# Account Takeover

When an attacker gains unauthorized control of a legitimate user's online account, usually to steal money, data, or identity.

**Account takeover[↗](/account-takeover)** occurs when an attacker gains unauthorized control of a legitimate user's account, email, banking, social media, or a corporate login, typically after obtaining the password through phishing[↗](/phishing), a data breach[↗](/data-breach), or credential stuffing[↗](/credential-stuffing). Once inside, the attacker can impersonate the victim, steal funds or data, or use the account as a launchpad for further attacks.

Account takeover is especially damaging because the activity often looks legitimate to automated defenses, since it comes from a real, trusted account. Multi-factor authentication[↗](/authentication), unique passwords per site, and login alerts are the most effective defenses against it.