New account takeover tactics allow thieves to bypass passwords
- Cybercriminals are increasingly using methods that don't require knowing a victim's password to gain access to online accounts.
- Stolen login sessions, SIM swapping and fraudulent account recovery requests can allow thieves to bypass traditional security protections.
- Security experts say consumers should continue using strong passwords but also monitor active sessions, protect recovery methods and review connected applications.
This sounds scary. Cybersecurity experts now warn that protecting online accounts with strong, unique passwords and two-factor authentication may no longer be enough to keep cybercriminals out.
A recent
Fox News report highlights a growing threat known as account takeover fraud, in which criminals gain access to someone's email, financial or other online accounts without necessarily knowing the password.
The reason is simple: Passwords are only one part of the process websites use to establish someone's identity. Criminals have learned to exploit other parts of that process. In some cases, thieves can take control of accounts even when consumers have followed recommended security practices.
Six ways hackers can bypass passwords
One increasingly concerning technique involves stealing what's known as a session cookie. When consumers log into a website, the site often creates a digital token that allows them to remain signed in without repeatedly entering their credentials.
If a criminal steals that token, often through malicious software, the thief may be able to impersonate the legitimate account holder.
Other methods include:
1. Hijacking account recovery. Criminals who gain control of a victim's recovery email address or phone number may be able to reset an account password, even without knowing the original one.
2. SIM swapping. A thief tricks a wireless carrier into transferring a victim's phone number to another device. That allows the criminal to receive text messages containing security codes used to verify account access.
3. Authentication fatigue attacks. Some criminals repeatedly trigger login approval requests, hoping the account holder will eventually approve one to make the notifications stop.
4. Sophisticated phishing attacks. Fake websites can capture authentication information, including session tokens, allowing criminals to bypass certain forms of two-factor authentication.
5. Compromised third-party applications. Many consumers authorize outside applications to access their email, social media or other accounts. If one of those applications is compromised, criminals may be able to exploit its existing permissions.
6. Stolen login sessions. Malware installed on a computer or smartphone can sometimes extract the information needed to impersonate a legitimate user who is already signed in.
These methods illustrate why account security involves much more than protecting a password.
Why changing your password might not solve the problem
One particularly troubling aspect of these attacks is that changing a password doesn't always immediately remove an intruder.
For example, a criminal who has stolen a valid session token may remain logged into an account even after its owner changes the password, depending on the website's security procedures.
Similarly, a malicious application that has been granted access to an account might retain that access until the consumer specifically revokes its permissions.
That means consumers who suspect an account has been compromised should do more than simply create a new password.
They should also review active sessions, sign out unfamiliar devices and examine which third-party applications have permission to access their information.
How consumers can protect themselves
Security experts continue to recommend strong passwords and multifactor authentication, but additional precautions can make account takeovers more difficult.
- Use passkeys when available. Passkeys use cryptographic authentication and are designed to resist phishing attacks.
- Check which devices are logged into your accounts. Many email providers and financial institutions allow users to review active sessions and remotely sign out devices.
- Protect your cellphone number. Ask your wireless carrier whether it offers a PIN or additional protection against unauthorized number transfers.
- Review connected applications. Remove access for unfamiliar or unnecessary third-party services.
- Never approve an unexpected authentication request. If you receive a request to authorize a login you didn't initiate, reject it and investigate.
- Keep devices updated. Security updates and reputable malware protection can reduce the risk of malicious software stealing login information.
Consumers should also pay particular attention to their primary email accounts. Someone who gains access to an email account may be able to reset passwords for numerous other services, including shopping, banking and social media accounts.
A new approach to online security
The growing sophistication of account takeover attacks doesn't mean passwords have become useless. Strong, unique passwords and multifactor authentication still prevent many common attacks.
But they are no longer a complete security strategy.
The Federal Trade Commission recommends that consumers who discover an account has been hacked change their passwords, check account recovery information and examine their accounts for unauthorized changes.
Consumers can find additional guidance at the FTC's
IdentityTheft.gov. The larger lesson is that protecting an online account now requires protecting the entire login process, including recovery methods, connected devices and applications.
A strong password may keep a criminal from opening the front door, but it won't necessarily stop someone who has found another way inside.
