In a payments context, account takeover splits into two categories that behave very differently. Takeover of a banking profile lets the attacker initiate transfers directly. Takeover of a mailbox lets the attacker influence transfers that other people initiate, which is far harder to detect because the money movement is performed by an authorized employee.
Mailbox takeover is often invisible for weeks. Attackers create inbox rules that hide replies, read historical threads to learn payment cadence and tone, and wait for an invoice of meaningful size before acting.
Common questions
It removes the simplest path, password reuse, but token theft, consent phishing, and help desk social engineering all produce authenticated sessions without a password prompt.
Unexplained inbox rules, especially rules that move or delete messages containing words such as invoice, payment, or remittance.
Sources and further reading
Citing this entry? Cite as Coffr, LLC and link to https://getcoffr.com/glossary/account-takeover.