Quiet brokerage accounts turn credential theft into wire fraud

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Socure's blog post: Quiet brokerage and investment accounts can be taken over with stolen credentials and hijacked codes, and low activity makes fraudulent transfers harder to spot.

Why it matters: Fraud, IAM, and identity teams need stronger session and behavioural corroboration because one credential or one OTP no longer proves the legitimate customer is present.

By the numbers:

• Account takeover losses reached $15.6 billion in 2024, up from $12.7 billion the year before.

Context

Brokerage account takeover is a fraud problem, but it is also an identity-governance problem because access can be granted by a credential, an OTP, or a recovered session without proving the person behind the account is legitimate. Low-frequency account use makes that governance harder, since behavioural baselines are thin and recovery paths are often weaker than day-to-day login controls.

The pattern matters because fraud rings do not need to compromise the full customer identity when they can exploit reset flows, hijacked one-time codes, or SIM porting to obtain a working authentication path. That turns the account itself into the control plane, and it is a familiar weakness in customer identity governance when recovery and session trust are not tied together.

Key questions

Q: What should teams prioritise after an account takeover is suspected?

A: Teams should contain the compromised session, review connected email and application activity, and look for other accounts showing the same behavioural pattern. The goal is to stop continued trusted-account misuse before the attacker completes additional actions through the same workflows.

Q: Why do low-activity accounts make account takeover fraud easier?

A: Low-activity accounts have sparse behavioural history, so fraud systems have fewer signals to distinguish the real user from an impostor. That makes takeover easier when an attacker can pair stolen credentials with familiar device, location or session patterns. Risk-based authentication and step-up verification help here.

Q: How does a SIM swap lead to account takeover?

A: A SIM swap lets an attacker receive SMS one-time codes and password reset links sent to the victim’s phone number, which can bypass weak account recovery. Once the mobile number is moved, recovery prompts and SMS-based MFA may be captured by the attacker instead of the real user.

Q: What is the difference between credential stuffing and account recovery abuse?

A: Credential stuffing uses stolen username and password pairs to try logins at scale, while account recovery abuse targets password reset and support workflows to seize access without the original password. The first attacks the login control, the second attacks the recovery path, often using weak identity proofing or help desk checks.

Technical breakdown

Why low-activity accounts weaken behavioural detection

Behavioural detection works by comparing a new login or transaction against a historical pattern of devices, locations, session timing, and transfer behaviour. When an account is used only a few times a year, the system has little reliable history, so an unusual beneficiary change or transfer may still look plausible. This is not a failure of detection alone. It is a data sparsity problem that weakens risk scoring and makes outlier analysis less trustworthy. See the Identity Fraud Prevention Guide.

Practical implication: Tune step-up review and transfer approval thresholds more aggressively for dormant or low-frequency accounts.

How credential and code interception becomes account control

Account takeover often starts before the login against the target institution. Attackers reuse breached credentials, then combine them with hijacked one-time codes, SIM swap access, or reset flows to satisfy authentication checks. Once they hold a working login path, they do not need to impersonate every customer attribute. They only need enough trust to reach the transaction boundary, where weak recovery and weak session binding become the real problem. See the Secure Password Reset Flow Guide.

Practical implication: Bind authentication, recovery, and session controls so a reset or OTP alone cannot establish durable trust.

Why multi-signal identity corroboration beats single-factor trust

Single signals are easy to fake in isolation. A credential may be stolen, a device may be emulated, and an OTP may be intercepted, but all of those together still need to align with session history and device behaviour. Corroboration means the system evaluates consistency across identity, device, and session context rather than treating any one factor as sufficient. That model raises the cost of fraud because it forces the attacker to satisfy multiple independent checks at once.

Practical implication: Correlate device, session, and identity evidence before approving high-risk transfers or profile changes.

Threat narrative

Attacker objective: The attacker wants to convert stolen or recovered access into a fraudulent transfer before the account holder or firm notices.

1. Entry occurs when fraudsters test breached credentials or obtain access through a reset path, intercepted one-time code, or SIM swap.
2. Credential access succeeds when the attacker pairs a working login with a compromised authentication factor and reaches the account.
3. Impact follows when the quiet account is used for beneficiary changes or wire transfers that blend into sparse behavioural history.

