What account takeover is
Account compromise means someone gets into your email, bank or other online account without your permission. The Australian Cyber Security Centre says they can then steal personal information, money and identity. Accounts are often compromised because login details leak: you reused a password on another account that was breached, your details were in a data breach, or they were stolen by a phishing scam.
For a business, a taken-over email account is the engine of payment redirection: the criminals aim to trick the owner's contacts into sending money to accounts they control. Warning signs listed by the Australian Cyber Security Centre include being logged out of all devices, logins from unusual places, unexpected password-reset messages, changed recovery details, and emails marked as read, sent or deleted that you did not touch.
Remember
Facts and sources for this part
- Account compromise means someone gets into your email, bank or other online account without permission and can steal personal information, money and identity. [KS10]
- Accounts can be compromised when login details are leaked or stolen, for example by reusing a password on another account that is breached, or by a phishing scam. [KS10]
- With a business email account, criminals aim to trick the account owner's contacts into sending money to bank accounts the criminals control. [KS10]
- Warning signs include being logged out of all devices, logins from unusual places or devices, unexpected password reset messages, changed recovery details, and emails marked as read, sent or deleted that you did not touch. [KS10]
Passwords and multi-factor authentication
Multi-factor authentication (MFA) means you need two or more different ways to prove you own an account, such as a password and a code. If a criminal steals your password, they still have to get past the second step. The Australian Cyber Security Centre calls MFA one of the most effective controls against unauthorised access, because stealing one credential is much easier than stealing the right combination of several. Scamwatch lists reused and easily guessed passwords as weaknesses scammers exploit, and advises passwords or passphrases that are hard to guess.
Our advice: use a different long passphrase for each important account, store them in a password manager your workplace approves, and turn on MFA wherever it is offered, starting with email.
Remember
Facts and sources for this part
- Multi-factor authentication (MFA) means needing two or more different ways to prove you own the account, which makes it harder for criminals even if they steal a password. [KS10]
- The Australian Cyber Security Centre describes MFA as one of the most effective controls against unauthorised access, because stealing one credential is much easier than stealing a correct combination of several. [KS9]
- Scamwatch lists reused and easily guessed passwords among the weaknesses scammers exploit, and advises passwords or passphrases that are hard to guess. [KS3]
- Scamwatch lists using multi-factor authentication whenever you can as a basic step to protect against account takeover. [KS3]
MFA fatigue and giving away codes
Not all MFA is equally secure. The US cyber agency CISA says some forms are vulnerable to phishing, "push bombing" and SIM swapping. Push bombing, also called MFA fatigue, is when an attacker who already has your password floods your phone with approval prompts until you approve one by accident or just to make them stop.
CISA recommends phishing-resistant MFA and, where that is not possible, number matching for push prompts, while noting that number matching is weaker. The FBI adds that criminals use social engineering to talk people into reading out a two-factor code, so never give a code to anyone who contacts you. Our advice: if you receive an approval prompt you did not start, always press Deny, change your password, and tell IT, because someone already knows your password.
Remember
Facts and sources for this part
- CISA says not all forms of MFA are equally secure: some are vulnerable to phishing, push bombing and SIM swapping. [KS32]
- MFA fatigue, also called push bombing, is when an attacker floods a user with phone approval prompts until the user approves one by accident or out of annoyance. [KS33]
- The US cyber agency (CISA) recommends phishing-resistant MFA, and if that is not possible, number matching for push prompts, while noting number matching is weaker. [KS33]
- The FBI says actors may use social engineering to get you to disclose a two-factor code, which lets them take over your accounts. [KS15]
SIM swaps and help-desk tricks
A SIM swap is when criminals convince a phone company to move your number to a SIM card they control. Scamwatch explains that once a number is ported, calls and texts, including bank codes, go to the scammer, who can then log into bank, email and other accounts.
A government advisory about one criminal group describes tactics that mix several of these steps: repeated MFA prompts until staff press Accept, phone calls and texts posing as the IT help desk, and posing as employees to get the real help desk to reset a password and move the employee's MFA to the criminals' device. The same advisory says FIDO/WebAuthn and PKI-based MFA resist phishing. Our advice: help desks need the same callback and second-person rules as finance teams, for any password or MFA reset.
Remember
Facts and sources for this part
- A SIM swap is when criminals convince a phone company to move your number to a SIM card they control. [KS32]
- Scamwatch says that once a number is ported, calls and messages, including bank SMS codes, go to the scammer, who can then log into bank, email and other accounts. [KS3]
- A government advisory about a criminal group describes tactics that include repeated MFA prompts until staff press Accept, phone calls and texts posing as the IT help desk, and posing as employees to get the help desk to reset a password and move the employee's MFA to the criminals' device. [KS13]
- The same advisory says FIDO/WebAuthn and PKI-based MFA are resistant to phishing and, as it puts it, not susceptible to push bombing or SIM swap attacks. [KS13]
Scenario 1: a chat message
At 11:40 pm Priya's phone buzzes with a sign-in approval request from the company's login app. She did not try to log in. It buzzes again, and again, ten times in five minutes. Then a text arrives: "This is IT Security. We are fixing a fault. Please approve the next request to stop the alerts."
