Account takeover fraud vs identity theft is a distinction between an existing account and a new one. In account takeover, a criminal gets control of an account the customer already holds, usually by stealing or tricking out the login, and moves the money in it. In new-account identity theft, a criminal uses the customer's personal details to open an account the customer never asked for. Both are identity theft in the broad sense used by the Bureau of Justice Statistics, but they exploit different steps of the bank's identity process, fall under different rules and land with different teams, and treating them as one problem leaves gaps in both. Botminds' Account Takeover Fraud Prevention is built for the first: it detects hijacked online banking and contact-center sessions on existing accounts before money leaves.
The case examples are sample data on fictional people at a fictional bank, Corvane National Bank, as it runs through the solution. Government figures are linked where they appear.
Is account takeover identity theft? In the survey's sense yes, in the bank's workflow no
Yes, in the broad sense: the Bureau of Justice Statistics counts "Misuse of an existing account" as one of three kinds of identity theft, defined as "completed unauthorized use of one or more existing accounts, such as a credit card, debit card, checking, savings, email, social media, telephone, online, mortgage, or insurance account" (BJS, Victims of Identity Theft, 2021). Opening a new account with someone's details is a second kind, and misusing their information for other fraud, such as a false tax return, is a third.
Inside a bank the distinction is sharper. FinCEN's analysis of suspicious activity reports maps typologies to the identity process: "During the authentication step, bad actors engage in an "Account Takeover" using stolen authenticators and credentials to gain full access to victim financial accounts. Bad actors who compromise the full PII details of victims ("Identity Theft") create new account relationships such as loans or new accounts to defraud victims" (FinCEN, Identity-Related Suspicious Activity, 2024). In that vocabulary, account takeover is a failure of authentication and identity theft a failure of verification at opening.
What is the difference between account takeover and identity theft? Row by row
The difference is which account is used and which check was beaten. In a takeover, the account, its history and its money are real, and the criminal has to pass as the customer at login or on the phone. In new-account fraud, the account is fresh and empty, and the criminal has to pass as the customer at opening.
Account takeover fraud vs new-account identity theft, row by row
Account takeover: An existing account the customer opened and uses
New-account identity theft: A new account opened in the customer's name without their knowledge
Account takeover: Authentication: login, reset, one-time code, contact-center questions
New-account identity theft: Verification at opening: documents, data checks, the customer identification program
Account takeover: A reset, a new device, a changed phone number or email, a new payee
New-account identity theft: Inconsistent identity data, a new device or address at application, rapid use after opening
Account takeover: The customer's balance, moved out in minutes
New-account identity theft: Credit lines and the account itself as a channel for other fraud
Account takeover: Regulation E for consumer transfers; Article 4A for business funds transfers; the Red Flags program for existing accounts
New-account identity theft: Customer identification rules at opening; the Red Flags program for new accounts
Account takeover: The fraud team watching sessions, or the customer locked out
New-account identity theft: The onboarding team, a credit bureau alert, or the person whose name was used
Account takeover: Contact-center logs, sessions, device history, change logs, payees
New-account identity theft: Application data, identity documents, onboarding device and address
The two often meet in one case. In the sample case at Corvane National Bank, the takeover of Gloria Henshaw's account, a customer since 2004, sent $9,750.00 to a payee whose account at another bank had been opened eleven days earlier and had been added to two other customers' profiles the same day. The takeover is one bank's problem; the eleven-day-old receiving account is very likely another bank's new-account fraud or a mule account.
Which is more common, account takeover or new account fraud?
Misuse of existing accounts is far more common. In the Bureau of Justice Statistics' 2021 survey, "3% had experienced the misuse of an existing bank account", while fewer than 1% had their personal information used to open a new account (BJS, 2021). In numbers, that is about 7.4 million people with an existing bank account misused against about 1.6 million with a new account opened in their name.
