What is account takeover?
Account takeover is an attacker gaining control of a legitimate account, and on corporate social accounts it almost always happens through people and process rather than through the platform itself.
Also called ATO.
The common routes are mundane: a login shared between several people with no second factor, an administrator who left the business and kept their access, an agency seat that outlived its contract, or a recovery address pointing at a mailbox nobody controls any more.
The consequences are disproportionate to the effort. A taken-over account carries the brand's followers, its verification badge and its credibility, which is why it is used for payment fraud and cryptocurrency scams rather than for defacement.
Recovery depends almost entirely on what was recorded before the incident. A brand that can show the account's ownership history, its administrator of record and a controlled recovery route gets it back quickly; one that cannot is in a support queue with no evidence.
Related terms
- Social media governanceSocial media governance is the set of controls that establishes who owns a brand's social accounts, who can reach them and how that access is granted and removed — as distinct from managing what gets published on them.
- Ghost accessGhost access is a live grant on an account held by someone who should no longer have it — a former employee, a finished agency, a contractor whose engagement ended.
- Social engineering fraudSocial engineering fraud is a loss caused by deceiving a person into authorising a payment or handing over access, rather than by any technical compromise of a system.
- VerificationVerification is a platform's own confirmation that an account genuinely belongs to the person or organisation it claims to, shown as a badge on the profile.