Account takeover fraud is when someone gains control of your account without your permission and uses it to move money or make purchases

The attacker logs in as you—either by stealing your password, bypassing your security questions, or tricking customer service into handing over access. Once inside, they change your contact information so you stop getting alerts, then drain funds, open new accounts in your name, or rack up charges on your existing cards. You often don't notice until the bank or a creditor contacts you about activity you didn't authorize.

This is different from credit card fraud, where someone uses your card number without accessing your actual account. In account takeover, the criminal has the keys to the whole house. They can see your transaction history, change your password, add themselves as an authorized user, and lock you out of your own account.

Key Takeaways

  • Account takeover usually starts with a stolen password, phishing email, or a data breach at a company where you have an account.
  • The attacker changes your contact information first so you won't see alerts about what they're doing next.
  • Banks and credit card companies can reverse fraudulent charges, but the process takes weeks and you may lose access to your account during the investigation.
  • The fastest way to stop ongoing fraud is to call your bank's fraud line directly—not the number on your card, but the one on your statement or their website.
  • Freezing your credit report prevents the attacker from opening new accounts in your name while you sort out what happened.

How attackers get into your account in the first place

The most common entry point is a password you've used before. If you reuse the same password across multiple sites, and one of those sites gets breached, attackers can try that password on your bank, email, or payment accounts. They don't need to guess—they have a list of working credentials from the breach.

Phishing emails are the second major route. You receive a message that looks like it's from your bank, asking you to "verify your account" or "confirm your identity." The link takes you to a fake login page that looks identical to the real one. You enter your username and password, and the attacker now has both. This works because most people don't check the sender's actual email address or hover over links to see where they really go.

A third method is social engineering—calling your bank's customer service line, claiming to be you, and asking them to reset your password or add a new phone number to your account. If the attacker has your Social Security number, date of birth, and a few other details (often available from public records or previous breaches), they can convince a tired customer service representative to hand over access.

What the attacker does once they're inside

The first thing they do is change your contact information. They update your email address, phone number, or both. This stops you from receiving alerts about the activity that's about to happen. Your bank might send you a notification that your email was changed, but by then the attacker has already locked you out of that email account too.

Next, they move money. If it's a bank account, they set up a transfer to an account they control—often at a different bank, which makes it harder to reverse. If it's a credit card, they make large purchases, sometimes testing with a small charge first to see if it goes through. They may also add themselves as an authorized user on your account, which gives them a physical card in their name but tied to your credit line.

Some attackers open new accounts entirely in your name—credit cards, personal loans, even bank accounts. They use your Social Security number and the contact information they just changed to your email or phone. The bills go to their email, and you have no idea until a collection agency calls.

Why banks can reverse the fraud but it still costs you time

Federal law (the Electronic Funds Transfer Act for bank accounts, and the Fair Credit Billing Act for credit cards) requires banks to reverse unauthorized charges. But "reverse" doesn't mean when ready. The bank will typically freeze your account while they investigate, which can take two to four weeks. During that time, you can't access your own money, even though it's still technically yours.

For bank transfers, the window is tighter. You have to report the fraud within two business days to limit your liability to $50. After that, you could be liable for up to $500. If you don't report it within 60 days of your statement, you lose all protection and the bank doesn't have to refund anything. For credit cards, you have 60 days from when you see the charge on your statement.

The bank will contact the receiving bank and ask them to reverse the transfer. If the money has already been withdrawn or transferred again, recovery becomes much harder. Some banks can freeze the receiving account, but only if you report it quickly enough.

The steps to take when ready after you discover the fraud

Call your bank's fraud department right away. Don't use the number on your card—use the number on your statement or the bank's official website. Scammers sometimes intercept calls by putting their own fraud number on fake statements. Tell them you've been a victim of account takeover and ask them to freeze your account when ready.