Red flags: Approval prompts for a login you did not start; Repeated prompts to wear you down; A message urging you to approve one to "stop" them.
What to do: Press Deny on every prompt and do not approve any. Change your password from a device you trust, and report it to IT through the normal channel the next morning or the emergency number. Someone has your password, so it needs resetting even though the attempt failed.
Remember
- Approval prompts for a login you did not start
- Repeated prompts to wear you down
- A message urging you to approve one to "stop" them
Facts and sources for this part
- MFA fatigue, also called push bombing, is when an attacker floods a user with phone approval prompts until the user approves one by accident or out of annoyance. [KS33]
- The US cyber agency (CISA) recommends phishing-resistant MFA, and if that is not possible, number matching for push prompts, while noting number matching is weaker. [KS33]
- The FBI says actors may use social engineering to get you to disclose a two-factor code, which lets them take over your accounts. [KS15]
Scenario 2: a phone call
Marcus's phone rings. "Hi, this is Sam from the IT help desk. We've detected unusual activity on your account. To secure it I need you to read me the six-digit code your authenticator app is showing, and then install a support tool so I can check your laptop."
Red flags: An unexpected call from "IT" asking for a one-time code; A request to install remote-access software; Pressure about "unusual activity".
What to do: Do not read the code or install anything. Say you will call back, hang up, and phone the help desk on the number in the company directory. Report the call. Real support staff do not need your one-time codes.
Remember
- An unexpected call from "IT" asking for a one-time code
- A request to install remote-access software
- Pressure about "unusual activity"
Facts and sources for this part
- A government advisory about a criminal group describes tactics that include repeated MFA prompts until staff press Accept, phone calls and texts posing as the IT help desk, and posing as employees to get the help desk to reset a password and move the employee's MFA to the criminals' device. [KS13]
- The FBI says actors may use social engineering to get you to disclose a two-factor code, which lets them take over your accounts. [KS15]
- Phishing warning signs listed by the Australian Cyber Security Centre include pressure to act quickly, requests for passwords or authentication codes, and callers asking you to skip normal security steps. [KS11]
Scenario 3: a text message
Elena's mobile suddenly shows "No service". Ten minutes later, on a colleague's phone, she sees an email alert: "Your mailbox password was reset" and a bank notification that a new device was added. She never asked for either.
Red flags: Sudden loss of phone service; Password-reset and new-device notices you did not request; Bank codes would now go to whoever controls the number.
What to do: Contact your phone company from another phone and ask whether your number was moved. Call your bank on the number on your card and ask them to block access. Reset your email password from a trusted device, and tell IT. Check your accounts for changes.
Remember
- Sudden loss of phone service
- Password-reset and new-device notices you did not request
- Bank codes would now go to whoever controls the number
Facts and sources for this part
- A SIM swap is when criminals convince a phone company to move your number to a SIM card they control. [KS32]
- Scamwatch says that once a number is ported, calls and messages, including bank SMS codes, go to the scammer, who can then log into bank, email and other accounts. [KS3]
- Warning signs include being logged out of all devices, logins from unusual places or devices, unexpected password reset messages, changed recovery details, and emails marked as read, sent or deleted that you did not touch. [KS10]
Scenario 4: an email
Marcus receives an email: "Someone signed in to your account from a new device in another country. If this was not you, click here to secure your account." He has not travelled. The link goes to a sign-in page at "secure-signin.example".
Red flags: A security alert that asks you to click and sign in; A sign-in page at an unfamiliar address; Fear used to rush you.
What to do: Do not click the link. Go to the service by typing its address or using its app, and look at the account's recent activity there. If anything looks wrong, change the password and check that MFA is on. Report the email to IT.
Remember
- A security alert that asks you to click and sign in
- A sign-in page at an unfamiliar address
- Fear used to rush you
Facts and sources for this part
- Accounts can be compromised when login details are leaked or stolen, for example by reusing a password on another account that is breached, or by a phishing scam. [KS10]
- Warning signs include being logged out of all devices, logins from unusual places or devices, unexpected password reset messages, changed recovery details, and emails marked as read, sent or deleted that you did not touch. [KS10]
- The FBI says not to click links in an email or text until you have independently confirmed who sent it. [KS15]
- Scamwatch lists using multi-factor authentication whenever you can as a basic step to protect against account takeover. [KS3]
Check what you have learned
Three questions from the test, each explained. Tap an answer.
Question 1 of 3
At 11:40 pm your phone buzzes ten times with sign-in approval requests you did not start. A text says "IT Security: approve the next request to stop the alerts". What do you do?
Show the answer
Right answer: A, Press Deny on all of them, change your password on a trusted device, and tell IT. Someone already has your password. Real IT staff do not ask you to approve a login you did not start. [KS33]
Question 2 of 3
What happens after a successful SIM swap?
Show the answer
Right answer: A, Calls and texts, including bank codes, go to the criminal who controls the SIM. Scamwatch explains that scammers can then log into bank, email and other accounts. [KS32]
Question 3 of 3
You get an email saying "someone signed in to your account from a new device in another country; click here to secure it". You have not travelled. What do you do?
Show the answer
Right answer: D, Don't click; go to the service yourself, check recent activity, and report the email. A security alert that asks you to click and sign in is a common trick. Go to the service directly. [KS10]