and social engineering?

[Phishing for Information](https://arsen.co/en/resources/phishing-for-information), [vishing](https://arsen.co/en/resources/vishing), and insider bribery are primary sources of the credentials sold on underground markets. Organisations that do not train employees against social engineering directly feed the Access Acquisition economy.

## Key takeaways

- Access Acquisition maps to **Resource Development** in MITRE F3.
- Fraud actors buy credentials, session cookies, API keys, and remote access tooling from broker networks.
- This technique skips early attack phases, accelerating time-to-fraud.
- High-limit accounts, privileged roles, and payment processors are the most targeted.
- Social engineering (phishing, vishing, insider threats) is the primary upstream source of sold access.

## What is MITRE Fight Fraud Framework™ (F3)?

The MITRE Fight Fraud Framework (F3) is a curated knowledge base of tactics, techniques, and sub-techniques used by fraud actors in cyber-based financial fraud incidents. Developed by MITRE's Center for Threat-Informed Defense in collaboration with FS-ISAC, JPMorganChase, and Lloyds Banking Group, it provides a common language for fraud-fusion teams to describe, detect, and prevent financial fraud. F3 is modeled after MITRE ATT&CK® and focuses on banking institutions as its initial scope. 

[Explore the F3 Matrix](https://ctid.mitre.org/fraud)