Account Takeover Prevention (ATO)
Assess the app and device behind a sign-in. Use runtime evidence alongside authentication to protect account recovery and sensitive account actions.
Fewer reports can still mean greater harm.
Account takeover starts when someone gains access to an account that is not theirs. An attacker can run a password list through a mobile emulator, retrying until a guess works, or automate sign-ins with credentials stolen elsewhere. Once inside, they can change recovery details, add a payee, or empty the balance.
Phishing is one route to stolen credentials. These two charts show a broader phishing and spoofing category, rather than a count of account takeovers or AI attacks.
Phishing & spoofing reports
Complaints received by FBI IC3 · 2023–2025
Complaint volume declined in this category.
Phishing and spoofing complaints include attacks beyond account takeover. Counts reflect reports received, not the frequency of every attempted attack.
FBI · Internet Crime Complaint CenterPage 25 · complaint countsView underlying data
| Category | Value |
|---|---|
| 2023 | 298,878 |
| 2024 | 193,407 |
| 2025 | 191,561 |
Phishing & spoofing losses
Losses reported to FBI IC3 · 2023–2025 · USD
Reported losses rose as complaint counts fell.
Losses in the same IC3 category. The report does not attribute this change to AI or identify what portion resulted in account takeover.
FBI · Internet Crime Complaint CenterPage 26 · complaint lossesView underlying data
| Category | Value |
|---|---|
| 2023 | $18,728,550 |
| 2024 | $70,013,036 |
| 2025 | $215,843,126 |
The impersonation can sound like someone you trust.
The FBI describes criminals using generated messages and cloned voices to make impersonation more convincing. Its separate account takeover alert documents fake bank-support calls and websites that obtain passwords and one-time codes.[3][2]
AI gives those approaches more reach and more credible material. Once credentials are stolen, the account still needs protection at the point of use. Assess the client, then combine the findings with authentication and account activity. A healthy device does not rule out a socially engineered takeover.
Stop the controlled client before it gets access.
Trying many passwords against one account is password guessing. Testing stolen username/password pairs is credential stuffing; both can be automated. Request limits help, but the app and device making those attempts offer another opportunity to intervene.[5]
Cipherstep’s Attestation SDK collects and seals supported client observations at sign-in. Your backend sends the artifact to the Decision API. In the example below, the request comes from an emulated client and reuses an authenticated attestation session already seen in another evaluation. The replay finding makes the determination block.
Your backend enforces the result before issuing account access. Emulator evidence alone does not prove a takeover, and replay refers to attestation reuse, not password reuse. Keep phishing-resistant authentication, rate limits, recovery safeguards, and account monitoring for attacks from genuine devices too.[5][4]
One account. A queue of password guesses.
Illustrative session · highlights show the decision and supporting findings.
Decision API response
JSON/v1/evaluations/{evaluationId}{
"evaluationId": "6f626279-59b7-4dc3-9557-b2bd7db0a102",
"userId": "account-access-example",
"status": "complete",
"analysis": {
"decision": "block",
"signals": [
{"type": "emulator_detected", "confidence": 90},
{"type": "unique_replay_detected", "confidence": 100}
]
},
"analysisVersion": 5,
"networkPending": false
}