Account takeover fraud

The beauty of online banking and other online accounts is that you can monitor them almost in real time. That means you can catch crooks long before a statement arrives in the mail.

Here’s how to shield your money and your existing accounts.

What to do if an account is hacked:

• View and verify account activity. First, go through your account activity to confirm any changes or fraudulent charges. Keep in mind that some legitimate transactions may seem fraudulent if the company does business under a different name.
• Update your system and delete any malware.  The first thing you should do if your account gets hacked is to run an end-to-end antivirus scan. This means skipping the "quick scan" setting in favor of a deep scan to identify and eliminate not only all forms of malware (including Trojans and spyware to keyloggers that could be tracking your keystrokes even after the hack has been identified) and potentially unwanted applications.  It's important to make sure you're clean before you change any of your other sensitive information to avoid restarting the cycle.  Also, set your security software, internet browser, and operating system to update automatically.  Click here for a list of free online security scanning software.
• Review Social Media Accounts.  Look for changes your social networking sites, look for changes to the account since you last logged in.  Look at your personal details, review any third-party apps connected to your account, and check your security questions and answers and your backup email addresses and/or phone numbers. If you think your hacker had a chance to scan your security questions and backup accounts, try to change these on the compromised account and on any other account that relies on the same information. This will prevent the bad actor from using your personal details to breach other accounts in the future.
• Change Your PINs & Passwords.  Once your computer is free of malware, it's time to change your password. If you've lost access to your account, you may need to contact the company directly, prove who you are and ask for a password reset. Choose a new password that is very different from your old one and make sure it doesn't contain strings of repeated characters or numbers. Your password should be unique for each account, complex (i.e., a mix of letters, numbers and special characters) and at least 15 characters long.  Learn more about passwords here.
• Contact Other Online Services.  It's critical to change your passwords with other payment-based accounts such as Amazon, Netflix, LinkedIn, credit card companies, etc. Make sure you use different passwords for every online account.
• Notify People You Know.  Tell your friends, family and anyone else on your email contact list that they might have gotten a malicious link. During the period when attackers had control of your account, they could have sent dozens or even hundreds of fraudulent emails to everyone you know, in turn giving them access to a new set of victims. 
• Change Your Security Questions.  While your password was the most likely attack route, it's also possible that hackers broke into your account after answering your security questions. Many users choose the same answer to common security questions.  In order to further protect your email, be sure to employ the multi-factor authentication that many providers allow to gain access to your password, including using secondary email addresses or text messages, since security questions alone are not enough.
• Report the Hack.  If you haven't already, contact your financial institution, email provider, or other company and report the hack. This is important even if your hacked account didn't cause you to lose access since it helps providers track scam-based behavior. If possible, freeze your bank account online, on the app or by speaking with customer service.  In addition, your account provider may be able to offer details about the origin or nature of the attack.
• Contact Credit Agencies.  Contact the three credit reporting agencies TransUnion, Experian and Equifax to monitor your accounts in the months after you've been hacked.  Click here to contact credit report agencies.
• Consider Your ID Protection Options.  If you've been hacked, another idea worth considering is an ID protection service. These services typically offer real-time email and online retail account monitoring, in addition to credit score reporting, and personal assistance in the event of an identity theft. Your financial institution will offer this program for a small monthly fee.
• Review All Email Accounts.  If the breach affected a service that includes email, such as your Google account, check the email account for sent messages or for new filters. For example, clever hackers can set up filters that forward all incoming mail to an address you don't recognize. Delete such filters to prevent people from worming their way back into your account in the future. This is particularly important because you can reset many other accounts' passwords, and receive notifications about suspicious activity, over email. You don't want an eavesdropper to nab those recovery messages.  Also, check that your email signature and "away" message don’t contain unfamiliar links or forwards. 
• Create a New Email Account.  Sometimes it's not worth picking up where you left off. If this isn't the first time hacked email has been a problem, or if your provider doesn't seem to be taking steps to mitigate the amount of spam you receive, it may be time for a switch. Look for a service that offers default encryption of your emails and solid customer service in the event of an issue.

What types of crimes can be committed by criminals with your information?

• Phishing:  Mobile, Email, Web Site & Social Media phishing rely on social engineering tactics to fool you into either clicking on a link, sharing a link, downloading a file or entering information into an online form.  Having more of your personal information makes it easier for criminals to convince you that the "phish" is legit.
• Stolen or Compromised Credentials:  Armed with stolen, up-to-date PII data, criminals can more easily impersonate you in order to get into your account.  Stolen information will be used to take over existing accounts, such as banking, brokerage, phone service, tax refund fraud, social security, government benefit fraud and retirement accounts. Call centers and online systems rely on these pieces of information to verify account holders.  Criminals can use this information to correctly answer the call center knowledge-based authentication questions.
• Passwords: Reused passwords multiply consumer risk.  Once a fraudster hacks one of your accounts, the next account often is easier to crack if you use the same username and password combination.
• Email Account: With access to an email account, the fraudster can reset site passwords on commercial websites using your trusted email address. 
• eCommerce Account: Once a fraudster accesses your e-commerce account, they now have access to all of the payment methods linked to that account.  You may have a stored account where you have linked a few of your credit cards and PayPal account to easily use when you check out.  Gaining access to this account is far more lucrative to a hacker as they now have access to your multiple stored payment methods versus trying to use a list of one-off stolen credit card numbers, which may or may not be valid.
• Rewards accounts: Another goldmine for fraudsters is rewards points stored online in retail store accounts.  Thieves who get access to those accounts can use the stored information to buy expensive items. 
• Banking: If a fraudster cleans out your bank account or takes out a loan in your name, your money is gone.  One way that this can happen is if click on a link that downloads keystroke logging malware onto your computer. That keystroke logging tracker will note that every time you click on your bank’s website and record the user name and password.  The malware sends the login info to the fraudster’s network. The malware works in the background and van be very difficult to detect. 

1. Reconcile or balance your bank account every month. The beauty of online accounts is that you can monitor them almost in real time. That means you can catch crooks long before a statement arrives in the mail. Learn more
2. File your taxes promptly.  While thieves may use stolen information to create fraudulent bank accounts, they may also use it to file fraudulent tax returns. File your taxes as soon as you have the tax information you need and respond promptly to letters sent to you by the IRS. Note that the IRS will never communicate with you via email, so watch out for this type of fraud and don’t open emails purporting to be from the IRS
3. Be extra careful about emails and attachments.  Avoid clicking on links or downloading attachments from suspicious emails that claim to be updates from any company connected to a data breach. Learn More
4. Use Two-factor authentication.  Two-factor authentication adds a second level of authentication to an account log-in. When you have to enter only your username and one password, that's considered a single-factor authentication. 2FA requires the user to have two out of three types of credentials before being able to access an account. Learn More
5. Check your Credit Cards accounts often. Reviewing your recent account activity is fundamental to credit card safety—and it’s easy. You can do it online or by phone. If your credit card issuer offers email or text alerts about unusual activity, sign up to receive them.
6. Monitor credit reports.  Check your credit report for any accounts that crooks may have opened in your name. Credit reports are available for free, from each of the three national credit reporting agencies — Equifax, Experian and TransUnion — every 12 months from http://www.AnnualCreditReport.com. Some monitoring services and credit card companies now allow you unlimited access to credit information, so you could theoretically check every day. 

Data breaches will help phishers trick you.

What to do: