How to Prevent Account Takeover

Account takeover is the attack that turns every other security failure into a personal crisis. When an attacker takes control of your email account, they can reset every other account linked to it. When they take control of a financial account, the consequence is immediate monetary loss. Understanding how to prevent account takeover means knowing both the specific attack techniques and the defences that make each one fail. If you want the full context, see our Complete Guide to Online Security and Privacy.

Account takeover attempts are almost always automated, opportunistic, and credential-based. The rare targeted attack uses social engineering and manual exploitation of recovery systems. Both categories require different — though overlapping — defences. The automated attacks affect most people; the targeted techniques require additional precautions for higher-risk individuals.

The attack techniques — knowing what you’re defending against

The most common account takeover techniques, in order of volume:

• Credential stuffing: testing breached username-password combinations against other services. Fully automated, scales to billions of tests per day, requires only the breached datasets that circulate freely in criminal forums. The dominant technique by volume.
• Password spraying: testing a small number of common passwords against many accounts. Avoids account lockout by trying few passwords per account rather than many passwords against one account.
• Phishing (standard): deceiving users into entering credentials on fake sites that look like real login pages.
• AitM phishing (Adversary-in-the-Middle): proxying the real login page through the attacker’s server, capturing credentials and session tokens in real time — including the 2FA code — while the user sees an apparently successful login. This technique bypasses TOTP 2FA entirely because the session token is captured after authentication.
• SIM swapping: convincing carriers to transfer a phone number to an attacker-controlled SIM, bypassing SMS-based 2FA.
• Account recovery exploitation: abusing password reset flows, security questions, and support agents to gain access without the password.

Defences by attack type — what works and what doesn’t

Attack type	Primary defence	Effectiveness
Credential stuffing	Unique generated password per account (password manager)	Complete prevention — a unique password can’t be stuffed
Password spraying	Strong unique password; platform-side rate limiting	Complete prevention
Standard phishing	Password manager autofill (won’t fill on fake domains) + sender verification habit	High prevention
AitM phishing	Passkeys / FIDO2 hardware key (cryptographically domain-bound)	Complete prevention
SIM swap	Authenticator app 2FA instead of SMS; carrier PIN or port freeze	High prevention
Support social engineering	Support PIN on accounts; data minimisation (less public info)	Partial prevention
Session hijacking	Regular session review and termination; device security	Partial prevention

The table reveals where to invest effort: the complete-prevention controls at the credential layer address the two highest-volume attack categories simultaneously. Partial-prevention controls address lower-volume, higher-effort attacks. Layer the complete-prevention controls first, then add the partial-prevention ones — rather than treating all attack types as equally likely and investing equally in each.

The step-by-step prevention setup

1. Unique generated password for every account. This single change prevents credential stuffing — the majority of automated account takeover attempts. Generate passwords through the password manager; never reuse or invent them. The vault health report identifies any remaining reused passwords. Our guide on using a password manager covers the complete setup.
2. Enable 2FA on every account that offers it. Use an authenticator app (preferred) rather than SMS (vulnerable to SIM swap). Prioritise email first — it controls recovery for everything else — then financial accounts, cloud storage, and social media. Our guide on setting up two-factor authentication covers setup for every major platform.
3. Harden recovery options. Recovery phone numbers should be a VoIP number that cannot be SIM-swapped. Recovery email addresses should be a secondary secured account. Security question answers should be random nonsense stored in the password manager — never real answers researchable from social media. Weak recovery options create a backdoor that bypasses strong primary credentials. This is the most commonly skipped step.
4. Enable login notifications. Every major service can send email or push alerts for new device sign-ins. Enable these on every account. A login notification for a device you didn’t use is the early warning that enables rapid response before the attacker has time to cause significant damage.
5. Regularly review active sessions. Most services provide a list of active sessions — devices and browsers currently logged in. Review this quarterly on high-value accounts and terminate any unfamiliar sessions immediately.
6. Use passkeys where available. Passkeys are cryptographically bound to the exact website domain and cannot be captured by fake login pages — the most effective control against AitM phishing. Enable them on services that support them as the primary authentication method. Our guide on passkeys vs passwords covers this in detail.
7. Monitor breach databases. Subscribe to Have I Been Pwned alerts for every email address you use. A breach notification for a service you use is a signal to immediately change that service’s password.

Recovery options hardening — the most commonly skipped step

Recovery channels create a backdoor that bypasses the strong primary credentials most users work hard to set up. A strong password and authenticator 2FA on an account with a real phone number as the recovery option is still vulnerable to SIM swap. A recovery email with a weak password is a weaker point than the primary account it’s designed to recover.

The recovery email should have its own unique strong password, its own 2FA, and should not itself use the primary account as a recovery path — circular recovery creates a single point of failure. Every service has a recovery flow, and each recovery flow has assumptions about what an attacker can and cannot access. To prevent account takeover through the recovery channel, those assumptions must be correct.

