Account Takeover (ATO) Prevention: Signals That Actually Work

Account takeover doesn't break in, it logs in, using credentials stolen from a breach or phished from the user. Because the password is correct, ATO sails past the front door untouched. Stopping it means looking past the credential to the context of the login: where it's coming from, on what network, and how it compares to the account's normal behavior.

How ATO happens

• Credential stuffing: bots replay username/password pairs leaked from other breaches at scale.
• Phishing: the user is tricked into handing over credentials (and sometimes an OTP).
• Session hijacking: stealing an authenticated session token.

Signals that actually catch it

The correct password tells you nothing about whether the person typing it is the real owner. These contextual signals do:

• IP reputation & classification: logins from datacenter IPs, known VPNs, or proxies are disproportionately ATO, especially for accounts that normally connect from residential networks.
• Geo / impossible travel: a login from a new country minutes after one from home.
• New device / fingerprint: an unrecognized device on a sensitive account.
• Phone changes: an attacker swapping the recovery number to a VoIP line is a major red flag.
• Velocity: many login attempts across many accounts from one network signals credential stuffing.

Responding without punishing real users

The art of ATO defense is reacting to risk without adding friction for the 99% of logins that are legitimate. Score the login context; when risk is elevated, step up with an additional factor or a verification challenge rather than a hard block. Save aggressive responses, lockouts, forced resets, for high-confidence cases like a known-VPN login from a new country immediately followed by a recovery-phone change.

const ip = await score("ip_risk", { ip: loginIp });

const risky =
  ip.ip_features.known_vpn ||
  ip.ip_features.classification === "datacenter" ||
  isNewCountry(account, ip.ip_features.geolocation.country);

if (risky) requireSecondFactor();   // OTP, passkey, email confirm
else proceed();