Account Takeover (ATO) maps to Initial Access in the MITRE F3 Framework. It specifically covers compromise of financial accounts (online banking, card-issuing platforms, digital wallets) rather than general user or application accounts covered by Compromise Accounts.
Sub-techniques
| Sub-technique | How access is gained |
|---|---|
| Exposed Login Credential | Credential stuffing from breach dumps; keylogger output |
| Exposed API Key | Leaked developer keys from repositories or phishing of technical staff |
| Password Reset Abuse | Intercepting reset links or OTPs; compromising the victim's email first |
What do attackers do after account takeover?
Once inside a financial account, fraud actors typically:
- Change contact details and security settings to lock out the legitimate user
- Add or modify payees for fund transfers
- Redirect incoming deposits or payouts
- Initiate unauthorised transfers and card-not-present transactions
- Harvest additional identity data for downstream fraud
How does social engineering enable ATO?
Phishing and vishing are the primary upstream techniques. A vishing call impersonating a bank ("we've detected suspicious activity") pressures the victim into reading out an OTP; enabling the attacker to complete a password reset or transaction authorisation in real time.
Key takeaways
- Account Takeover in MITRE F3 targets financial accounts specifically, not general IT accounts.
- Three sub-techniques: exposed login credentials, exposed API keys, and password reset abuse.
- Post-compromise actions focus on fund transfer, payee manipulation, and victim lockout.
- Phishing and vishing are the dominant upstream enablers of ATO.
- Contact centre staff training is critical: vishing calls targeting OTP extraction are a primary ATO vector.
What is MITRE Fight Fraud Framework™ (F3)?
The MITRE Fight Fraud Framework (F3) is a curated knowledge base of tactics, techniques, and sub-techniques used by fraud actors in cyber-based financial fraud incidents. Developed by MITRE's Center for Threat-Informed Defense in collaboration with FS-ISAC, JPMorganChase, and Lloyds Banking Group, it provides a common language for fraud-fusion teams to describe, detect, and prevent financial fraud. F3 is modeled after MITRE ATT&CK® and focuses on banking institutions as its initial scope.
