Account takeover fraud detection is the work of spotting that someone other than the customer is now in control of an account, and stopping money before it leaves. Banks do it by joining signals across channels: a password reset or phished login, a new device, a changed phone number or email, a new payee, then a transfer. The hard part is that each system sees only its own step, and the one that scores the transfer rarely knows a reset happened an hour earlier. Botminds' Account Takeover Fraud Prevention lays one customer's steps on a single strip, scores takeover confidence on the whole sequence, and, between low and high confidence, proposes a question to the real customer rather than a hold on a guess.
The case and settings on this page are sample data from a fictional bank, Corvane National Bank, as it runs through the solution. The thresholds are that sample bank's settings, not recommendations for yours.
How do banks detect account takeover? By joining steps, not scoring one
Banks detect account takeover by watching for changes in how an account is accessed and administered before money moves, and then confirming with the customer through a channel the criminal does not control. FinCEN's advisory on account takeover activity, still the reference for how to file on it, framed detection that way in 2011: monitoring can reveal "inconsistencies with a customer's normal account activity that indicates illicit intrusions", including "unusual ATM activity, clustered Automated Clearing House (ACH) transactions in different geographic areas, sudden wire transfers, or changes to customer and account profiles" (FinCEN Advisory FIN-2011-A016).
The last item in that list is the one most systems underweight. A changed phone number or email is not a payment and usually does not reach the payments fraud engine at all, yet it is often the step that disarms every later control: once the number changes, the passcode for the new payee and the alert about the transfer both go to the criminal. Detection that starts at the transfer starts after the takeover is complete.
Scoring the transfer versus reading the session: what each one sees
A score on the transfer: A $9,750.00 transfer to a new payee, just under the $10,000 new-payee limit
The whole session, stitched: A phone reset at 1:12 PM, a new device in Las Vegas at 1:50, a new mobile number at 1:53, a new payee at 1:58, the transfer at 2:04
A score on the transfer: New payee and amount near a limit: score 914
The whole session, stitched: The temporary password from the phone reset used on the new device's first login
A score on the transfer: That the passcode for the payee went to a number changed five minutes earlier
The whole session, stitched: Nothing on the strip; it marks a step "may be incomplete" if a feed lags
A score on the transfer: The number on the profile, which is now the criminal's
The whole session, stitched: The mobile on file since 2019; the number added at 1:53 PM is marked never call
A score on the transfer: A score and a hunch
The whole session, stitched: Five dated steps, each with its source, and one proposed action
What are the signs of account takeover? The red flags regulators list
The signs of account takeover are changes in who logs in, from where and how, followed by changes to the account's controls and then unusual money movement. Three public sources between them cover most of the list, and they agree more than they differ.
Account takeover red flags, and where each regulator or supervisor names them
| Red flag | Named by | Why it matters |
|---|---|---|
| Changes to customer and account profiles | FinCEN advisory, 2011 | Phone, email and address changes redirect alerts and codes before money moves |
| Device ID not recognized; unfamiliar IP log-on address | Texas Department of Banking best practices, 2019 | A first-seen device far from the customer's history is the commonest login signal |
| Changes in customer behavior, transaction velocity, login or lockout activity | FFIEC appendix, 2021 | Bursts of failed logins point to password guessing; velocity points to a cash-out |
| New payees or receivers, unusual amounts; account and routing numbers of existing payees changed | Texas Department of Banking best practices, 2019 | Payee edits that keep the name but change the account are easy to miss |
| Unusually small transactions, such as a $1.00 ACH, at unusual hours | Texas Department of Banking best practices, 2019 | Test transactions often come before the theft |
| Clustered ACH in different geographic areas; sudden wires | FinCEN advisory, 2011 | The cash-out pattern: many transfers to many accounts at once |
| Deviation from the usual method of communication, such as an Internet-based phone number | FFIEC appendix, 2021 | The contact center's version of a new device |
A list is not a detector. Each flag on its own fires on thousands of legitimate customers a day: people buy new phones, travel, change carriers and pay new contractors. What separates a takeover is order and proximity, a reset followed by a new device followed by a contact change followed by a payee, inside an hour. That is a sequence question, and a sequence can only be read if the steps from the contact center, digital banking, the core system and the payments hub sit on one timeline.
Why a high score that nobody reads is not detection
A detection system is only as good as the decision it reaches inside the time the money is still there. The case most often cited on this point is a business account, but the lesson is general. In Patco Construction v. People's United Bank, the First Circuit described a bank whose system flagged six fraudulent withdrawals as high-risk and let them go through; "it appears no one at the bank monitored these high-risk transactions," the court wrote (Patco v. People's United Bank, 1st Cir. 2012). The loss totalled $588,851.26 over seven days.