People who experienced each kind of identity theft in the past year, 2021
Frequency is not the same as cost per victim. The survey put the average direct loss from a new account opened in a victim's name at $3,430, against $620 for a misused credit card, $670 for a misused bank account and $550 for another existing account (the new account fraud statistics guide sets these beside the newer data). The bank-account figure is the victim's loss before reimbursement; under Regulation E much of an unauthorized consumer transfer is the bank's to repay, which shifts where takeover losses finally land.
Is account takeover covered by the Red Flags Rule? Yes, for existing accounts
Yes. The Identity Theft Red Flags Rule requires a written program to detect, prevent and mitigate identity theft both when a covered account is opened and on any covered account that already exists (12 CFR 41.90(d)(1); the Federal Reserve, FDIC and FTC have parallel rules). Many banks file the program under onboarding, which leaves the existing-account half thin.
The guidelines that accompany the rule are explicit about the existing-account side. For existing covered accounts, they say a program should catch red flags by authenticating customers, monitoring transactions and checking that change-of-address requests are genuine (Red Flags guidelines, Appendix A to 16 CFR part 681). Their examples include a request for a new card or phone, or for added authorized users, "Shortly following the notice of a change of address", and they name, as an aggravating factor that raises the risk, the bank learning that a customer has handed account information to someone falsely claiming to speak for the bank. That last example is the bank-impersonation call behind many takeovers.
A takeover program is therefore part of the Red Flags program, not a separate thing. When an examiner asks how the bank detects identity theft in existing accounts, the honest answer is the takeover controls: authentication on resets and contact changes, session monitoring, outreach to trusted contacts.
Which rules apply: Regulation E, Article 4A, the Red Flags program and customer identification
The rules follow the account. For takeover of a consumer account, Regulation E decides who pays for electronic transfers: a transfer made with credentials tricked out of the customer is still unauthorized, as the CFPB's Electronic Fund Transfers FAQs explain, and the customer's share is capped by how quickly they report. For a business account, Article 4A decides, and the security procedure is the question. New-account fraud sits mainly under the customer identification and Red Flags programs, because the victim is not the account holder.
Which rule answers which question, for each kind of fraud
| Question | Account takeover | New-account identity theft |
|---|---|---|
| Who bears a consumer's lost transfer? | Regulation E: mostly the bank, beyond the customer's capped share | Not a Regulation E question for the person whose name was used: it is not their account |
| Who bears a business's lost wire? | UCC Article 4A: the security procedure and the bank's good faith decide | Rarely arises: the account was never the business's |
| What program must detect it? | The Red Flags program for existing covered accounts | The Red Flags program for opening, plus customer identification |
| What does the FFIEC 2021 guidance cover? | Authentication, layered security, call centers, account maintenance | Identity verification for new customers and users |
| What goes in a suspicious activity report? | The term "account takeover fraud" in the narrative (FinCEN, 2011) | The identity theft typology and the opening details |
Who pays in a consumer takeover, tier by tier, is set out in the guide to Reg E and account takeover, and the business-account rules in the guide to corporate account takeover policy.
Who investigates account takeover? Different teams, and where Account Takeover Fraud Prevention hands off
Account takeover is usually investigated by the digital or payments fraud team, with the contact center for outreach; new-account fraud by onboarding or identity fraud teams, often close to know-your-customer operations. The split makes sense because the evidence is different: a takeover is reconstructed from authentication logs, sessions, device histories and change logs; a fraudulent opening from application data and identity documents.
The split also creates a blind spot where the two meet. A takeover's money usually lands in an account opened recently, sometimes at the same bank. If the takeover team blocks the payee but never tells the team that opened the receiving account, the mule account stays open for the next victim. In Account Takeover Fraud Prevention, the link agent looks for the same device, IP block or payee across customers, and in the sample case it found the receiving payee on two other customers' profiles that afternoon; blocking it for every customer was part of one checked bundle.
The takeover's payee, an eleven-day-old account, found on three customers by Account Takeover Fraud Prevention
Classification helps the teams talk. The Federal Reserve's FraudClassifier model separates "Unauthorized Party Took Over Account" from other unauthorized-party cases and, within it, takeovers through compromised credentials from those where the criminal impersonated the account holder, with a call-center example in which the impostor "was able to convince the call center he was Greg, having Greg's personally identifiable information in his possession" (FedPayments Improvement, FraudClassifier). Using one model across both teams lets the bank count where its identity process fails.
