Account takeover

The FBI describes account takeover as criminals gaining unauthorised access to an online financial institution, payroll or health savings account in order to steal money or information. It differs from a scam where you send the money yourself: here the attacker becomes the account holder, and the transfers come from your own login.

In the pattern the FBI warned about in November 2025, the criminal impersonates a bank employee, customer support or technical support, by text, phone call, email or a lookalike website. The goal is your password plus the multi-factor code or one-time passcode. With both, they log in to the real site, reset the password and lock you out. Some callers say there are fraudulent transactions on the account and send a link to a fake page that supposedly reports the fraud.

Speed is the danger. The FBI says that once in control, the criminals quickly wire funds to accounts they control, many linked to cryptocurrency wallets, so the money is hard to trace and recover. Its figures: more than 5,100 complaints and more than $262 million in losses between January and the November 2025 notice. The FBI’s advice is to use bookmarks to reach login pages and avoid search results and ads, because MFA does not protect you on a fraudulent login page. It also says to be suspicious of unknown banking or company employees who call you, not to trust caller ID, and to hang up, verify the correct number and call it yourself. Companies generally do not contact you to ask for your username, password or one-time passcode.