Up to 25% of U.S. adults targeted by account takeovers
Research shows up to 25% of U.S. adults face account takeovers, with attackers increasingly seeking durable footholds that survive password resets.
Key figures
| U.S. adults experienced account takeover attacks | 22% and 25% |
|---|---|
| Personal social media accounts share of personal ATOs | 51% |
| Average financial loss for targets | nearly $12,000 |
| Increase in ATOs between 2019 and 2020 | 250% |
| Takeovers affecting personal accounts | 80% |
Between 22% and 25% of U.S. adults have experienced account takeover (ATO) attacks, according to research from security.org [2]. Personal social media accounts are the most frequent targets, accounting for 51% of personal ATOs [2].
The prevalence of these attacks highlights a gap in current defenses. Research shows that 62% of personal ATO victims had security questions or advanced authentication enabled on their accounts [2]. For those targeted, the average financial loss is nearly $12,000 [2].
The shift to durable access
While initial access often begins with phishing—a process now aided by generative AI—attackers are moving away from immediate exploitation [3]. Dave Baggett, SVP Cybersecurity with software developer Kaseya, said, "Now they are starting to get clever. They’ll get access to an account and sit tight," to monitor traffic and wait for a strategic moment to act [3].
The goal of this stealth phase is to convert temporary access into a permanent foothold [1]. Research from NHIMG indicates that attackers attempt to create durable control that can survive simple remediation, such as a password reset [1]. This involves reshaping the account's identity to ensure repeatable access [1].
Signs of campaign expansion
Detecting a takeover requires monitoring the "control plane" rather than just login anomalies [1]. NHIMG states that "expansion is visible in control-plane activity before it is visible in business impact" [1].
Specific indicators that a campaign is expanding include:
- Enrollment of new multi-factor authentication (MFA) factors [1].
- Registration of new devices through native management tools [1].
- Unusual VPN usage originating from unmanaged devices [1].
- Enumeration of applications connected to the identity provider [1].
Once an attacker establishes this foothold, they may pivot into business-critical applications, cloud consoles, or security tooling to widen the blast radius [1].
Target distribution and growth
The scale of the problem grew rapidly between 2019 and 2020, with ATOs increasing by 250% [2]. This surge was fueled by discounts on botnet time and dark web data [2].
The targets are predominantly individuals, with 80% of takeovers affecting personal accounts compared to 13% of business accounts [2]. Beyond social media, one-third of all ATOs target bank accounts, including fintech services [2].
What we don't know
- What specific "advanced authentication" methods were bypassed by 62% of the personal ATO victims?
- Which specific "third party" accounts are most vulnerable to outbound phishing as identified by Kaseya?
- To what extent does the use of generative AI in phishing specifically increase the success rate of bypassing MFA compared to traditional phishing?
Sources
- What are the signs that an account takeover campaign is extending ... — nhimg.org, Oct 24, 2026
- Account Takeover Fraud: A Guide to Protecting Yourself — security.org, Oct 24, 2026
- When the attacker becomes the user: Rethinking account takeover — theregister.com, Oct 22, 2026
Photos and video from the reports
- Photo: Research showing social media (51%) and banking (32%) as the most common accounts taken over.
- Photo: Data showing 29% of account takeover victims experienced identity theft.
- Video: A video titled "How Scammers Takeover Accounts | Account Takeover Fraud & Identity Theft".
- Video: A video titled "SCAM ALERT: How Criminals Can Takeover Your Bank Account".
