Account Takeover Fraud: How to Spot It
A thief logs into your customer's account, not yours. Here is how that turns into fraud at your checkout, and what to watch for.
A customer you know places an order. The name is right. The saved card is right. The shipping address is new. The order is real, but the person placing it is not.
What is account takeover fraud?
Account takeover fraud is when a thief gets into someone else's account and uses it. In a store, this usually means logging into a customer's account. Then the thief buys with the card saved there.
It is not the same as first-party fraud. In first-party fraud, the real customer buys and then disputes the charge. Here, the real customer never placed the order at all.
How an account takeover happens
The first signs show up at login. Stripe's guide says machine learning can detect account takeover attempts by watching for multiple failed logins or logins from new devices or locations.
The saved card makes the payment easy.
Account takeover fraud examples
A common pattern: several failed logins, then one that works. Another: one device is linked to many customer accounts.
Why it matters for merchants
The card is real, so the payment clears. A sale made by a fraudster can come back to you as a chargeback later on. You lose the goods and the money.
Any store with customer accounts and saved cards is open to it.
Warning signs a merchant can watch for
Watch for these on the order and the account:
-
Many failed logins before one succeeds
-
A login from a new device or location
-
Odd login patterns that do not fit the customer
-
Several accounts reached from one device
One sign alone is weak. Several together should make you hold the order.
How fraud detection tools can help
Stripe's guide says machine learning is a tool increasingly used in fraud detection. It can look through huge amounts of data. Stripe's guide says machine learning can detect account takeover attempts by watching for multiple failed logins or logins from new devices or locations. It can also spot takeovers. It can see when one device is tied to many accounts.
Stripe's article also covers behavior. Stripe's article says machine learning can analyze user behavior patterns, such as typing speed or swipe gestures, to verify identity and detect anomalies. It can also watch how and when people log in. Odd login habits can point to an attempt. Check the provider's own docs to see what its tool covers. Check its pricing page for cost.
Where to go next
Start with account takeover fraud prevention to stop the break-in. Then use account takeover fraud detection to catch it as it happens. For a broader look at how these tools work, see AI fraud detection.