Account takeover fraud

Account takeover fraud occurs when an attacker gains access to an existing customer's account and acts as that customer. Stolen passwords, phished authentication codes or a hijacked phone number can give criminals the access they need. In banking, a compromised login can expose account data and let an attacker initiate payments without the customer's permission.

Preventing account takeover requires protection both at login and during the session that follows. Banks can check authentication and unusual activity to identify access or payments that do not match the customer's normal behavior. In Germany, unauthorized payments generally require a refund, while customer liability depends on the circumstances, including fraud, intent or gross negligence.

How attackers get into an account

The cheapest route is credential stuffing, which OWASP describes as the automated submission of stolen username and password pairs into login forms. Credential stuffing works because people reuse passwords across sites, so one breach opens accounts elsewhere. The BSI lists the other routes to online banking access: phishing emails, trojans that capture access data and databases stolen from service providers.

A password alone rarely moves money at a European bank, because strong customer authentication asks for a second element. Attackers therefore go after that element too: a TAN typed into a phishing page, a code read out to a fake bank employee on the phone, or SMS codes redirected through a SIM swap.

Who carries the loss in Germany

A payment that the attacker initiates is unauthorized, and under section 675u of the Civil Code the bank must refund it at once, at the latest by the end of the business day after it learns of it. Under section 675v the customer carries at most EUR 50 where a payment instrument was misused, carries the full loss only after fraud, intent or gross negligence, and carries nothing if the bank did not require strong customer authentication.

The 2025 report on payment fraud by the EBA and the ECB shows how the line between unauthorized and authorized payments moves losses. In more than 90 percent of the value of card fraud the fraudster issued the payment order, and users bore 38 percent of card fraud losses. For credit transfers, where most fraud came from manipulating the payer into paying, users bore around 85 percent.

What banks check after login

Passkeys bind the login to the bank's own domain, so a phishing page cannot reuse them. Behavioral biometrics compares typing and touch patterns during the session with the customer's usual ones. ENISA describes an interface that some mobile operators offer to banks, so the bank can ask whether a customer's SIM card was swapped shortly before it sends a code.

The Payment Services Regulation adds duties for payment service providers: according to the European Parliament, payment service providers have to offer spending limits and blocking measures to reduce the risk of fraud. AI fraud detection scores the risk of payments after customers log in.

Upcoming events on fraud and digital identity in Germany

What is the difference between account takeover and identity theft?

Identity theft is the misuse of someone's personal data in general. Account takeover is the form that targets an account the victim already holds: the attacker logs in as the customer and acts from inside. The BSI names online banking among the accounts that criminals take over with stolen data.

Is account takeover covered by the APP fraud rules?

Authorized push payment fraud covers payments the customer makes personally after being deceived. In an account takeover the fraudster initiates the payment, which makes it unauthorized, and under the Payment Services Regulation a transaction that a fraudster starts or changes also counts as unauthorized.