What account takeover fraud is

Account takeover fraud happens when someone gains access to your online account—email, bank, payment app, social media, or anything else—and uses it without your permission. They log in with your password, change your contact information, drain money, make purchases, or lock you out entirely. Unlike identity theft, which uses your personal information to open new accounts in your name, account takeover uses an account you already own.

The fraudster's goal is usually speed: drain a bank account, transfer money to themselves, change the recovery email so you can't regain access, or use your account to commit fraud against other people. Some takeovers sit dormant for weeks while the criminal watches your activity before making a move.

Key Takeaways

  • Account takeover happens when someone logs into your existing account using your password or by bypassing your security questions, not by opening a new account in your name.
  • The most common entry point is a password breach from another website, so using the same password across multiple sites puts all of them at risk.
  • If you notice unauthorized activity, change your password immediately from a different device, then contact your bank or service provider to report the fraud and freeze any transactions.
  • Two-factor authentication (a code sent to your phone or generated by an app) blocks most takeovers even if the criminal has your password.
  • Recovery time varies: banks usually reverse fraudulent charges within 10 business days, but regaining control of a compromised email account can take weeks.

How your account gets compromised

The most common path is a password breach. When a website or app you use gets hacked, criminals download millions of usernames and passwords. They then try those same credentials on other sites—your email, your bank, your payment apps. If you use the same password everywhere, one breach opens every door.

A second route is phishing: a fake email or text that looks like it came from your bank or a service you trust, asking you to "verify your account" or "confirm your identity." You click the link, enter your password on a fake website that looks identical to the real one, and the criminal now has your credentials.

A third method is social engineering. The criminal calls your bank pretending to be you, answers security questions using information they found online (your mother's maiden name, your pet's name, your high school), and convinces the bank to reset your password or add their phone number as a recovery contact.

Less common but faster: the criminal buys your credentials on the dark web from someone who already stole them, or they use malware on your computer that logs every keystroke you type.

Signs your account has been taken over

You cannot log in, even though you know your password is correct. The password reset email goes to an address you do not recognize. You see transactions you did not make, or charges from merchants you have never heard of. Your phone stops receiving text messages from your bank (a sign the criminal changed your phone number on file). Friends tell you they received strange messages from you.

Sometimes the signs are quieter: your email forwarding rules have changed, your recovery phone number is different, or your account settings show a login from a city you have never visited. Check your account activity log regularly, especially for financial accounts. Most banks and payment apps show you a list of recent logins with dates, times, and locations.

What to do immediately

If you suspect takeover, do not use the compromised account to change anything. Log in from a different device or computer—one the criminal does not have access to—and change your password to something long and unique that you have never used before. Use a combination of uppercase letters, lowercase letters, numbers, and symbols.

Next, contact your bank or payment service by phone using the number on the back of your card or statement, not a number from an email or text. Tell them you believe your account has been compromised. Ask them to freeze your account, reverse any fraudulent charges, and review recent activity with you. Most banks have a fraud department that can act within minutes.

If your email account was taken over, change the password and review your recovery options: the phone number on file, the backup email address, and your security questions. Add a recovery phone number or email that only you control. Check your forwarding rules and connected apps to see if the criminal set up a way to stay in your account.

Enable two-factor authentication (also called 2FA) on every account that offers it. This requires a second form of proof—usually a code sent to your phone or generated by an authenticator app—every time someone logs in from a new device. Even if the criminal has your password, they cannot get in without that code.

How banks and payment services respond

Banks are required by federal law to investigate fraud claims and reverse unauthorized charges within a specific timeframe. For debit card fraud, you have up to 60 days to report it; the bank then has 10 business days to investigate and either reverse the charge or explain why they will not. For credit cards, the process is similar but the timeline is longer—you have 60 days to dispute, and the card company has 30 to 60 days to investigate.

Payment apps like Venmo, PayPal, and Cash App have their own fraud policies. Some reverse unauthorized transfers quickly; others require you to file a police report first. Check your app's fraud reporting page or call their customer service number to understand their specific process.

Your bank may also issue you a new debit card or credit card number to prevent further fraud on that account. This is standard and usually happens within 5 to 10 business days.

Recovering a compromised email account

Your email is the master key to every other account you own. If someone takes over your email, they can reset the password on your bank, your payment apps, your social media, and anything else linked to that email address. Recovering a compromised email account is often slower and more complicated than recovering a bank account.

If you cannot log in to your email, use the "Forgot password" link and follow the recovery process. Google, Microsoft, and Yahoo will ask you to verify your identity by answering security questions, entering a recovery phone number, or providing a recovery email address. If the criminal changed all of these, recovery can take days or weeks and may require you to submit a government ID.

Once you regain access, change your password, review your recovery options, enable two-factor authentication, and check your forwarding rules and connected apps. Remove any devices or apps the criminal may have added.

Protecting yourself going forward

Use a unique password for every account. A password manager like Bitwarden, 1Password, or Dashlane stores all your passwords in an encrypted vault so you only have to remember one master password. This way, if one website gets breached, the criminal cannot use that password on your other accounts.

Enable two-factor authentication on every account that offers it, especially email, banking, and payment apps. Use an authenticator app (Google Authenticator, Microsoft Authenticator, Authy) rather than text messages when possible—text messages can be intercepted or redirected by criminals who have access to your phone number.

Check your credit report regularly through AnnualCreditReport.com (the only free, official source). Look for accounts you did not open or inquiries you did not authorize. You can also place a credit freeze with the three major credit bureaus (Equifax, Experian, TransUnion) to prevent someone from opening new accounts in your name, though this does not stop account takeover.

Be skeptical of emails and texts asking you to verify your account or confirm your identity. Banks and legitimate companies rarely ask for passwords or sensitive information via email. If you receive a suspicious message, go directly to the company's website or call the number on your statement—do not click links in the message.

Frequently Asked Questions

How long does it take to recover a hacked bank account?

Banks must reverse fraudulent charges within 10 business days of your report. You usually regain full access to your account within 24 to 48 hours. However, if the criminal changed your password and recovery information, it may take longer to prove your identity and regain control. Contact your bank's fraud department for a specific timeline.

Can I get my money back if someone drained my account?

Yes, if you report it to your bank within 60 days. Banks are required to reverse unauthorized debit card charges. If you wait longer than 60 days, the bank may not be required to refund you, though some will do so anyway. Report fraud as soon as you notice it.

What is the difference between account takeover and identity theft?

Account takeover uses an account you already own; identity theft uses your personal information to open new accounts in your name. Account takeover is usually faster and easier for the criminal, so it happens more often. Both are fraud, but they require different recovery steps.

Will two-factor authentication stop account takeover?

Two-factor authentication blocks most account takeovers because the criminal needs both your password and access to your phone or authenticator app. However, if the criminal has your phone or has redirected your phone number to their device, they can still get in. It is not perfect, but it is the single most effective protection available.

Should I file a police report for account takeover?

Filing a police report is not required for your bank to reverse charges, but some payment apps and services ask for one before they will refund you. You can file a report online through your local police department's website or in person at a police station. Keep the report number for your records.