Breaches seen in the wild

• 23andMe credential stuffing 2023: Credential stuffing into 18,000 accounts exposed nearly 7 million people through the DNA Relatives feature.
• Twilio 0ktapus breach 2022: SMS phishing of employees exposed 209 Twilio customers and 1,900 Signal users, part of the 0ktapus campaign against 130+ firms.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Quiet accounts create a governance blind spot, not just a fraud gap. Low-activity brokerage and retirement accounts generate too little behavioural history for the controls to distinguish routine from abnormal with confidence. That means the access problem is not only whether a login succeeds, but whether the organisation can establish that the session belongs to the real customer before value moves. Practitioner implication: treat inactivity as a risk amplifier, not a neutral state.

Reset and recovery are the real trust boundary in brokerage ATO. If a call-centre reset, hijacked OTP, or SIM port can produce a working credential, the identity programme has already accepted a weaker proof than the transaction deserves. The governance failure is allowing recovery paths to outrank the evidence needed for wire-level authority. Practitioner implication: separate recovery eligibility from transaction eligibility and review them as distinct control paths.

Cross-signal corroboration is the named control concept this problem demands. A credential can be stolen, a device can be spoofed, and a one-time code can be intercepted, but the attacker still has to make the whole identity story line up. That is why identity fraud prevention increasingly depends on device, session, and identity consistency rather than one-off authentication events. Practitioner implication: score the consistency of signals, not just the success of login steps.

Fraud detection should move from event-based checks to relationship-based trust. The article’s core lesson is that a single login or transfer event is too small to govern by itself when the customer’s account is rarely used. Relationship-based trust looks at how the account, device, session, and historical behaviour relate over time. Practitioner implication: build transfer approval logic around longitudinal trust, not isolated authentication results.

What this signals

Low-frequency account trust becomes the new attack surface. As more financial accounts sit unused for months at a time, behavioural trust decays faster than many fraud programmes assume. The practical response is to treat inactivity as a control signal in its own right and to raise the bar before any transfer or profile change leaves the account.

Recovery-channel trust is now a fraud decision, not a help-desk detail. When a reset path can hand over a working credential, the organisation is effectively promoting that channel into an authentication factor. That makes recovery design, logging, and escalation thresholds central to brokerage fraud defence.

For practitioners

• Harden account recovery as a privileged path Treat call-centre resets, OTP recovery, and SIM-based recovery as elevated-risk events that require tighter verification and stronger audit logging than normal login flows.
• Correlate device and session history before payment release Block or step up review when a low-activity account shows a new device, unusual session timing, or an atypical transfer pattern that does not match prior behaviour.
• Separate dormant-account rules from active-account rules Apply stricter transfer thresholds, beneficiary-change checks, and analyst review to accounts with sparse login history or long periods of inactivity.
• Feed cross-institution fraud signals into decisioning Use consortium or external fraud intelligence to identify credentials that have already been tested or flagged elsewhere before approving access or high-risk activity.

Key takeaways

• Quiet brokerage accounts are easier to abuse because sparse login history weakens behavioural detection and lets fraudulent activity blend in.
• The strongest evidence in the source is the scale of the problem, with account takeover losses reaching $15.6 billion in 2024.
• Fraud programmes need corroborated device, session, and identity signals, because a single credential or one-time code no longer proves legitimacy.

Related NHI Mgmt Group resources: Account Takeover Prevention Guide · Identity Fraud Prevention Guide · Secure Password Reset Flow Guide · MFA backup codes and recovery codes guide

Key terms

• Account Takeover: Account takeover is unauthorized use of a legitimate account after an attacker obtains valid access through stolen credentials, tokens, or trusted integrations. The key security problem is that the resulting activity often looks normal to logs and controls, which makes containment and attribution harder than in a forced-entry breach.
• Credential Stuffing: Credential stuffing is an attack that uses stolen username and password pairs from previous breaches to try logging into other services. It works because many people reuse credentials, and because the login attempt uses valid information, it can look ordinary until the surrounding behavior gives it away.
• One-Time Code (OTC): One-Time Code (OTC) is a short-lived authentication code used once to verify a login, transaction, or recovery step. It is usually delivered by SMS, email, an authenticator app, or a hardware token, and is distinct from a reusable password because the code expires after single use or a brief time window.
• SIM swap: A takeover technique in which an attacker convinces a mobile carrier to move a victim’s phone number to a SIM card the attacker controls. Once successful, the attacker can receive SMS messages and intercept one-time codes, turning the phone number into a compromise path rather than a factor.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, workload identity, and secrets management. It helps security and IAM practitioners connect identity controls to the broader security programme.