# What is an account takeover?

> When an attacker gains control of an account and locks the legitimate owner out of it.

Last reviewed: 2026-09-01

## Account takeover

Category: Attacks

Also called: ATO

Canonical page: https://moolkey.com/glossary/account-takeover

Account takeover happens when an attacker moves from accessing your account to controlling it. They may change the password, recovery email, and second factor so you cannot get back in. Credential stuffing, phishing, and SIM swapping are common routes to that outcome.

### The chain that leads there

Almost every takeover follows the same route: a password is obtained (through a breach, a phishing page, or reuse), it works somewhere, and the attacker then locks down the recovery paths. The critical link is usually your email account, because whoever controls it can reset everything else.

### What actually stops it

A unique password per site removes replay. Two-factor authentication means a correct password alone is not enough. An authenticator app or hardware key removes SIM swapping as a route in. Protect the email account first because it can reset almost everything else.

### Sources

- [OWASP: Credential Stuffing Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.html): How password reuse is replayed at scale and how services can limit the damage.
- [OWASP: Multifactor Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Multifactor_Authentication_Cheat_Sheet.html): A comparison of authentication factors, recovery paths, and common attack routes.
- [CISA: Secure Our World](https://www.cisa.gov/secure-our-world): Public guidance for recognizing phishing and protecting high-value accounts.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.