ATO prevention tips highlight the limits of legacy MFA

At a glance

What this is: This is a SecureAuth guide on preventing account takeover, with the central finding that legacy MFA alone does not stop credential-based compromise.

Why it matters: It matters because IAM teams protecting customer and workforce identities need controls that reduce credential reuse, automate anomaly detection, and harden recovery paths, not just add another authentication factor.

By the numbers:

• Account takeover attacks are increasing 65% year over year, according to SecureAuth.
• The article cites 24B credentials exposed in breaches, according to SecureAuth.
• SecureAuth says the average cost per account takeover incident is $12K.

Context

Account takeover is what happens when an attacker turns stolen, guessed, or socially engineered credentials into account access. The security gap is not only in authentication strength, but in the surrounding controls that decide whether suspicious login attempts, reset requests, and device changes are challenged or allowed through.

For customer identity programmes, that means the real control surface extends beyond MFA prompts. Password screening, bot resistance, behavioural signals, account lockout logic, device recognition, and secure recovery flows all determine whether a compromised credential becomes a live incident or a blocked attempt.

Key questions

Q: What breaks when MFA is the main control for bank account takeover?

A: MFA breaks down when attackers use man-in-the-middle phishing, credential replay, or session hijacking to complete the challenge in real time. In those cases, the control proves the user responded, but not that the channel was trustworthy. Banks need phishing-resistant authentication, device and session risk signals, and transaction controls that can interrupt misuse after sign-in.

Q: Why do stolen credentials still lead to account takeover in mature environments?

A: Because authentication alone does not prove intent or legitimacy. If attackers can reuse valid credentials, bypass weak recovery flows, or blend into normal session patterns, they can still gain control. Mature environments need contextual detection, not just strong passwords or MFA in isolation.

Q: How do you know if account takeover controls are actually working?

A: Look for reduced successful takeovers, lower fraud losses, and preserved good-user throughput at the same time. If false positives rise sharply or attackers simply shift tactics while account compromise stays flat, the control is creating friction without changing outcomes.

Q: When should organisations prioritise passkeys over legacy second-factor methods?

A: Organisations should prioritise passkeys when the main problem is user friction, phishing exposure, or the operational burden of issuing and replacing physical authenticators. Passkeys are most valuable when the business needs stronger authentication without the deployability pain that comes with tokens or the password reset overhead that traditional login systems create.

Technical breakdown

Why legacy MFA does not stop credential stuffing

Legacy MFA reduces some password-only attacks, but it does not remove the value of stolen credentials when the second factor is weak, phishable, or reused across services. Credential stuffing succeeds because attackers automate large-scale login attempts against known username and password pairs, then exploit any account that still accepts them. If the surrounding controls do not distinguish a legitimate user from a scripted login flood, MFA becomes a checkpoint rather than a barrier. The better model is layered access assurance, where authentication, device context, and behavioural signals are evaluated together.

Practical implication: treat MFA as necessary but insufficient and add controls that detect automated reuse of breached credentials.

Why password reset and device recognition are part of account security

Reset flows and device checks are often where account takeover succeeds after initial authentication fails. A weak reset path lets an attacker bypass login protections by exploiting email access, knowledge-based recovery, or poorly governed help-desk processes. Device recognition adds friction when a login comes from a new or suspicious endpoint, while impossible-travel and notification controls surface anomalies that a password prompt will never catch. In practice, these controls govern the transition from attempted access to durable session establishment, which is where account takeover becomes operational.

Practical implication: review recovery and device-trust controls with the same urgency as primary authentication.

How behavioural analytics changes the account takeover model

Behavioural biometrics and continuous risk scoring shift the control point from a one-time login decision to ongoing session evaluation. That matters because account takeover is not always obvious at sign-in; attackers may wait, pivot, or imitate normal user timing once inside. Behavioural analytics looks for patterns such as typing rhythm, navigation style, location inconsistency, and login cadence that deviate from the account's normal baseline. Used well, these controls do not replace authentication. They make stolen credentials less useful by reducing the attacker's ability to operate without raising risk signals.

Practical implication: use behavioural signals to detect misuse after authentication, not just to gate the first login.

Threat narrative

Attacker objective: The objective is to turn ordinary account credentials into monetisable access that can be used for fraud, theft, or abuse without triggering strong friction.

