Account takeover fraud is exposing identity control gaps at scale

At a glance

What this is: This is a Seamfix analysis of account takeover fraud showing how reused credentials, phishing and weak manual verification let attackers bypass customer identity controls at scale.

Why it matters: It matters because IAM, CIAM and fraud teams have to treat authentication, recovery and step-up checks as a single attack surface, not separate controls.

By the numbers:

• Account takeover fraud drove nearly $13 billion in losses in 2023.
• Account takeover attacks rose by 354% yearly.

Context

Account takeover fraud is a customer identity problem, not just a fraud operations problem. The attack succeeds when reused passwords, phishing and recovery friction let an attacker present as the legitimate account holder while the business keeps trusting the same identity evidence.

The article argues that manual verification and weak recovery flows are the soft points most attackers exploit. That puts CIAM, identity proofing and transaction verification into the same governance conversation, especially where customer trust and regulatory exposure are on the line.

Key questions

Q: What breaks when account takeover controls still rely on reused passwords and manual checks?

A: The control breaks at the point where an attacker can satisfy the system with stolen credentials and then pass through predictable recovery or review steps. At that stage, the business is no longer validating identity, only replaying trust. That is why account takeover often survives basic MFA and still reaches customer data or payments.

Q: Why do reused credentials and phishing create such high takeover risk?

A: Reused credentials turn one stolen password into many possible entry points, while phishing supplies the attacker with the secret or the confidence to bypass it. Together, they collapse the distance between compromise and account access, especially when the business does not add device, behaviour or transaction-based checks.

Q: What are the signs that account takeover controls are too weak or too disruptive?

A: Weak controls usually show up as repeated login anomalies, suspicious password reset activity, sudden changes in device or location patterns, and account abuse that slips through unchanged. Overly disruptive controls show the opposite pattern, with rising abandonment, repeated challenge failures, and complaints from legitimate users. The practical test is whether risk signals are reducing fraud without creating excessive friction.

Q: Should organisations prioritise biometric verification or stronger recovery controls first?

A: Recovery controls usually deserve priority because they are the bridge attackers use when a password has already been stolen or reused. Biometrics can reduce impersonation risk, but they do not help if the account can be reclaimed through weak fallback paths. The sequencing should reflect where takeover actually succeeds in the customer journey.

Technical breakdown

How credential stuffing turns reused passwords into account access

Credential stuffing is the automated testing of stolen username and password pairs against many accounts until one works. It scales because password reuse is common, so a single breach elsewhere can unlock accounts across unrelated services. The control failure is not only weak password policy, but the absence of risk-based detection at login, device and session level. When the attacker can appear as a normal customer from a valid location or device, the authentication layer becomes an entry point rather than a barrier.

Practical implication: tune fraud and IAM controls to detect reuse patterns, impossible logins and scripted retries before an account is taken over.

Why manual verification breaks under social engineering

Manual verification assumes a human reviewer can reliably distinguish a genuine customer from a convincing impostor using documents, answers or scripted prompts. In practice, social engineering exploits predictable processes, and counterfeit or stolen identity evidence can satisfy a brittle workflow. The result is a governance gap between identity proofing and ongoing account trust. Where verification depends on the reviewer instead of the identity evidence, attackers can target the process itself rather than the account directly.

Practical implication: remove high-risk manual exceptions from recovery and onboarding paths that determine account trust.

Biometric verification and liveness detection as anti-takeover controls

Biometric verification checks whether the person presenting the identity is physically present and matches the enrolled identity, while liveness detection tries to block photos, replays and deepfake-style impersonation. These controls shift some trust away from what a customer knows toward what they are and whether they are present. That matters most when the business permits high-value transactions, account recovery or remote onboarding. The limitation is that biometrics reduce some takeover paths but do not replace lifecycle governance, step-up policy or fraud monitoring.

Practical implication: use biometrics and liveness as one layer in a broader customer identity control stack, not as a standalone answer.

Threat narrative

Attacker objective: The attacker wants to impersonate the legitimate customer well enough to move money, access data or abuse account controls without immediate detection.

1. Entry begins with stolen credentials or successful phishing that gives the attacker a working customer identity surface to test.
2. Escalation follows when credential stuffing or social engineering bypasses weak manual verification and recovery checks.
3. Impact is account takeover, with fraud losses, customer trust erosion and downstream compliance exposure.

