# What is Account Takeover?
Source: https://arsen.co/en/resources/account-takeover
Summary: Account Takeover is when fraud actors gain unauthorised control of bank or payment accounts using stolen credentials, phishing, or MFA bypass.

**Account Takeover (ATO) maps to Initial Access in the [MITRE F3 Framework](https://ctid.mitre.org/fraud). It specifically covers compromise of financial accounts (online banking, card-issuing platforms, digital wallets) rather than general user or application accounts covered by [Compromise Accounts](https://arsen.co/en/resources/compromise-accounts).**

## Sub-techniques

| Sub-technique | How access is gained |
|---|---|
| Exposed Login Credential | Credential stuffing from breach dumps; keylogger output |
| Exposed API Key | Leaked developer keys from repositories or phishing of technical staff |
| Password Reset Abuse | Intercepting reset links or OTPs; compromising the victim's email first |

## What do attackers do after account takeover?

Once inside a financial account, fraud actors typically:

1. Change contact details and security settings to lock out the legitimate user
2. Add or modify payees for fund transfers
3. Redirect incoming deposits or payouts
4. Initiate unauthorised transfers and card-not-present transactions
5. Harvest additional identity data for downstream fraud

## How does social engineering enable ATO?

[Phishing](https://arsen.co/en/resources/phishing) and [vishing](https://arsen.co/en/resources/vishing) are the primary upstream techniques. A vishing call impersonating a bank ("we've detected suspicious activity") pressures the victim into reading out an OTP; enabling the attacker to complete a password reset or transaction authorisation in real time.

## Key takeaways

- Account Takeover in MITRE F3 targets financial accounts specifically, not general IT accounts.
- Three sub-techniques: exposed login credentials, exposed API keys, and password reset abuse.
- Post-compromise actions focus on fund transfer, payee manipulation, and victim lockout.
- Phishing and vishing are the dominant upstream enablers of ATO.
- Contact centre staff training is critical: vishing calls targeting OTP extraction are a primary ATO vector.
	

## What is MITRE Fight Fraud Framework™ (F3)?

The MITRE Fight Fraud Framework (F3) is a curated knowledge base of tactics, techniques, and sub-techniques used by fraud actors in cyber-based financial fraud incidents. Developed by MITRE's Center for Threat-Informed Defense in collaboration with FS-ISAC, JPMorganChase, and Lloyds Banking Group, it provides a common language for fraud-fusion teams to describe, detect, and prevent financial fraud. F3 is modeled after MITRE ATT&CK® and focuses on banking institutions as its initial scope. 

[Explore the F3 Matrix](https://ctid.mitre.org/fraud)