Account takeovers on cryptocurrency exchanges are increasing as more individuals are beginning to invest in digital currencies. Account takeovers can also occur with banks, investment firms, retail websites, social media and on other online accounts. Account owners should be aware when they are being targeted by a scammer for an account takeover.

What Is an Account Takeover?
An account takeover occurs when someone other than the owner of an account takes over an account. Scammers will often use phishing techniques pretending to be someone from the victim’s financial institution, cryptocurrency exchange or another company to gain access to the target victim’s account. Once a scammer has been given access to a financial or cryptocurrency account, the scammer is able to transfer money in the account to an account the scammer controls within a matter of seconds. Cryptocurrency crimes have become a favorite of scammers for account takeovers and hacking because transactions on the blockchain cannot be reversed once the transaction has been recorded on the blockchain ledger.

Combat Takeovers With Two-Factor Authentication
In the past few years, companies have begun using two-factor authentication, or 2FA, to combat account takeovers. Two-factor authentication is used to confirm ownership of an account. Two-factor authentication is based on “something you know” and “something you have.” Debit and credit card PINs, passphrases and passcodes are examples of something you know. Your phone or the physical credit card are something you have. Additionally, “something you are” is another method of authentication using your fingerprints and voice.

Companies will either send an email or a text to the account holder with an authentication code that the account holder must enter to access their account. Companies can also ask an account owner to enter an authentication code from an authentication app like Google Authentication to verify account ownership. However, scammers are committed to finding a way around two-factor authentication by using methods such as SIM swapping and contacting the account owner using phishing techniques in an attempt to get the account holder to give them access to the target victim’s account.

Getting Around 2FA
SIM swapping is gaining access to the account owner’s mobile phone by getting a wireless phone company to issue a new SIM card to the scammer who is pretending to be the wireless customer. If the scammer is successful in getting the wireless phone company to send them the SIM card, the scammer hopes to gain access to the victim’s account by getting the authentication code sent to the victim’s mobile phone by text, which is now going to a phone controlled by the scammer.

Scammers will also contact the targeted victim to request the account owner’s login and password information along with the authentication code the potential victim will receive by text, email or the authentication mobile app. The scammer, pretending to represent the victim’s financial institution, retailer or crypto exchange, will attempt to gain access to the victim’s account by telling the potential victim there is or has been unusual activity occurring on the account and they (the scammer) need access to the victim’s account.

Preventing Account Takeovers
It’s important to know that financial institutions, crypto exchanges, retailers and other companies will not contact account holders by phone, text or email requesting login information, passwords or authentication codes. If you receive a phone call from someone pretending to be your financial institution or crypto exchange, or another company, take the person’s name and contact information including their email address. Most scammers will not give out their email address since the scammer’s email address will not match the email address of the company they are pretending to be calling from.

For online accounts, you should never use the same login and password across platforms since scammers will often use the password and user login formation on different websites they’ve obtained from data breaches.

You should use two-factor authentication to protect all your online accounts. Account holders who are victims of account takeover should be aware that financial institutions may not put money back into the account if the account owner has given someone access to their account. Since cryptocurrency is mostly unregulated, crypto exchanges and platforms are under no obligation to put stolen cryptocurrency back into the owner’s wallets (crypto account).

If you have been a victim of an account takeover, contact your financial institution, cryptocurrency exchange, social media site or retailer, and file a report with law enforcement.