Account Takeover

What it is

Account takeover is the unauthorized control of an existing account. It describes the outcome, not one particular entry method: the attacker may use a stolen password, a hijacked session, an abused recovery process, or a malicious app grant. They can read private data, impersonate you, make purchases, and change recovery details to keep you out.

How it works

After gaining access, the attacker often establishes staying power by changing contact details, enrolling a device, or adding mail-forwarding rules. An email takeover is especially dangerous because password resets for other services arrive there. Some attackers leave your access working so they can monitor silently rather than locking you out immediately.

How people get tricked

A familiar security alert can lead to a fake recovery flow, or a friend can unknowingly send messages from their compromised account. Continued ability to log in does not prove nobody else has access; the attacker may be using a parallel session.

Example scenario

Your email still works, but a new forwarding rule copies bank messages to an unfamiliar address. The attacker uses those messages to learn about accounts and intercept recovery information.

Warning signs

• Unfamiliar sessions, devices, purchases, or sent messages.
• Recovery details or MFA settings change without your approval.
• New email forwarding rules or connected applications appear.

If it happens to you

Start with the provider's official recovery process on a trusted device. Secure your email, change affected credentials, revoke other sessions and app grants, and inspect forwarding and recovery settings. Notify contacts if impersonation occurred and dispute unauthorized transactions with the provider.