Account Takeover (ATO)

Account takeover sits at the intersection of fraud, AML, and customer experience, which is why it gets attention from three different parts of the business at the same time. The attacker may use credential stuffing (testing leaked passwords against the operator), SIM swap to bypass SMS-based 2FA, or social engineering of customer support to change account details. Once inside, they typically change the withdrawal method, drain the balance, or use the account to layer illicit funds in and out. For operators, the cost goes beyond the immediate chargeback or refund. Successful ATO erodes player trust, attracts regulator scrutiny under licensing conditions for customer protection, and can trigger AML reporting obligations if the account was used to move money. Modern defenses combine device fingerprinting, behavioral biometrics, step-up authentication on high-risk actions, and PSP-level signals shared back to the platform. Passkeys and FIDO2 adoption are slowly replacing SMS 2FA in the most mature jurisdictions.