Change your password from a different device—a phone or computer the attacker doesn't have access to. If you change it from a compromised computer, the attacker can see the new password as you type it. Use a password that's long, random, and different from anything you've used before.

Check your credit report for accounts you didn't open. You can get a free report from each of the three bureaus (Equifax, Experian, TransUnion) at annualcreditreport.com. Look for new credit cards, loans, or inquiries you don't recognize. If you find fraudulent accounts, dispute them with the bureau and the creditor.

Place a fraud alert on your credit file by contacting one of the three bureaus. They're required to notify the other two. A fraud alert tells creditors to verify your identity before opening new accounts in your name. It lasts one year and is free. If you want longer protection, you can place a credit freeze, which blocks all new credit inquiries until you lift it.

Preventing account takeover before it happens

Use a unique password for every account that matters—your email, bank, credit cards, and payment apps. A password manager like Bitwarden or 1Password stores them encrypted so you only have to remember one master password. This way, if one site gets breached, the attacker can't use that password anywhere else.

Turn on two-factor authentication (2FA) on every account that offers it. This means even if someone has your password, they can't log in without a second piece of information—usually a code sent to your phone or generated by an authenticator app. Text-based codes (SMS) are better than nothing, but authenticator apps like Google Authenticator or Authy are more find because attackers can't intercept them as easily.

Don't reuse security questions and answers. If your security question is "What's your mother's maiden name?" and that information is public or on your Facebook profile, the attacker can answer it. Use random answers that have nothing to do with the actual question, and store them in your password manager.

Monitor your accounts regularly. Check your bank and credit card statements at least weekly. Set up alerts for any transaction over a certain amount—even $1 if your bank allows it. The faster you spot fraud, the faster you can stop it and the more likely the bank can recover the money.

What happens if the attacker opened accounts in your name

Dispute the accounts with the credit bureaus and the creditors directly. Send a written dispute (email or certified mail) stating that you did not open the account and that it resulted from identity theft. Include a copy of your fraud alert or police report if you have one. The creditor has 30 days to investigate and respond.

File a report with the Federal Trade Commission at identitytheft.gov. This creates an official record of the fraud and gives you a recovery plan. You can also file a police report with your local department, though many won't investigate unless the amount is large. The police report number helps when disputing accounts.

Contact the creditor's fraud department and ask them to remove the fraudulent account from your credit report. Even if the account is closed, it can still damage your credit score. Once the dispute is resolved, ask the bureau to remove it entirely. If they won't, it will eventually age off your report after seven years.

Frequently Asked Questions

How long does it take to get my money back after account takeover?

Bank transfers typically take two to four weeks to reverse, assuming you reported the fraud within two business days. Credit card charges can take 30 to 60 days. During the investigation, your account may be frozen, so you won't have access to your own funds. Some banks can speed this up if you file a police report.

Can the attacker lock me out of my own account permanently?

Not permanently, but they can lock you out temporarily by changing your password and recovery email. Call your bank's customer service line and prove your identity using information only you would know—your Social Security number, account history, or other verification. They can reset your access within hours.

What if I didn't notice the fraud for three months?

You've missed the two-day window for bank transfers and the 60-day window for credit cards, which means the bank may not refund you. However, contact them anyway and explain what happened. Some banks will still reverse charges if you can show you were a victim of identity theft, especially if the attacker changed your contact information so you couldn't see the activity.

Do I need to close my account after account takeover?

Not necessarily. Closing the account doesn't erase the fraud from your history, and it can hurt your credit score by reducing your available credit. Keep the account open, change your password, enable 2FA, and monitor it closely. If the bank offers to close it and open a new one with a new account number, that's worth considering because it stops the attacker from using the old account number.

Will my credit score recover after account takeover fraud?

Yes, but it takes time. Fraudulent accounts and missed payments damage your score, but once you dispute and remove them, the impact fades. Hard inquiries fall off after two years, accounts after seven years. Paying your real bills on time rebuilds your score faster than waiting for the fraud to age off.