Account takeover: detection through session, device, and behavioral signals
In an account takeover, credentials are valid but the person behind the account has changed. TruvaLI analyzes device, IP, session, and transaction behavior together to catch anomalies before funds leave the account.
Account takeover occurs when an unauthorized person accesses a legitimate user's account. The distinguishing factor is that the login is successful. The password is correct, and in most cases, multi-factor authentication has also been bypassed. This is why takeover is not visible during authentication, but in post-login behavior.
Which signals indicate a takeover?
| Signal | Why it matters |
|---|---|
| New device ID | If an account has been accessed from the same device for years, a new device alone draws attention |
| IP reputation | Whether the address is a proxy, VPN, or residential ISP is determined via reverse DNS and ownership records |
| Impossible travel | If the distance between two sessions cannot be covered in the elapsed time |
| Shared device | Multiple customer accounts logging in from the same device ID |
| Setting change sequence | Funds leaving the account immediately after a password, email, phone, or IBAN change |
| Behavioral speed | Consecutive transactions on an account that is normally used slowly |
None of these signals constitute a decision on their own. What makes a takeover visible is their combination: funds leaving an account from a new device, behind a VPN, immediately after an IBAN change turns three separate weak signals into a single strong pattern.
How many accounts were opened from the same device?
Takeovers rarely stop at a single account. Account clusters connected via the same device, the same IP, or the same email pattern are invisible when viewed individually. Link analysis reveals these clusters: a suspicious account opens up all other accounts sharing the same device for investigation. Details are on the fraud detection page.
The email address itself is also a signal. Whether the provider is reputable, disposable, or privacy-focused generates a risk score. The similarity of the address to other addresses in the system via fuzzy matching, and clusters of addresses with sequential endings, provide additional indicators.
Catching it is not enough, it must be caught in time
In account takeovers, losses occur before detection, not after. Therefore, the evaluation must take place inline within the transaction flow, fast enough to make a decision. A slow check provides the correct answer only after the money has left, which has no practical value.
The impact of a rule is measured before going live: the new threshold is run against historical session and transaction traffic to see how many legitimate users it would block. This is what rule simulation and backtesting is for; the rule itself is written in the rule and scenario engine.
Generating rules from past cases
A past takeover is the best source for a rule. The signal pattern within the case can be extracted and converted into a rule, ensuring the same path cannot be exploited twice. The generating rules from past fraud page explains this.
When a suspicious flow is stopped
Stopping a flow opens a case. The case consolidates session history, device and IP information, the triggered rule and its version, transaction details, and the analyst's reasoning. Communicating with the customer and reopening the account are also decisions that are recorded. The workflow is detailed on the alert and case management page.
Takeovers often go hand in hand with payment fraud; read more on the chargeback and payment fraud page.
Common questions
- Why is account takeover not caught during authentication?
- Because the login is successful. The password is correct, and in most cases, multi-factor authentication has also been bypassed; the takeover becomes visible in post-login behavior.
- Which signals are evaluated together?
- New device ID, the proxy or VPN status of the IP, impossible travel between two sessions, shared devices, funds leaving the account following a settings change, and unusual transaction speed.
- Does a single signal trigger a decision?
- No. What makes a takeover visible is the combination of signals; a new device, a VPN, and funds leaving after an IBAN change together form a single strong pattern.
- Are accounts opened from the same device detected?
- Yes. Account clusters connected via the same device, IP, or email pattern are revealed through link analysis; a suspicious account opens up others sharing the same device for investigation.
- How does an email address generate a signal?
- Whether the provider is reputable, disposable, or privacy-focused generates a risk score. The similarity of the address to other addresses in the system via fuzzy matching, and clusters of addresses with sequential endings, serve as additional indicators.
- Does the check slow down the payment flow?
- The evaluation runs inline within the transaction flow and is fast enough to make a decision. A slow check provides the correct answer only after the money has left, which has no practical value.
- How is the risk of blocking legitimate users measured?
- The new threshold is run against historical session and transaction traffic, showing how many legitimate users would be blocked before the rule goes live.
- Can a rule be generated from a past case?
- Yes. The signal pattern within the case can be extracted and converted into a rule, ensuring the same path cannot be exploited twice.