What is synthetic identity vs account takeover? A third kind, with no real victim at the door
Synthetic identity fraud uses an identity that belongs to nobody, or to nobody who will ever complain; account takeover uses a real customer's real account. The FFIEC defines the difference in a footnote: "Unlike typical identity theft fraud where a fraudster steals the identity of a real person and uses it to commit fraud, a synthetic identity is a completely fabricated identity that does not correspond to any actual person" (FFIEC 2021).
That changes how each is found. A takeover victim notices, often within hours, because their money moved or they were locked out. A synthetic identity has no one to notice, so it can be cultivated for months before it busts out. They meet in the same place as new-account fraud does: synthetic and freshly opened accounts are a common destination for takeover proceeds.
How do you report account takeover? To the bank first, then the authorities
A customer should report a takeover to their bank immediately, using a number they find themselves rather than one in a message or call, and then to the FBI's Internet Crime Complaint Center. Banks report suspected takeover in a suspicious activity report where the thresholds are met. FinCEN asked filers in 2011 to "use the term "account takeover fraud" in the narrative section of the SAR and provide a detailed description of the activity" (FinCEN Advisory FIN-2011-A016).
Reporting an account takeover: the customer's steps and the bank's
- Customer: call the bank on a number you looked up
Report it as soon as you know; under Regulation E, telling the bank within two business days of learning of it keeps a consumer's liability at no more than $50.
- Customer: ask for a recall and reset credentials
The FBI advises requesting a recall or reversal quickly and resetting any credentials that may have been exposed.
- Customer: file with the FBI's IC3
Include the words "Account Takeover" in the description, the FBI asks, along with the accounts and websites involved.
- Bank: protect, reach the customer, restore
Hold what can be held, call a contact that predates the takeover, and restore the profile with a second person's check.
- Bank: file a SAR where required
Use the term "account takeover fraud" in the narrative and describe the channel, as FinCEN's advisory asks.
- Bank: tell the receiving bank
Ask it to freeze or return the funds; the faster the request, the more often money is recovered.
Inside the bank, one confirmed case can need three hand-offs: to disputes if money left, to the BSA team for the SAR, and to the onboarding or mule team for the receiving account. In Account Takeover Fraud Prevention, the referral to the BSA officer is restricted to fraud, BSA and audit roles and never appears on a customer letter or call script. To see how a takeover case is assembled for each of those hand-offs, start from Account Takeover Fraud Prevention; the numbers behind both frauds are in the guide to account takeover fraud statistics.
Questions people ask
Is account takeover a form of identity theft?
In the broad sense, yes: the Bureau of Justice Statistics counts misuse of an existing account as identity theft, and it is the most common kind. In bank operations it is usually treated separately, because it defeats authentication on an existing account rather than verification at opening, and different rules and teams handle it.
Can account takeover lead to new-account fraud?
Yes. A criminal who controls a customer's email or phone can use it to pass checks when opening new accounts or applying for credit, and takeover proceeds often flow into newly opened accounts. In the fictional sample case, the payee's account had been opened eleven days before the takeover.
Does Regulation E cover a new account opened in my name?
Regulation E protects consumers against unauthorized transfers from their own accounts. A person whose identity was used to open an account is not that account's holder, so their protection comes from other rules, such as identity theft and credit reporting rules, and from the institution's Red Flags program. Counsel should advise on a specific case.
How do I know if it is account takeover or a scam?
Ask who made the payment. If someone else used the customer's credentials, it is a takeover, and Regulation E treats the transfer as unauthorized even if the customer was tricked into revealing them. If the customer was persuaded to send the money themselves, it is a scam, which is handled differently in the United States.
Which team should own account takeover?
Usually the digital or payments fraud team, with the contact center for outreach and the BSA team for reporting. What matters more than the owner is the hand-off: the team that confirms a takeover should be able to pass the receiving account to the team that handles new-account and mule fraud the same day.