--- title: Stopping Account Takeover - some practical steps date: 2019-02-13T14:32:00+00:00 author: Katrina Scott canonical_url: "https://www.ravelin.com/blog/stopping-account-takeover" section: Blog --- Blog /[Account takeover](/resources?search=&category%5B0%5D=134546#resourceContainer "Go to Account takeover"), [Link analysis & graph databases](/resources?search=&category%5B0%5D=134548#resourceContainer "Go to Link analysis & graph databases"), [Machine learning & AI](/resources?search=&category%5B0%5D=134549#resourceContainer "Go to Machine learning & AI") # Stopping Account Takeover - some practical steps What ATO is, how it happens and how to stop it happening to your business ![Stopping Account Takeover - some practical steps](https://storage.googleapis.com/ravelin-website-assets-production/assets/images/_blogSmall/2398/ato-listing.webp) The use of stolen payment details remains the largest fraud cost to online businesses by some margin. Emerging quickly from its shadow however is the blight of [account takeover](https://www.ravelin.com/insights/account-takeover-fraud). Some figures put losses at $5BN per year and growing. Whatever the true figures it’s large and unlike credit card fraud it is coupled with a reputational costs - read more about this [here](https://www.ravelin.com/insights/online-payment-fraud). Customers that have their accounts hacked are very quick (understandably) to take to social media as due to the nature of the crime the route to compensation for a consumer is less clear than credit card theft. Ravelin has written a guide to this topic available for download here. I recommend you read. Here is a shorter summary of what to expect. ![Connect Ato](https://storage.googleapis.com/ravelin-website-assets-production/assets/images/_1408xAUTO_crop_center-center_100_line_ns/2295/Connect_ato.webp)## What is Account Takeover? Account Takeover (ATO) is when a fraudster gains control of an account that belongs to a genuine customer. With [account takeover Fraud](https://www.ravelin.com/insights/account-takeover-fraud), fraudsters use the customer’s good track record to make unauthorised transactions. This can be done with the good customer’s saved card details or with stolen card details purchased online. The most common method used is credential stuffing. Credential stuffing relies on ‘combo lists’ - lists of passwords and emails usually compiled from several data breaches. The combinations are then automatically run against a login with any successful attempts logged. This is usually referred to as account ‘cracking’. Breached credentials can be used to ‘crack’ an account on another service because people often use the same password across multiple services. Credential stuffing can be scripted by more skilled fraudsters. However, automated tools like [Sentry MBA](https://sentry.mba/) make credential stuffing attacks very easy for anyone to do. ## What you can do to stop it There are a number of things merchants can do to mitigate against ATO. Targeting the tools and techniques that fraudsters use to commit ATO is a good place to start. - Monitoring login activity and patterns in things like HTTP client, IP, user agent and device details is important. Maintaining a breached credentials database can also help to protect your customers from ATO. - Targeting other tools that may indicate suspicious activity such as headless browsers, automated OCR tools (if you use captchas), TOR, VPN, proxies etc. is also advisable. - Implementing 2FA if you have verified numbers associated with accounts can be helpful though may negatively impact conversion if applied to all customers. ## What Ravelin does to stop ATO Ravelin has introduced a number of different ways to combat ATO that we make available to clients. ### Breached credentials database check Ravelin maintains a breached credentials database. Knowing whether credentials have been compromised allows merchants to take proactive steps to prevent ATO attacks before they happen. ### Rate limits We have added customizable rate limits that specifically target ATO at login around device, username and IP. This can be useful for tackling high volume attacks. ### Rules Rules add another layer of protection for customer accounts. This allows you to use further challenges on only the most vulnerable accounts, protecting good customers and conversion. ### Material account changes We detect and inform you of key changes and suspicious account events. You can then decide to notify the user and request that the customer confirm the activity was legitimate. ### Collecting and surfacing login activity data We provide oversight of login activity within our dashboard through reporting and rich customer profiles. ### Model behaviour We can work with clients to develop machine learning models that target ATO. This approach has huge potential for anomaly alerts and uncovering hidden patterns in the fraudsters’ attack strategies. You can read more about ATO and what Ravelin does to tackle it in[ our insights page here](https://www.ravelin.com/insights/account-takeover-fraud). ## Author ![Katrina Scott](https://storage.googleapis.com/ravelin-website-assets-production/assets/images/_avatarSmall/866/meet-the-team-katrina-product-manager-at-ravelin_181024_074740.webp) Katrina ScottProduct Director A lifelong fascination with crime and conflict led Katrina to study Politics and Criminology before earning her Master’s in Security Studies. Initially… [More from this author](https://www.ravelin.com/author/katrina-scott) ## Related content [Blog / Payments & payment fraud ### Card payment liability shift – everything you need to know to reduce chargeback burden The knowledge you need to make the most of liability shifts and reap the benefits for your company – including saving money on chargebacks. ![Freddie burgess](https://storage.googleapis.com/ravelin-website-assets-production/assets/images/_33x33_crop_center-center_none_ns/281707/freddie-burgess.webp)Freddie Burgess,Senior Product Support Analyst](https://www.ravelin.com/blog/card-payment-liability-shift-for-chargebacks) [Blog / Fraud analytics ### Refund abuse KPIs: How to measure and reduce refund fraud rates What you need to know to assess and quantify refund abuse – as well as to measure whether your refund abuse solution and strategy are delivering results. ![Can](https://storage.googleapis.com/ravelin-website-assets-production/assets/images/_33x33_crop_center-center_none_ns/280078/can.webp)Can Colak,Senior Product Manager](https://www.ravelin.com/blog/how-to-measure-refund-abuse-kpis) [Blog / Press release ### Driven by AI, customers now rival criminals for ecommerce fraud, say merchants Global ecommerce fraud enters a new phase as losses continue to climb. Merchants now view criminals and their own customers as presenting a comparable risk, and there's a gap in AI adoption. ![Ravelin Symbol Blue 1](https://storage.googleapis.com/ravelin-website-assets-production/assets/images/_33x33_crop_center-center_none_ns/187712/Ravelin-Symbol-Blue-1.webp)Ravelin Technology](https://www.ravelin.com/blog/ravelin-fraud-survey-2026-press-release)