What is account takeover fraud?

Account takeover (ATO) is the hijacking of an account that belongs to someone else. Unlike a fake account opened with stolen documents, ATO abuses an account that already has history, balances and trust attached to it, which is why it is attractive to fraudsters and hard for institutions to spot.

Targets include bank and UPI accounts, payment wallets, email and cloud accounts, social media profiles, e-commerce and loyalty accounts, and corporate systems such as ERP, payroll or vendor portals.

How does account takeover happen?

The attacker needs whatever the account uses to verify identity. Common routes are:

• Phishing and fake websites that capture usernames, passwords and OTPs.
• Credential stuffing: testing username and password pairs leaked from other breaches, exploiting password reuse.
• SIM-swap: obtaining a replacement SIM for the victim's number so OTPs and alerts go to the fraudster.
• Malware and remote-access apps: the victim is talked into installing screen-sharing software.
• Insider help: a staff member at a bank, telecom outlet or the victim organisation changes contact details or leaks data. This overlaps with insider threat.

Once inside, the fraudster typically changes the registered mobile number or email to lock the owner out, then moves money quickly through mule accounts.

What does Indian law and regulation say?

• IT Act 2000: s. 66C (identity theft), covering fraudulent use of another person's password or unique identification feature, and s. 66D (cheating by personation using a computer resource). Both carry up to three years and a fine up to INR 1 lakh. Unauthorised access is also covered by s. 43 and s. 66.
• Bharatiya Nyaya Sanhita 2023: cheating (s. 318) and cheating by personation (s. 319).
• CERT-In Directions (28 April 2022): "unauthorised access to social media accounts" and "identity theft, spoofing and phishing attacks" are reportable within six hours by covered entities.

Telecom controls target SIM-swap directly. A Department of Telecommunications instruction of 27 September 2022 bars incoming and outgoing SMS on a new SIM for 24 hours after a swap. TRAI's Mobile Number Portability (Ninth Amendment) Regulations 2024, effective 1 July 2024, prevent a porting code being generated within seven days of a SIM swap.

Who bears the loss?

For bank customers, RBI's 2017 circular on limiting customer liability in unauthorised electronic banking transactions gives zero liability where the bank was at fault, and for third-party breaches reported within three working days. Limited liability applies for reports within four to seven working days.

RBI's Responsible Business Conduct Third Amendment Directions dated 24 June 2026 replace this for commercial banks (excluding small finance, payments, regional rural and local area banks) for transactions on or after 1 January 2027. They allow zero liability for third-party breaches reported within five calendar days and introduce one-time compensation for small-value frauds. Until then, the 2017 rules apply.

Red flags of account takeover

• Sudden loss of mobile network on the victim's phone.
• Alerts about password, mobile number or email changes the user did not make.
• New payees or beneficiaries added, followed by rapid transfers.
• Logins from unfamiliar devices, locations or at unusual hours.
• Customer complaints of OTPs they did not request.

How does ATO differ from related frauds?

Business email compromise is a specific type of takeover focused on mailboxes and payment instructions. Identity fraud using forged documents to open new accounts is a know-your-customer failure rather than ATO. Phishing is usually the method; ATO is the result.

For detection and response steps, see our guide to account takeover and SIM-swap fraud. Our digital forensics and eDiscovery service covers log and device analysis to reconstruct how an account was compromised.