The opposite failure is as real. In 2022 the CFPB found that Bank of America acted unfairly when it turned down prepaid debit cardholders' error notices and froze their accounts on nothing more than the output of a faulty fraud filter (CFPB, Bank of America, N.A., 2022; the guide to AI for fraud investigation reads the order closely). The bureau ordered a $100 million penalty, and the OCC fined the bank a further $125 million. The case was about claims and freezes, not takeover alerts, but the principle carries: a score that acts alone, with no person reading the evidence, is a liability in both directions.
Between those two lies the design question for any takeover system: what does it do when it is not sure? Holding every unclear session freezes good customers. Releasing them hands the clear cases to the criminal along with the unclear ones. The middle answer is to ask.
What is a takeover confidence score, and what should each band trigger?
A takeover confidence score is the system's estimate, from 0 to 1, that the person in the session is not the customer, computed over the whole sequence of steps rather than a single event. On its own it decides nothing. What matters is the action attached to each band, who is allowed to take it, and what happens when the score falls between the bands.
Four confidence bands in Account Takeover Fraud Prevention, and the action each one proposes
Below 0.30
Likely the customer
Closed by the agents with a written reason. A supervisor samples 2% of these closures every day.
Agents close · supervisor samples
0.30 to 0.60
Unclear
The agent says "unclear" and proposes a step-up only: a code to a phone that was on file 30 days or more before the first suspicious step.
Agents propose · the customer answers
0.60 to 0.80
Ask a person
Escalated to an analyst with the strip and the cited signals; the proposal is a step-up or an outreach call to a trusted contact, not a hold.
Analyst decides
0.80 and above
Protect now
The agent proposes a hold and a profile lock inside the hold window. On approval they act at once, and a supervisor confirms within 30 minutes.
Analyst approves · supervisor checks
The two middle bands are where the design shows. An agent that is unsure says so, in those words, and proposes the least intrusive action that would settle the question: a step-up the real customer can pass in seconds, or a call from a person to a number the bank has trusted for years. The question it asks is written into the case alongside the answer, so the next reviewer, auditor or model validator can see why a session was challenged rather than held.
In the sample case the score reached 94% on five steps, so the proposal was a hold and a profile lock. Contrast a case lower in the same queue: a customer who enrolled a new phone and logged in from Denver to send $1,850.00 to his own brokerage account scored 23%. A step-up passcode went to a number on file since 2017, the bank had a travel notice for those dates, and the payee had been on file since 2021. The payment was released, with a supervisor's check, in the same batch.
Asking the agents why, with the source behind each reason
What is step-up authentication, and when should detection ask rather than hold?
Step-up authentication is an extra check demanded in the middle of a session because something about it raised the risk: a one-time code to a trusted device, a confirmation in the bank's app, or a call back. The FFIEC describes the principle as authentication "applied commensurate with the increasing risk level associated with a transaction or access to an information system" (FFIEC 2021).
Step-up only works if the factor it asks for is still the customer's. Most takeovers that reach the payment stage have already changed the phone number or enrolled a device, so a code "to the phone on file" can land with the criminal. The sample bank's rule is therefore about dates, not channels: a step-up or outreach may only use a contact detail that was on file 30 days or more before the first suspicious step. A number added at 1:53 PM is never used, however confident the score.
Ask rather than hold when the evidence is ambiguous and the customer can be reached in time; hold when the evidence is strong or the window is closing. The solution's hold-window agent knows each rail's clock, asks for a decision 20 minutes before a window closes and escalates to the supervisor at 15, so an unanswered question turns into a protective hold rather than a release by default.
Who should a bank contact when it suspects takeover? The number the criminal did not choose
Contact the customer through a channel that predates the suspicious activity: a mobile or home number that has been on file for months or years, or a letter to the mailing address on file. Do not use the number on the profile without checking when it was added. In the sample case the outreach agent lists each contact detail with the date it went on file, the mobile since March 2019, the home line since August 2004 and the email since 2012, and marks the number added during the session never call.
Attempts are bounded too. The sample bank tries twice, 15 minutes apart; if neither call is answered, the hold stays and the supervisor is told. That rule matters because the cheapest way for a criminal to defeat outreach is to be unreachable on the old number and very reachable on the new one.
How long can a bank hold a payment for suspected takeover?
There is no general U.S. statute that sets how long a bank may delay an outgoing payment it suspects; the practical limit is the payment rail's settlement window and the terms of the account agreement. For wires and other funds transfers under Article 4A of the Uniform Commercial Code, a bank that has not agreed otherwise owes no duty to accept a payment order, or to do anything about it before acceptance, beyond what the Article itself requires (UCC §4A-212). The window to act is short in any case: once a same-day ACH batch settles or a wire is sent, stopping the money means recall requests and the cooperation of the receiving bank.