Breaches seen in the wild

• 23andMe credential stuffing 2023: Credential stuffing into 18,000 accounts exposed nearly 7 million people through the DNA Relatives feature.
• SonicWall SSL VPN account compromises 2025: Attackers used valid credentials to log in to more than 100 SonicWall SSL VPN accounts across 16 environments in October 2025.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Account takeover is an identity governance problem disguised as fraud. The article shows that attackers do not need to break encryption or defeat core platform security when password reuse, recovery design and manual review already create a weak trust boundary. The practical conclusion is that CIAM, fraud and IAM controls must be governed as one customer identity system.

Reused credentials create the primary trust debt in customer identity programmes. The article's 78% password reuse figure explains why stuffing remains effective even when organisations believe individual accounts are protected. Once a password is reused, the attacker is no longer attacking one account, but a trust relationship that extends across services and sessions.

Manual verification is the wrong control plane for modern account takeover. Human review was designed for low-volume exceptions, not for adversaries who can industrialise deception at scale. The governance implication is that high-risk account actions need stronger evidence than a scripted human judgement can provide.

Biometric consent and liveness detection sharpen the distinction between possession, presence and legitimacy. That distinction matters because account takeover often succeeds when a business treats one signal as proof of all three. Practitioners should treat these controls as identity evidence inputs, not as proof that the account itself is safe.

Customer identity programmes need a fraud-aware control model, not a login-only model. The article connects onboarding, authentication, transaction approval and analytics into one attack surface, which is the right way to think about modern account takeover. The field should move from point controls to governed identity journeys.

From our research library:

• Stolen credentials were involved in 22% of breaches overall and in 88% of basic web application attacks, according to Verizon's 2025 Data Breach Investigations Report.
• Read next: Customer IAM (CIAM) Guide

What this signals

Customer takeover is rarely a single-control failure. It usually emerges when authentication, recovery and transaction approval each assume the others are trustworthy. That means programme owners need one governance view across CIAM, fraud and identity proofing rather than three disconnected control sets.

Identity journeys need stronger proof at the moments that matter most. When an attacker can get through password reuse, then use recovery to stabilise access and finally authorise a transaction, the business has a process design problem, not just an authentication problem. The control strategy should follow the journey, not the login screen.

For practitioners

• Reduce password reuse exposure Measure how often customers reuse passwords across services and use that signal to prioritise stronger step-up controls on risky sessions.
• Remove brittle manual verification paths Eliminate recovery and exception workflows that rely on static questions or predictable human review when they can be bypassed by social engineering.
• Apply risk-based step-up to high-value actions Require stronger verification for transfers, profile changes and account recovery instead of treating every authenticated session as equally trusted.
• Use liveness checks where impersonation risk is highest Place biometric liveness controls on onboarding and high-risk transaction flows where a replayed image or counterfeit identity document would otherwise pass.
• Correlate identity signals across the journey Join authentication, device, location, transaction and recovery signals so that fraud patterns are visible before account takeover completes.

Key takeaways

• Account takeover fraud exposes gaps in how businesses govern customer authentication, recovery and verification as one identity journey.
• The article points to nearly $13 billion in losses and a 354% yearly rise, which shows the attack is scaling faster than many control models.
• The most effective response is to close weak recovery paths, reduce password reuse exposure and add stronger verification at high-risk actions.

Key terms

• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Credential Stuffing: Credential stuffing is an attack that uses stolen username and password pairs from previous breaches to try logging into other services. It works because many people reuse credentials, and because the login attempt uses valid information, it can look ordinary until the surrounding behavior gives it away.
• Identity proofing: The process of verifying that a person is who they claim to be before granting or restoring access. In higher-risk recovery paths, proofing can include stronger evidence checks such as government ID validation or liveness-based facial verification so the assurance level matches the sensitivity of the request.
• Liveness Detection: Liveness detection is the mechanism that checks whether a biometric sample comes from a real, present person rather than a spoof such as a photo, screen, or mask. In identity programmes, it is a core defence against presentation attacks and should be tested under realistic operating conditions.

Deepen your knowledge

Identity lifecycle management, secrets management, and workload identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.