Usernames and passwords are acquired from mass data dumps that are accessible on the dark web. Each data dump can consist of millions of username and password combinations following years of data breaches carried out across multiple sites, with these details used to commit account takeover fraud. The challenge for businesses resides not only in the availability and low price point of data dumps, but consumer behavior. With more passwords to keep track of, consumers are reusing log in details across multiple sites and neglecting password updates for years at a time, leaving themselves and your business exposed to ATO attacks.

• Credential stuffing
• SIM swapping
• Phishing scams
• Malware
• Man-in-the-Middle (MitM) attacks

Credential stuffing is a form of account takeover attack in which credentials obtained from a data breach on a certain service are used in an attempt to log into another unrelated service. Credential stuffing attacks use bots for automation and is founded in the assumption that many users reuse usernames and passwords across a variety of services.

Account takeover attacks allow the attacker access to data and privileges associated with the compromised account – and potentially other accounts beyond this one. Therefore, account takeovers are considered a breach.

Netacea uses a range of approaches to identify account takeovers. At a simple level, the built-in reputational analysis and blacklist of known bad actors can easily weed out the less sophisticated attempts. However, this pool is rapidly shrinking as more complex tools are developed and become more widely available. To address the remaining account takeover fraud, Netacea has developed cutting-edge machine learning algorithms that adapt to detect evolving account takeover strategies and tools.

Netacea’s Intent Analytics™ Engine uses advanced machine learning techniques to detect account takeover attempts by spotting patterns of behavior that indicate malicious intent. This includes spotting indicators of an upcoming attack, such as large amounts of fake accounts being created that can be used to camouflage an account takeover, as well as the attack itself.