That is why detection is measured against clocks, not just accuracy. The sample bank's windows are same-day ACH batches at 11:00 AM and 3:30 PM, a 3:00 PM wire cutoff, person-to-person payments held 45 minutes, and profile-only cases decided within two hours. A correct answer at 3:31 PM on a 3:30 PM batch is a reimbursement, not a prevention; what that reimbursement costs the bank is set out in the guide to Reg E and account takeover.
Hold approved and profile locked, with the supervisor's check due
Can AI stop account takeover? What the agents in Account Takeover Fraud Prevention do and never do
AI can find and explain a takeover faster than a person rebuilding it from five screens, but in a well-governed bank it should not be the one that stops it. The solution's agents stitch the session, date the contact details, explain the signals, watch the clock, prepare the call and draft the restore; they never hold, release, call or restore. The analyst approves, edits or releases, with a reason code on every override, and a supervisor checks every release, unlock, restore and bulk protection.
In the sample bank's last week, analysts approved 739 of the 840 proposals as written (88%), edited 67 with a reason and overrode 34 with a reason code, most often because they had context the agents did not. Those overrides are the most useful output for the strategy team: each one says where the agents' picture was incomplete. The median time from escalation to decision was 14 minutes, every one inside its hold window. These are sample figures; the design target is to hold 90% or more of confirmed takeover transfers before they leave.
What to look for in account takeover detection software
Look for evidence that the system reads the steps before the payment, explains itself in terms an analyst can check, and is honest about uncertainty. Product demonstrations make every system look accurate on a clean case; the useful questions are about the messy ones.
Eight questions to put to any account takeover detection system, including this one
- Does it see the contact center?
Ask to see a phone reset joined to the login that used its temporary password. If the answer is "the engine scores the login", it does not.
- Does it date contact details?
A system that cannot say when a number went on file cannot tell you which number to call.
- What does it do when it is unsure?
There should be a named band between close and hold, with a less intrusive action than a freeze.
- Can every signal be opened at its source?
An analyst, an auditor or an examiner should reach the log line behind each claim in one click.
- Who acts, and who checks?
Holds, releases, unlocks and restores should be people's decisions, with a second person on the ones that matter.
- Does it know the clocks?
Queue order should follow time left before the money goes, not alert age.
- Does one takeover find the next?
The same device, IP block or payee on other customers should surface the same afternoon, not in next month's report.
- Will it run on your own past cases first?
Replay a quarter of confirmed takeovers and false alarms; count what it would have held, asked and missed.
Be equally clear about what Account Takeover Fraud Prevention is not. It does not replace the fraud detection engine, the device intelligence or the authentication system; it reads them, and its signals are only as complete as their logs. It does not authenticate customers at login. And it is built for takeover, where someone else is in the account; a customer who is tricked into sending money themselves is a scam case, covered by APP Fraud Detection. How to run the replay and the shadow period is set out in the six-week account takeover prevention plan, and how a model risk team should review the scores is in the guide to behavioral biometrics in banking. To see the strip on your own cases, start from Account Takeover Fraud Prevention.
Questions people ask
What are the first signs of account takeover?
Usually a change in how the account is reached or administered: a password reset, a login from a device never seen before, or a new phone number or email, before any money moves. FinCEN's 2011 advisory lists "changes to customer and account profiles" alongside sudden wires and clustered ACH transfers. Small test transactions, such as a $1.00 ACH, can also come first.
What is step-up authentication in banking?
It is an extra authentication step asked for mid-session because the risk went up, such as a one-time code before adding a payee. It protects only if the factor is still the customer's; a code sent to a number changed earlier in the same session goes to the criminal. The sample bank's rule is to step up only through contact details on file 30 days or more before the first suspicious step.
Should a bank freeze an account when it suspects takeover?
A targeted hold on the suspect transfer and a lock on profile changes protect the customer with less harm than a full freeze, and they keep the account usable while the bank reaches the real owner. A freeze based solely on an automated score is risky: the CFPB found it unfair in its 2022 order against Bank of America, which carried a $100 million penalty.
How fast must a takeover be caught to stop the money?
Before the transfer settles: the next same-day ACH batch, the wire cutoff or, for person-to-person payments, often minutes. After that the bank depends on recalls and the receiving bank. In the fictional sample case, 52 minutes passed from the phone reset to the transfer, and the hold was approved at 2:13 PM, 77 minutes before the 3:30 PM batch.
Can behavioral biometrics detect account takeover on their own?
They add a useful signal, typing and swiping patterns that differ from the customer's, but published research does not support using them as the only check, and NIST's 2025 guidelines allow biometrics only as part of multi-factor authentication. They work best as one signal on the strip, cited like the others, with a person deciding.