Fraud detection · Account takeover
Account takeover prevention for banks and fintech.
Account takeover is when someone who is not the customer operates with their session, or convinces them to operate themselves. Ironchip detects it through the place, the device and the behavior of each operation, without adding steps for the customer who operates from where they always do.
Account takeover: scored operations
Why passwords and SMS codes are not enough.
In an account takeover the attacker already has what the bank asks for: the password, the one-time code or even the open session. That is why controls that only check credentials miss it. What the attacker cannot copy is the legitimate customer's context: where they operate from, with which device and how.
Phishing and credential theft
The attacker signs in with the password and code they have captured.
- A known customer suddenly uses a device that others have already used.
- A country or device never seen before, and impossible travel between two operations.
Vishing and authorized push payment fraud
The customer is talked into operating themselves over the phone.
- A transfer ordered during an ongoing call or with call forwarding active.
- A new device or context, or a remote control app installed.
SIM swapping
The customer's SIM is duplicated to receive their codes.
- A change of carrier or SIM country that does not match the radio signature of the place.
- Virtual eSIM activated just before operating.
Malware and remote control
The customer is signed in and someone else drives the session.
- Known malicious apps or a debugger attached to the app.
- Modified system: root, jailbreak, or emulator.
Where it is evaluated and how it responds.
Sign-up, login, KYC, every transfer and any change to account data or settings are scored. Account takeover has its own score, separate from the other fraud families, and comes explained in one sentence.
- 01Gather
The SDK reads the device environment at the moment of operation: GPS position, network, carrier, model and system, language, and app status.
- 02Understand
The engine contrasts GPS position with the radio signature and IP, and puts it alongside the customer's history: how many times they have operated, from where, with which device, and which network.
- 03Intercept
Your system decides with the score: let it through, ask for another factor or hold it. The customer who operates from where they always do notices nothing.
It integrates into your app and your decision engine.
- 1Datasource SDK in your app
Library for iOS, Android and JavaScript. It reads the signals when the customer operates, with no new screens.
- 2Fraud Detection API from your backend
With the operation identifier you request the report over HTTP, or receive it via webhook or WebSocket as soon as it's ready.
- 3Your engine decides
The account takeover score goes into the BPM, SIEM or case manager you already use, with the rules you already have.
Real case: how Abanca stops money mules and SIM swaps from their app
Account takeover FAQ
What is account takeover?
It is when someone other than the customer takes control of the customer's account. The attacker operates with the customer's session, with stolen credentials, or by convincing the customer to carry out the operation themselves, for example a transfer or adding a new payee.
Why doesn't an SMS code prevent account takeover?
Because the attacker can get the code: they ask the customer for it over the phone, receive it with a duplicate SIM, or capture it with a phishing site that relays the session in real time. The code proves that someone has it, not who is operating or from where.
How does Ironchip detect an account takeover?
By comparing each operation with the customer's usual context: their places, their device, their network and their usual way of operating. A device or a country never seen before, impossible travel, a SIM that does not match the radio signature of the place, or a transfer during a phone call raise the account takeover score.
Does it add steps or friction to the end customer?
No. The SDK reads signals in the background while the customer operates, without new screens. Only risky operations receive an additional factor or are held; the rest proceeds as always.
How does it integrate with our decision engine?
The Datasource SDK integrates into the iOS, Android or web app, and your backend requests the report for each operation from the Fraud Detection API via HTTP, or receives it via webhook or WebSocket. The score and fraud type enter your current rules.
Let's analyze your account takeover cases with real data.
A specialist reviews your scenarios before the call and we show you the platform using your own operations.