1. Entry begins with credential stuffing, phishing, or social engineering that yields valid customer credentials or access to a password reset path.
2. Escalation occurs when the attacker bypasses weak MFA, abuses automated login handling, or completes a recovery flow that does not adequately challenge the request.
3. Impact follows when the attacker takes over the account to commit fraud, steal data, or damage the brand through unauthorised activity.

Breaches seen in the wild

• 23andMe credential stuffing 2023: Credential stuffing into 18,000 accounts exposed nearly 7 million people through the DNA Relatives feature.
• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Account takeover prevention is no longer an MFA problem alone: the control failure is broader than authentication strength. Legacy MFA reduces some risk, but credential stuffing, phishing, and reset abuse move the battle to the surrounding account lifecycle. The implication is that identity teams must treat login, recovery, device trust, and alerting as one control plane rather than separate features.

Reset flows are the most underestimated account takeover pathway: attackers do not need to beat primary authentication if they can manipulate account recovery. That makes the password reset journey a governance surface, not a support function. The implication is that the weakest operational process often becomes the highest-risk access path.

Behavioural controls change the economics of stolen credentials: a password is only useful if the attacker can act like the legitimate user long enough to profit. Continuous scoring, device recognition, and login notifications reduce that window. The implication is that account takeover defence has to be judged by attacker friction, not by the number of factors deployed.

Identity assurance for consumer accounts needs lifecycle thinking, not point control thinking: the article's advice spans authentication, screening, bot detection, device recognition, and reset hardening because no single control closes the gap. That is the right pattern for customer identity programmes. The implication is that practitioners should design for chained controls that fail safely rather than isolated gates that fail silently.

From our research library:

• Across one million observed logins, 1 in 4 were password-based rather than SSO, 2 in 5 were not protected by MFA and 1 in 5 used a weak, breached or reused password.

What this signals

Passwordless reduces one attack object, not the whole account-takeover surface: moving away from reusable passwords helps, but recovery abuse, device trust, and session monitoring still determine whether an attacker can convert access into impact. Identity programmes should therefore judge controls by the full path from login to recovery to session use.

Consumer identity needs layered fraud controls, not single-point authentication: customer accounts are often attacked by automation at scale, which means bot resistance and behavioural analytics are as important as the login method itself. Teams that only upgrade MFA without reworking the rest of the access journey leave the highest-risk paths open.

For practitioners

• Harden password reset flows Require strong recovery verification, remove brittle knowledge-based checks, and monitor recovery events as high-risk access changes.
• Block automated credential stuffing Use bot detection, rate limiting, and breached-password screening to reduce high-volume login abuse without causing lockout denial of service.
• Add device and location context Flag new devices, impossible travel, and unusual login patterns so risk increases before the attacker can establish a trusted session.
• Move toward passwordless access Adopt passkeys or hardware-backed authentication where possible so there is no reusable password to steal and replay across accounts.
• Instrument post-login anomaly monitoring Correlate behavioural biometrics, login notifications, and continuous risk scoring to spot account abuse after authentication succeeds.

Key takeaways

• Account takeover succeeds when credentials, recovery paths, and behavioural gaps line up, not just when MFA is weak.
• The article ties account takeover to a very large breach-exposure base and a material per-incident cost, which makes prevention a governance issue rather than a UI issue.
• Practitioners should harden reset flows, screen breached passwords, and add device and behavioural controls so stolen credentials cannot be turned into durable access.

Key terms

• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Phishing-Resistant MFA: Phishing-resistant MFA uses authentication factors that cannot be easily replayed, intercepted, or socially engineered. In regulated environments, this usually means device-bound or cryptographic methods rather than push prompts or SMS codes, because the control must hold up under realistic attack conditions.
• Behavioral Biometrics: Behavioral biometrics uses patterns such as typing rhythm, swipe style, device handling, and session timing to infer whether the same user is still present. In practice, it supports continuous verification, but it also demands careful tuning because legitimate behavior can change with context.
• Credential Stuffing: Credential stuffing is an attack that uses stolen username and password pairs from previous breaches to try logging into other services. It works because many people reuse credentials, and because the login attempt uses valid information, it can look ordinary until the surrounding behavior gives it away.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.