# What are Compromised Accounts?
Source: https://arsen.co/en/resources/compromise-accounts
Summary: Compromised Accounts is a resource development technique. Fraud actors take over email, social, cloud, and corporate accounts to impersonate trusted people.

**Compromised Accounts maps to Resource Development in the [MITRE F3 Framework](https://ctid.mitre.org/fraud). Rather than building fake personas from scratch, fraud actors hijack real accounts, taking advantage of the trust and credibility already established with the victim's contacts.**

## Sub-techniques

| Sub-technique | Primary Risk |
|---|---|
| Email Accounts | Thread hijacking, phishing from a trusted sender |
| Corporate Accounts | Fraudulent payment authorisations, BEC |
| Cloud Accounts | Infrastructure abuse, mass phishing via SaaS |
| Social Media Accounts | Spear-phishing via trusted connections |

#### How are accounts compromised?

- **[Phishing for Information](https://arsen.co/en/resources/phishing-for-information)**: Fake login pages harvest credentials directly.
- **Credential purchases**: Third-party breach dumps sold on underground markets.
- **Brute force**: Password reuse exploited through credential stuffing.
- **Insider access**: Employees or partners bribed or coerced into providing credentials.

## Why is account compromise more dangerous than a fresh fake account?

An existing email thread, a known LinkedIn profile, or a recognised corporate address dramatically increases victim trust. A fraud actor operating from a compromised account does not need to build rapport: it already exists. This is what makes business email compromise (BEC) and thread hijacking so effective: the victim sees a familiar sender and conversation history.

## Key takeaways

- Compromise Accounts is a **Resource Development** technique in MITRE F3 with four sub-techniques.
- Attackers prefer compromised real accounts over fabricated ones because trust is pre-established.
- Email and corporate account compromise directly enables [phishing](https://arsen.co/en/resources/phishing), BEC, and wire fraud.
- Cloud account compromise enables infrastructure abuse: mass phishing via AWS SES, SendGrid, or Twilio.
- Social media account compromise supports spear-phishing via direct messages on trusted platforms.
	

## What is MITRE Fight Fraud Framework™ (F3)?

The MITRE Fight Fraud Framework (F3) is a curated knowledge base of tactics, techniques, and sub-techniques used by fraud actors in cyber-based financial fraud incidents. Developed by MITRE's Center for Threat-Informed Defense in collaboration with FS-ISAC, JPMorganChase, and Lloyds Banking Group, it provides a common language for fraud-fusion teams to describe, detect, and prevent financial fraud. F3 is modeled after MITRE ATT&CK® and focuses on banking institutions as its initial scope. 

[Explore the F3 Matrix](https://ctid.mitre.org/fraud)