Account Takeover (ATO)

Account takeover is when an attacker gains unauthorized control of a legitimate user's already-existing account and then uses that access to steal funds, data, or the account itself. It's distinct from Synthetic Identity Fraud and First-Party Fraud, both of which target the moment an account is created, ATO targets an account that already legitimately exists and belongs to a real person who is not the attacker.

The attack paths that lead to ATO are varied but well understood: credential stuffing (an attacker replays a username/password pair leaked in an unrelated data breach, betting the victim reused it here), SIM swap (an attacker convinces or bribes a telecom to port the victim's phone number onto a SIM the attacker controls, hijacking any SMS-based two-factor authentication or account-recovery flow tied to that number), phishing (tricking the victim into handing over credentials directly), and social engineering the support channel itself, convincing a company's own customer-support agent, through a plausible enough story, to reset an account's recovery method on the attacker's behalf. That last vector is often the hardest to defend against, because it targets a human decision rather than a technical control.

Account recovery flows are the specific chokepoint where ATO risk concentrates, and for a structural reason: any system that lets a locked-out legitimate user regain access necessarily also has to let someone claiming to be that user regain access, and the recovery flow can't always tell the difference in advance. Get the check too weak and an attacker walks through it; get it too strict and a genuinely locked-out user is stuck for days.

Who actually built this

No single body coined or owns "account takeover" as a term, it's shared vocabulary across payments, banking, and cybersecurity practice. Two concrete, real responses are worth citing directly: the EU's PSD2 Strong Customer Authentication mandate pushed European payment-account providers toward multi-factor authentication in large part to close off the weakest ATO vectors, and the FIDO Alliance's passkey/WebAuthn standards were built specifically to eliminate the reusable-password problem that makes credential-stuffing ATO possible at scale. Neither is Solidus's work.

Solidus today

Solidus has designed, but not shipped, a response to ATO. The design, described in Solidus's own internal recovery vertical specification, replaces knowledge-based recovery questions and a support agent's manual judgment call with a supervised, high-assurance identity recheck for account recovery and other high-risk account changes. None of it runs today: there is no shipped recovery API, no audited flow, no design-partner integration, and no paying customer. The pricing figures attached to the idea internally are explicitly labeled illustrative rather than a live offer. What is real and separate from any recovery-specific product is Solidus Verify's general identity-match and liveness-detection pipeline, live on testnet, unaudited, which is the kind of engine a genuine recovery/ATO product would eventually be built from.

See also

Chargeback is a common downstream consequence of ATO, a stolen account making unauthorized purchases generates fraud-coded disputes. Synthetic Identity Fraud and First-Party Fraud are the two account-creation-stage fraud categories ATO is distinct from. Liveness Detection and Presentation Attack are the specific techniques a high-assurance recovery check would need to be honest about. Level of Assurance is what governs how strong a recovery recheck needs to be relative to the original account-opening check.