How E-Commerce Stores Can Prevent Account Takeovers

Think about what sits inside the average online shopping account.

A customer's name and home address are the obvious things. There might also be saved cards, previous orders, store credit, loyalty points and gift card balances. Add the ability to place an order without entering all that information again and it's easy to see why somebody else might want access.

For retailers, that's the awkward thing about account takeover. Many of the features that make shopping easier for customers also make a compromised account more useful.

And an attacker doesn't necessarily have to “hack” the retailer to get in.

Passwords stolen elsewhere can be surprisingly effective because people reuse them. Phishing gives criminals another route, as does malware designed to steal login information or active sessions.

So the login page is important, but it isn't the whole story which is why an Ato protection software can be key for safety.

1 - A correct password doesn't prove very much

If somebody enters the right email address and password, it's tempting to assume the security check has worked.

Sometimes that's exactly what the attacker is relying on.

Retailers need to look at a little more context. Is this a recognised device? Have there been numerous failed attempts beforehand? Is the location unusual? Has the same source just attempted to access dozens of unrelated customer accounts?

None of those things proves fraud on its own.

Someone logging in from Spain when they normally shop from Birmingham might simply be on holiday. Block every unusual login and you'll end up annoying plenty of perfectly genuine customers.

It's the combination of signals that's useful.

Where the risk looks higher, that's the moment to ask for something extra. Multi-factor authentication, email verification or another challenge can provide an additional check without putting every shopper through it.

2 - Don't forget the password reset button

Protecting the login is only useful if an attacker can't simply take another route into the account.

Account recovery deserves the same attention. If resetting a password relies on information that's easy to discover or an email account that's already been compromised, strong login security can quickly be undermined.

Retailers should pay attention to unusual recovery attempts, particularly when they're combined with other changes. A password reset from a new device followed immediately by a new delivery address, for example, carries a different level of risk from a customer simply forgetting their password.

It's also worth reviewing old recovery processes. Security questions based on information such as a date of birth, pet's name or family details aren't particularly reassuring when so much personal information can be found online.

Recovery should help genuine customers regain access without becoming the easiest way in for everybody else.

3 - Getting in is only half the job

Say the login looks normal and the customer gets through.

What happens next?

A fraudster might immediately change the email address attached to the account. Perhaps a new delivery address appears, followed by a password change and an expensive order.

Individually, all of those things happen legitimately every day. Put them together within five minutes and they're worth another look.

This is why account takeover prevention shouldn't end at authentication. What somebody does inside an account can reveal just as much as the way they entered it.

Retailers can also make certain changes harder to hide. Send an alert to the existing email address when a password, phone number or delivery information changes. If a customer didn't make the change, you've given them a chance to act.

4 - Then there are the bots

Trying stolen passwords manually isn't terribly efficient.

Trying thousands of them automatically is.

Credential stuffing attacks use bots to test stolen username and password combinations against other websites. Even if only a small percentage work, scale can make the exercise worthwhile.

E-commerce sites therefore need to watch the login page for automation as well as individual suspicious users.

Rate limits can stop repeated attempts getting out of hand. Bot detection can look for automated behaviour that's less obvious than simply hammering the same login form from one IP address.

The better bots, after all, are specifically designed not to look like bots.

5 - Make suspicious activity difficult to complete

Detecting a possible account takeover is useful. What happens next matters just as much.

Retailers don't always need to lock an account immediately. Depending on the level of risk, they could temporarily prevent sensitive changes, request additional verification or hold a high-value order for review.

Speed matters here.

If an attacker gets into an account and can instantly change the email address, password and delivery details, the genuine customer can quickly find themselves locked out.

Businesses should therefore decide in advance which account actions deserve additional protection and what should happen when several warning signs appear together.

The aim isn't to stop customers changing their own details. It's to create a small window in which suspicious activity can be checked before an attacker turns access to an account into an actual loss.

6 - Don't secure the shop so well nobody wants to use it

This is where retailers have to be careful.

You could demand multiple security checks every time somebody logs in. You could challenge unfamiliar devices, force constant password changes and make customers verify every little account update.

You'd probably stop some fraud.

You'd also create an absolutely miserable checkout experience.

The better approach is to make security proportionate to risk. A familiar customer logging in normally and buying a £20 T-shirt shouldn't necessarily have the same experience as an unfamiliar device changing account details before placing a £2,000 order.

Account takeover prevention works best when several relatively small protections work together: safer authentication, compromised credential monitoring, bot detection, alerts and checks on unusual account behaviour.

No-one needs to make shopping difficult.

In fact, that's probably the best test of the whole setup. A genuine customer should barely notice most of it.

The person trying to steal their account should notice quite a lot.