Account takeover

Account takeover prevention training for the login that looks normal.

Attackers often log in rather than break in. A stolen or reused password, a fake sign-in page, or a flood of approval prompts can give them access that looks like a normal session.

Protect my team Browse the modules
Self-paced modules you buy once. Instant access after purchase.
sign-in alert
AlertNew sign-in attempt
DeviceUnknown Windows PC
A verification code was requested. You did not start this.
Denied the prompt and reported it
Illustrative example
how it works
How it works

What account takeover is and how it happens

Account takeover is when an attacker gains control of someone else's account, such as email, a cloud app, or a banking portal. Common routes include stolen or reused passwords, fake login pages that capture credentials, and tricking the user into approving a sign-in.

It is hard to notice because the attacker uses real credentials. They may read email quietly, set up forwarding rules, and send requests that appear to come from a trusted colleague. Strong passwords, MFA, and a habit of reporting unexpected prompts reduce the chance of success.

warning signs
Warning signs

Account takeover warning signs

Some of these signs show an attempt in progress and some show a takeover that has already happened. Treat any of them as a reason to act.

  • Verification prompts you did not startUnexpected MFA approvals or codes can mean someone has your password.
  • Password reset messages you did not requestSomeone may be testing access to the account.
  • Sign-in alerts from unfamiliar devices or placesA new device or location that you do not recognize.
  • Messages sent that you did not writeColleagues or contacts receive odd messages from your account.
  • Inbox rules or forwarding you did not set upHidden rules can quietly copy or redirect your email.
in the moment
In the moment

What to do if an account may be taken over

Act on the account first, then tell the people who can check what else is affected.

  1. Deny unexpected promptsDo not approve a sign-in you did not start, even if the prompts keep coming.
  2. Change the password from a trusted devicePick a new, unique passphrase and change reused passwords elsewhere.
  3. Sign out other sessionsRemove devices and sessions you do not recognize.
  4. Review recovery and forwarding settingsCheck recovery contacts and mailbox rules for changes.
  5. Report it quicklyTell IT or security so they can check related accounts and warn others.
The training

Account takeover prevention training that covers the real attacks

These AwarenessCORE modules are self-paced and each ends with a graded assessment.

Passwords and Multi-Factor AuthenticationCovers MFA in depth, including the specific attacks against each type, and what to do when credentials fail.How passwords break, building and managing credentials, multi-factor authentication in depth, and what to do when credentials fail.View module and price ›Phishing AwarenessCovers attacks that arrive as fake MFA prompts, and how to verify, report, and recover.The psychology attackers use, reading an email like an attacker, attacks that arrive by text, phone, QR code, and fake MFA prompts, targeted fraud such as business email compromise, and how to verify, report, and recover.View module and price ›

Browse all modules and prices

Questions teams ask

Questions about account takeover prevention training

What is account takeover?

Account takeover is when an attacker gains control of a legitimate account by using stolen or guessed credentials, tricking the user, or both. The attacker can then act as that user.

How do attackers take over accounts?

Common methods include credential stuffing with passwords leaked elsewhere, phishing for logins, and pressuring users to approve MFA prompts. Reused passwords and accounts without MFA are easier targets.

What is MFA fatigue?

MFA fatigue, or prompt bombing, is when an attacker who has a password sends repeated approval requests, hoping the user will approve one to make them stop. The safe response is to deny every prompt you did not start and report it.

How can employees tell an account may be compromised?

Warning signs include unexpected verification prompts, password reset messages, alerts from unknown devices, messages you did not send, and mailbox rules you did not create. Report any of these quickly.

Does MFA prevent account takeover?

MFA raises the bar considerably but is not a guarantee, because some methods can be bypassed or phished. Stronger methods, unique passwords, and awareness of prompt attacks work together.

Know the signs

Know the signs beyond account takeover

A quick reference: the first warning sign from each of the ten threat pages. Each chip opens the full list and what to do.

PhishingThe sender and the address do not matchCEO fraudA request to pay, transfer, or buy gift cardsFake invoice scamsChanged bank detailsSmishingA message from a number you do not knowSocial engineeringA caller who creates urgencyRansomwareAn unexpected attachment or downloadInsider threatsData shared more widely than neededPassword securityThe same password in many placesWire fraudNew or changed payment instructionsAccount takeoverVerification prompts you did not start

Lock down accounts across your team

Tell us your team size and we will suggest which modules fit. A real person replies, usually within one business day.

  • A real person, not a bot, within one business day
  • Straight answer on cost and what fits your team size
  • No pressure to buy

Get a callback

Tell us about your team and we will follow up.
Rather move now? Browse the modules ›

Got it. We will be in touch.

Someone from AwarenessCORE will reach out within one business day.

What every module includes

  • A graded knowledge check with a pass mark
  • A completion certificate when you pass
  • Access that does not expire
  • One payment per module, no subscription

Built by TheBRHub, an IT and email security company in Carlsbad, California.

Train your team to protect accountsGet started

Before you go

Not ready to fill out the form? Leave your email and we will send you the details. No pressure.

Thanks. We will be in touch.
Or browse the modules ›