Account takeover

What it is

Once inside, attackers can reset other passwords, order goods, transfer money, or impersonate you to your contacts. Email and phone accounts are especially valuable because they sit at the center of password resets.

Takeovers often start with phishing, credential stuffing, malware, SIM swapping, or passwords reused from a breach.

How it works

1. Access — Stolen or guessed credentials, session theft, or SIM swap gets the attacker in.
2. Lockout — They change your password, MFA methods, or recovery email/phone.
3. Monetize — Purchases, transfers, crypto drains, or spam to your contacts.
4. Pivot — Your email is used to reset banking, social, and work accounts.
5. Social media takeover is the same pattern aimed at profiles used for reputation and social engineering.

Red flags

• Password-reset emails or MFA prompts you did not request
• Being locked out of an account that worked yesterday
• Sent messages or orders you did not make
• New devices, sessions, or forwarding rules you do not recognize
• Friends asking about weird requests from you
• Recovery phone/email changed without your approval

What to do if you’re targeted

• **Recover the account** via official account recovery flows; secure email and phone first.
• **Change passwords** and revoke sessions/apps; turn on MFA (prefer app or hardware keys over SMS when you can).
• **Check forwarding rules, recovery contacts, and connected apps.**
• **Warn contacts** if your account messaged them; report fraud to the platform and your bank if money moved.
• **Review other logins** that used the same password.
• **Optional:** free identity scan and monitoring for dark web dumps that may explain how access started.

Related terms

• Credential stuffing
• Social media takeover
• SIM swapping