# Account takeover prevention for banks and fintech.

> How to detect and stop account takeover in banking and fintech: phishing, vishing, SIM swapping and malware, through location, device and behavior.

URL: https://www.ironchip.com/en/account-takeover-prevention

Fraud detection · Account takeover


Account takeover is when someone who is not the customer operates with their session, or convinces them to operate themselves. Ironchip detects it through the place, the device and the behavior of each operation, without adding steps for the customer who operates from where they always do.

[Talk to an expert](https://www.ironchip.com/en/talk-sales?producto=Location-Based%20AntiFraud#hs-demo-form) [See the fraud platform](https://www.ironchip.com/en/fraud-platform)

_Operations scored in real time._

## Why passwords and SMS codes are not enough.

In an account takeover the attacker already has what the bank asks for: the password, the one-time code or even the open session. That is why controls that only check credentials miss it. What the attacker cannot copy is the legitimate customer's context: where they operate from, with which device and how.

### Phishing and credential theft

The attacker signs in with the password and code they have captured.

- A known customer suddenly uses a device that others have already used.
- A country or device never seen before, and impossible travel between two operations.

### Vishing and authorized push payment fraud

The customer is talked into operating themselves over the phone.

- A transfer ordered during an ongoing call or with call forwarding active.
- A new device or context, or a remote control app installed.

### SIM swapping

The customer's SIM is duplicated to receive their codes.

- A change of carrier or SIM country that does not match the radio signature of the place.
- Virtual eSIM activated just before operating.

### Malware and remote control

The customer is signed in and someone else drives the session.

- Known malicious apps or a debugger attached to the app.
- Modified system: root, jailbreak, or emulator.

## Where it is evaluated and how it responds.

Sign-up, login, KYC, every transfer and any change to account data or settings are scored. Account takeover has its own score, separate from the other fraud families, and comes explained in one sentence.

1. **Gather**: The SDK reads the device environment at the moment of operation: GPS position, network, carrier, model and system, language, and app status.
2. **Understand**: The engine contrasts GPS position with the radio signature and IP, and puts it alongside the customer's history: how many times they have operated, from where, with which device, and which network.
3. **Intercept**: Your system decides with the score: let it through, ask for another factor or hold it. The customer who operates from where they always do notices nothing.

## It integrates into your app and your decision engine.

1. **Datasource SDK in your app**: Library for iOS, Android and JavaScript. It reads the signals when the customer operates, with no new screens.
2. **Fraud Detection API from your backend**: With the operation identifier you request the report over HTTP, or receive it via webhook or WebSocket as soon as it's ready.
3. **Your engine decides**: The account takeover score goes into the BPM, SIEM or case manager you already use, with the rules you already have.

[Real case: how Abanca stops money mules and SIM swaps from their app](https://www.ironchip.com/en/customers/abanca)

## Account takeover FAQ

### What is account takeover?

It is when someone other than the customer takes control of the customer's account. The attacker operates with the customer's session, with stolen credentials, or by convincing the customer to carry out the operation themselves, for example a transfer or adding a new payee.

### Why doesn't an SMS code prevent account takeover?

Because the attacker can get the code: they ask the customer for it over the phone, receive it with a duplicate SIM, or capture it with a phishing site that relays the session in real time. The code proves that someone has it, not who is operating or from where.

### How does Ironchip detect an account takeover?

By comparing each operation with the customer's usual context: their places, their device, their network and their usual way of operating. A device or a country never seen before, impossible travel, a SIM that does not match the radio signature of the place, or a transfer during a phone call raise the account takeover score.

### Does it add steps or friction to the end customer?

No. The SDK reads signals in the background while the customer operates, without new screens. Only risky operations receive an additional factor or are held; the rest proceeds as always.

### How does it integrate with our decision engine?

The Datasource SDK integrates into the iOS, Android or web app, and your backend requests the report for each operation from the Fraud Detection API via HTTP, or receives it via webhook or WebSocket. The score and fraud type enter your current rules.

## Let's analyze your account takeover cases with real data.

A specialist reviews your scenarios before the call and we show you the platform using your own operations.

[Talk to an expert](https://www.ironchip.com/en/talk-sales?producto=Location-Based%20AntiFraud#hs-demo-form) [See the fraud platform](https://www.ironchip.com/en/fraud-platform)