An unfamiliar transfer is one sign that someone may have entered an account. Another is a security code you did not request, followed by a call asking you to read it aloud. Account takeover happens when a criminal gains unauthorized access to an online account and acts as its owner. The account might hold money, or it might hold the email address used to reset a banking password. Spotting the first odd detail can make the next steps clearer.
What account takeover can reach
The FBI’s Internet Crime Complaint Center (IC3) describes account takeover as a form of identity theft. A criminal gets into an account without permission to steal money or information. Bank and payment accounts are obvious targets, but email, payroll and social media accounts can matter too. Access to email, for example, may help someone intercept messages about another account.
Once inside, a criminal might make a purchase, withdraw money or redirect a payment. The activity may look ordinary to a system that sees a valid password and a successful sign-in. That is why a transaction alert, a changed contact detail or a sign-in notice you did not expect deserves attention even before a loss is visible.
The scale is substantial, though the figures do not predict any individual’s risk. A December 2025 report on an IC3 alert said the agency had received more than 5,100 account-takeover complaints that year, with reported losses above $262 million.
How a criminal gets past the sign-in screen
A password may be guessed, stolen from a fake website or exposed in an earlier data breach. Malicious software can also capture information from a device. Some attacks begin in search results: an ad or link presents a convincing sign-in page, but its web address has a changed letter or extra word. The person enters credentials into the imitation rather than the real site.
A second sign-in step can help, but criminals may try to obtain that step as well. Multi-factor authentication, or MFA, asks for another form of verification beyond a password. A one-time passcode is one example. IC3 describes a scam in which a fake site asks for a phone number, then an impersonator calls and requests the code that just arrived. The caller may already know the password. The code is what they still need.
In another method, called SIM swapping, a criminal moves someone’s phone number to a SIM card they control. That can put calls, texts and security codes within the criminal’s reach. These methods differ, but they explain why a correct-looking sign-in page or a caller who knows personal details is not proof that the contact is legitimate.
Red flags: compare the request with the account
Pay close attention to what an unexpected caller, text or chat asks you to do. A request to read out a one-time code, supply a password or share confidential information to “verify” the account matches patterns described in the IC3 guidance. The same caution applies when the contact claims to be from customer service or tech support. A familiar name on the screen does not establish who is behind the message.
Links need a separate check. A search result can lead to an address that resembles the one you know without matching it. An unsolicited email or text can also offer a download that hides password-stealing software. Typing a previously known address or using a bookmark avoids relying on the address supplied by a message or search ad.
Then compare what you see with the account’s own records through a channel you reach independently. A transaction you do not recognize, a changed phone number or an alert about a sign-in you did not make can help narrow down what needs review. One odd notification does not establish exactly what happened, but it is a reason to check rather than reply to the sender.
What payment protections cover, and what they do not settle
The Electronic Fund Transfer Act and its rule, Regulation E, address electronic transfers involving consumer accounts. The Consumer Financial Protection Bureau’s electronic fund transfer guidance discusses coverage for transfers involving personal checking, savings and other asset accounts. Depending on the transaction, that can include debit card payments, ACH transfers, prepaid accounts and certain mobile or person-to-person payments.
The account’s purpose matters. Regulation E generally concerns accounts established primarily for personal, family or household use. An account used mainly for business does not receive the same treatment under these consumer rules. The rules also address unauthorized transfers and error resolution, including notice and investigation requirements. Coverage and liability depend on facts and timing, so the existence of the rule does not mean every disputed payment has the same outcome.
When something looks wrong, establish a trusted channel
Speed matters because an intruder may still have access, and reporting time can matter under applicable payment rules. The useful first distinction is between a contact that came to you and one you initiate. A phone number in a suspicious text may lead back to the impersonator. A number on a statement or card, or a support route reached through the institution’s official app, gives you a way to ask about the account without trusting the message that raised the alarm.
In that conversation, the account holder can describe the unfamiliar activity and ask how the institution secures access, reviews transfers and accepts a dispute. Keeping a record of when the activity was noticed, which transactions are in question and when the institution was contacted makes later conversations easier to follow. If email may also be compromised, mention that concern so the institution knows a message sent to that address may not be private.
For reporting options and further steps, IC3 maintains account-takeover guidance. The immediate goal is to verify what happened through an independent channel, rather than provide another code or password to someone who reached out first.
Please seek a professional. This article is general information, not financial, tax or insurance advice. Please seek a licensed financial, tax or insurance professional about your own situation.
