Account takeover

Account takeover, explained

Account takeover, often shortened to ATO, is when an attacker gets into your account and locks you out or uses it for their own purposes. Common routes include reused passwords leaked from another site, phishing pages, smishing texts that trick you into sharing a verification code, SIM swaps that redirect your SMS codes, and recycled phone numbers that still receive texts meant for a previous owner. Once inside, attackers may change the email and phone on the account, message your contacts, make purchases or sell the account. Protecting yourself comes down to a few habits: use a unique password for each account with a password manager, turn on two-factor authentication with an authenticator app or passkey where possible, never share a code with anyone who contacts you, and keep your recovery email and phone up to date. If you signed up with a temporary number, replace it with a method you control, because a recycled number is a weak point. Act quickly if you see login alerts you do not recognize.

Protect your phone number →