Account Takeover & Protection

Account takeover (ATO) means someone who is not the owner gains control of an account and can act inside it as the owner. It does not require access to your device: a valid password, a stolen session token or a successful recovery reset is enough to sign in from anywhere.

Your primary email receives password-reset links for almost every other service. Whoever controls the inbox can reset the passwords of your bank, social media and cloud accounts, so securing the email account first protects everything linked to it.

SMS codes are better than a password alone, because they stop attackers who only have the password. They can still be relayed by a real-time phishing page, and SIM swapping can redirect them. Prefer passkeys, keep an authenticator app as backup, and remove SMS where the service allows.

A passkey is a private key on your device that signs a login only for the exact website it was registered on. A look-alike domain gets nothing usable, so there is no code or password to steal. Passkeys do not protect a session token that is stolen after login.

From a trusted device, secure your primary email, set a new unique password and sign out all other sessions. Then correct recovery email, phone and MFA methods, revoke unknown connected apps, delete suspicious forwarding rules and check the accounts that use this email for resets.

Not always. Stolen session tokens, an added recovery address, a connected app with its own token or a mail-forwarding rule can all survive a password change. After changing it, sign out everywhere and review recovery options, connected apps and mail rules.