Account takeover (ATO)
explained.

How account takeover happens

Visa defines ATO as a type of identity theft where fraudsters access victims' accounts and make changes such as modifying personal information. Its merchant guidance describes the common routes:

• Credential stuffing: bots test usernames and passwords stolen in other breaches against many sites at once, exploiting password reuse.
• Phishing, smishing and vishing: tricking customers into giving up credentials or one-time passcodes by email, text or phone.
• SIM swap: taking over a phone number to intercept passcodes.
• Social engineering of support teams: persuading an agent to change an email or reset a password.

Why ATO is dangerous for merchants

An established account looks trustworthy: prior orders, a real name, often a saved card. Fraud tools that reward history can wave the order through. When the real cardholder reports the charge, the merchant faces a fraud chargeback and a customer who lost trust in the store.

Warning signs

Visa's guidance tells merchants to monitor failed logins and logins whose device and session data differ from what's known about the user (IP address and geolocation, device ID, language, time zone), and to alert on multiple cards used with the same email and device or many logins from different IPs. On the order itself, look for:

• New shipping address, especially a freight forwarder or a different region.
• Email, phone or password changed shortly before the order.
• A new device or network.
• A new card on an account that always used the same one.
• An order several times the customer's usual size.
• Loyalty points or store credit drained.

A worked example

A customer has bought four times over two years, $60 to $90 each, shipping to Ohio. On Tuesday their account logs in from a new device, the email is changed, a new shipping address in another state is added, and a $780 order is placed with a new card. Each change alone is ordinary; together they are a classic takeover pattern. Holding the order and confirming with the customer through their original email costs a day; shipping it likely costs $780 plus a chargeback fee.

What merchants should do

• Offer or require multi-factor authentication, and step it up on sensitive changes.
• Notify customers at their old email when the email, password or address changes.
• Rate-limit logins and block known bot patterns.
• Screen orders on change signals, not just on history.

A note on Compelling Evidence 3.0

Visa CE 3.0 requires prior orders to match on at least two elements, one of them IP address or device. An account match alone is not enough, which helps protect cardholders from having ATO orders defended with the real customer's history.

How Verdikx helps

Verdikx is a fraud, chargeback and dispute platform for e-commerce and SaaS merchants, made by Verdikx LLC. On Growth and Pro, order screening checks established Shopify customer accounts for takeover patterns: a new shipping address, email, phone, internet connection, device or card, or an order much larger than usual. Two changes at once flag a possible takeover; three or more, or new contact details plus a new shipping address, flag a likely takeover, with plain-English reasons. On Pro, the "Hold account takeovers and card testing" rule template holds those orders before they ship. Verdikx never cancels an order on its own. With order screening (Growth and up), it holds risky Shopify orders and orders from customers you block, and you decide whether to cancel. Autopilot never accepts a dispute. See Shopify fraud detection.