Customer support social engineering is the vector that technical controls cannot fully prevent. An attacker with accurate personal information — name, address, date of birth, partial account details from data broker profiles — can sometimes convince customer support to reset account access. To reduce this risk: set a support PIN or passphrase on accounts that offer it (telecommunications providers almost universally offer this), keep personal information out of public sources (data broker opt-outs, private social media settings), and file “enhanced security” flags with carriers and financial institutions where available.

Elevated controls for high-value accounts

Email, financial accounts, and identity-linked government accounts warrant controls beyond the standard baseline:

For email accounts:

• A hardware security key (FIDO2) as the primary 2FA method — phishing-resistant in ways that authenticator apps are not
• The email password memorised rather than only stored in the password manager — resilience to manager unavailability
• A dedicated recovery email address, itself maximally secured
• Quarterly review of forwarding rules (an attacker who had brief access may have installed one that survives password changes) and connected application access
• Login alerts enabled and reviewed

For financial accounts:

• Transaction alerts for every transaction above a minimum threshold
• A dedicated email address used only for financial accounts — phishing targeting financial accounts doesn’t reach the same inbox as other emails
• Regular review of linked payment methods and account beneficiaries
• Disable “voice print” authentication (voice can be synthesised with AI tools) in favour of app-based authentication wherever available
• Enable transfer verification delays on large transfers where the financial institution offers them

AI-powered attack personalisation — the 2026 evolution

Automated account takeover tools now incorporate personal data from breach databases, social media, and data broker profiles to generate more convincing phishing lures. A credential stuffing attack that includes the target’s full name, current employer, and recent purchase history in the phishing email is significantly more convincing than a generic template.

To prevent account takeover from personalised attacks: the combination of technical controls (passkeys, unique passwords, hardware key 2FA) with data minimisation (reduced public personal information through data broker opt-outs and private social media settings) addresses both the technical and informational layers that these attacks exploit. Our guide on stopping data brokers covers the data minimisation that reduces the personalisation information available to attackers.

For households with less technically experienced members — elderly parents, children, anyone who doesn’t manage their own accounts — implement the prevention framework proportionately to their capability. Setting up a password manager and 2FA for a parent’s email and financial accounts, with yourself as an emergency access contact, provides technical protection without requiring active management. Regular quarterly reviews of their account sessions and recovery options are a meaningful contribution that requires only the technically-capable family member’s time. Account takeover prevention in household contexts is a shared responsibility distributed by capability.

What to do if account takeover has already happened

If you suspect an account has been taken over — login notification for an unfamiliar device, password that no longer works, activity you didn’t perform — the priority sequence:

1. Attempt to log in and change the password immediately if you still have access. Use the password manager’s generator for a new unique password.
2. If locked out: use the account’s official recovery process — not a link from any email received during the suspected compromise. Navigate directly to the service’s account recovery page.
3. After regaining access: terminate all active sessions except the current one. Check for forwarding rules, connected apps, and changed recovery options — these are the persistent access mechanisms an attacker installs during brief account access.
4. Enable 2FA immediately if it wasn’t already active — this prevents re-entry even if the attacker still has the password.
5. For financial account takeover: contact the institution directly (phone number from the back of the card or the official website, not from any communication received) to report the compromise and request card replacement.
6. Check all accounts that used this account’s email address for recovery — if the email account was taken over, assume every account using it for password reset is also at risk and change those passwords as well.

Account takeover prevention vs account takeover response

The best time to implement the prevention controls in this guide is before an account takeover occurs — and the second-best time is immediately after. Post-takeover is when the deficiencies in the previous security posture are most visible, and the motivation to address them is highest.

The three-control baseline that prevents account takeover for the vast majority of automated attacks: unique passwords from a password manager, TOTP 2FA on email, and passkeys on services that support them. Achievable in a single afternoon of setup. The coverage from these three controls addresses the attacks responsible for the majority of account compromises — leaving only the lower-volume, harder-to-execute attacks in the residual risk that the additional controls address incrementally.

Account takeover on shared or family accounts

Shared accounts — streaming services, family cloud storage, household utilities — present a specific account takeover challenge because multiple people accessing the same credentials means a security incident by any one person affects the whole household.

Practical household account security rules:

• Share credentials through the password manager’s sharing features (not via SMS, email, or a sticky note)
• Use the service’s own sub-account or profile system where available — each person has separate login credentials under one subscription, meaning individual account security can be managed independently
• Agree not to accept “remember this password” browser prompts on personal devices for shared accounts — use the password manager’s autofill instead
• Designate one household member responsible for quarterly session reviews on critical shared accounts

For family password manager setup specifically: Bitwarden Families ($40/year for up to 6 users) and 1Password Families ($5/month for up to 5 users) provide shared vault spaces alongside individual vaults — members can access shared credentials through the vault without the credentials being stored in their browser or known from memory, maintaining both convenience and security for household shared accounts. Our guide on Secure Password Reset covers an adjacent issue.

Account takeover prevention scales from an individual discipline to a household practice with relatively little additional complexity — the same tools and principles apply, with the household manager taking on the quarterly maintenance tasks for the less technically engaged members. That shared responsibility model provides household-wide protection without requiring every member to independently implement and maintain the full prevention framework. See also Two-Factor Authentication for a related case.