Why do account takeovers remain a serious risk even when organisations block suspicious geographies and domains?

Geography and domain filtering help, but they do not address the core problem. Attackers often operate through legitimate cloud services, shared hosting, or normal user infrastructure, which makes source based blocking incomplete. Account takeover risk persists because the attacker’s goal is to look legitimate at login time, then exploit valid access after compromise.

Why source-based blocking cannot stop account takeover

Blocking geographies and domains can remove some obvious abuse paths, but account takeover is usually not driven by a fixed source location. Attackers can route through legitimate cloud infrastructure, residential proxies, shared hosting, or compromised user devices, so the login attempt often looks ordinary enough to pass simple reputation rules.

That is why the real security problem is not where the request comes from, it is whether the credential, session, or recovery path has already been abused. Controls that only inspect origin miss attackers who behave like normal users after compromise, especially when they use valid credentials, familiar browsers, and low-and-slow patterns.

Geography and domain filtering still have value as friction, but they are best treated as one signal in a wider detection and response stack. In practice, they help most when paired with stronger authentication, risk-based challenges, session monitoring, and limits on recovery abuse. Customer identity guidance from Customer IAM (CIAM) Guide covers that broader approach.

How attackers stay legitimate after they get in

Account takeover succeeds when the attacker can blend into expected user behaviour. Once a valid login exists, the actor may not need noisy infrastructure, obvious phishing pages, or repeated password spraying. They can use the victim’s own access paths, session tokens, and trusted application flows to move quietly through the account.

This is why source reputation is such a weak boundary on its own. A blocked domain may stop a known bad host, but it does not stop credential stuffing, token replay, help-desk recovery abuse, or post-login activity from a clean-looking source. The compromise point is the identity, not the IP address.

Real-world breach patterns show the same theme. The 23andMe credential stuffing 2023 case is a clear example of reused passwords defeating perimeter-style assumptions. For a broader example of stolen credentials being used to hijack trusted accounts, see GitLocker GitHub extortion campaign.

What organisations should treat as the real control boundary

The useful control boundary is not source country or source domain, it is authentication strength, post-login anomaly detection, and recovery integrity. Organisations should assume an attacker may arrive through a legitimate hosting platform, then focus on what happens when the login itself is suspicious, even if the network origin is not.

That means looking for unusual combinations such as new device, new browser, impossible travel, unfamiliar session behaviour, rapid privilege changes, or access immediately after a recovery event. It also means limiting reliance on filters that are easy to route around. The most resilient programmes combine step-up checks, session revocation, recovery hardening, and privileged-action controls.

When compromise is possible through ordinary-looking infrastructure, access governance becomes more important than origin blocking. Customer IAM (CIAM) Guide is useful here because it ties account takeover prevention to authentication, recovery, and fraud-resistant user journeys rather than just perimeter filtering.

Risk and Threat Considerations

Geography and domain blocking can create false confidence because they are easy to observe but easy to evade. The exposure is not only failed detection, it is delayed detection: once an attacker has valid access, they can operate through normal services and remain inside the trust boundary long enough to do damage.

Failure mechanism: The defender is filtering on source reputation while the attacker is using legitimate infrastructure, valid credentials, or compromised sessions. That breaks the assumption that suspicious origin equals suspicious activity, and it leaves post-login abuse largely untouched.

Impact: Organisations can miss active account compromise, fraudulent transactions, data access, or privilege escalation until the attacker has already used the account. In practice, the longer the attacker can behave like a real user, the harder it becomes to distinguish abuse from legitimate activity.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP Non-Human Identity Top 10 and MITRE ATT&CK address the attack and risk surface, while NIST SP 800-53 Rev 5 and NIST SP 800-63 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP Non-Human Identity Top 10	NHI-04 — Insecure Authentication	Source-based blocking fails when login weakness lets attackers enter through valid auth.
	NHI-01 — Improper Offboarding	Stale access and recovery paths help attackers retain valid account access after compromise.
	NHI-07 — Long-Lived Secrets	Persisting tokens and secrets let attackers operate normally after an initial compromise.
Recommendation — Harden authentication to resist credential stuffing, replay, and other login abuse. Revoke dormant access and recovery routes quickly to shrink takeover window. Rotate or expire secrets and sessions to limit post-compromise reuse.
NIST SP 800-53 Rev 5	IA-2 — Identification and Authentication (Organizational Users)	Account takeover is prevented by stronger user authentication, not only by source filters.
	AC-7 — Unsuccessful Logon Attempts	Credential-stuffing and repeated login abuse are central to takeover attempts.
	IA-5 — Authenticator Management	Credential lifecycle controls reduce the value of stolen passwords and tokens.
Recommendation — Require stronger authentication for user sign-in and step-up access. Throttle repeated sign-in attempts and lock out abuse patterns. Enforce secure issuance, rotation, storage, and revocation of authenticators.
NIST SP 800-63	AAL2 — Authenticator Assurance Level 2	Phishing-resistant or stronger assurance reduces takeover risk from ordinary-looking sources.
Recommendation — Require higher-assurance authentication for accounts with meaningful exposure.
MITRE ATT&CK	T1110 — Brute Force	Credential stuffing and repeated login attempts are core account-takeover mechanics.
Recommendation — Detect and rate-limit repeated authentication abuse.

Practitioner Guidance

What to prioritise: Treat source blocking as a supporting signal, not the control that decides whether account takeover is possible. Prioritise authentication strength, recovery-hardening, and detection of suspicious post-login behaviour because those are the points that determine whether a valid login becomes a breach.

What to verify: Validate that risk-based authentication, step-up challenges, and session controls still trigger when the attacker comes from clean infrastructure. If those controls only react to bad IPs or known bad domains, your programme is depending on the wrong boundary.

Practitioner takeaway: Account takeover is an identity problem first and an origin problem second, so resilient defence has to focus on who is authenticated, how recovery is protected, and what the account does after login.