How to Prevent Account Takeover: Controls That Actually Work
Preventing account takeover means making a stolen password worthless on its own. The controls that do it, stacked: phishing-resistant MFA (passkeys and security keys beat app codes, which beat SMS), breached-password screening and rate limiting against credential stuffing, conditional access that evaluates every sign-in's context, session protections against token theft, and detection over the signals a takeover produces, impossible travel, new inbox rules, unusual OAuth grants. Prevention honestly includes response: sessions revoked and persistence removed in minutes, because takeovers are worked fast.
Account takeover (ATO) is what happens when an attacker gets working access to a legitimate account, through phished credentials, passwords reused from another breach, malware, or simply guessing. It is the entry point behind most business email compromise and a large share of cloud intrusions, and preventing it is less about one silver bullet than about stacking controls so that a stolen password alone is worthless.
1. Make the password insufficient
Multi-factor authentication is the single highest-value control, and its strength varies by type. SMS codes beat nothing; authenticator apps beat SMS; phishing-resistant methods, passkeys and FIDO2 security keys, beat everything, because there is no code for an attacker to proxy or a user to type into a fake page. Roll out phishing-resistant MFA to administrators and finance first, then everyone. Watch for MFA fatigue attacks against push notifications: number matching and limiting prompt frequency blunt them.
2. Stop credential stuffing at the door
Attackers replay billions of leaked credentials against every login page on the internet. Defenses that work: screening new and changed passwords against known-breach lists, rate limiting and bot detection on authentication endpoints, and banning the passwords everyone picks. If your identity provider supports breached-credential detection, turn it on; it quietly retires the most dangerous passwords in the fleet.
3. Make context part of the login decision
Conditional access policies evaluate every sign-in against context: device health, location, impossible travel, sign-in risk. A correct password from an anomalous context can be challenged, restricted, or blocked outright. This is where takeover attempts with valid credentials actually die, and it is included in identity platforms most organizations already license.
4. Protect the session, not just the login
Modern attacks increasingly steal session tokens rather than passwords, via adversary-in-the-middle phishing kits or infostealer malware. Mitigations: shorter session lifetimes for sensitive apps, token binding and continuous access evaluation where the platform offers them, and endpoint protection that catches the stealers, because a stolen cookie bypasses every login control you built.
Detection with the watching included
SubRosa's Managed SOC runs 24/7 detection and response across Microsoft 365, Entra ID, Defender, and your endpoints, with analysts triaging every alert.
Explore the Managed SOC5. Detect what prevention misses
No prevention stack is airtight, so detection is part of prevention done honestly. The signals that matter: impossible-travel and anomalous sign-ins, new inbox rules that forward or delete mail (the classic BEC move), unusual OAuth grants, MFA method changes, and dormant accounts waking up. Those detections need someone watching them around the clock, because takeovers are worked in minutes, not business days; that is the gap SubRosa's Managed SOC closes across Microsoft 365, Entra ID, and Defender telemetry.
6. Shrink the blast radius before it happens
Least privilege limits what any taken-over account can reach. Separate admin accounts from daily-driver accounts, remove standing privileged access in favor of just-in-time elevation, and review third-party app grants quarterly. Pair it with an offboarding process that actually disables accounts on day zero, and with awareness training so users recognize the consent-phishing and MFA-fatigue plays aimed at them.
If an account is taken over anyway
Move in this order: revoke all active sessions, reset the credential, remove attacker persistence (inbox rules, OAuth grants, registered MFA devices you did not add), then scope what the account touched while compromised. Mailbox access means checking what was read and forwarded; admin access means treating it as an incident, not a password reset. Our incident response steps guide covers the full sequence.
Frequently asked questions
What is account takeover?
An attacker gaining working control of a legitimate account via phished or reused credentials, malware, or session theft, then using it for fraud, data theft, or as a beachhead. Business email compromise, one of the costliest cybercrimes, is account takeover applied to mailboxes.
What is the single best defense against account takeover?
Phishing-resistant multi-factor authentication, passkeys or FIDO2 security keys, because it removes the secret a user can be tricked into surrendering. Any MFA beats none, but modern phishing kits proxy one-time codes in real time; phishing-resistant methods are the tier that ends that game.
How do attackers take over accounts despite MFA?
Four main paths: real-time phishing proxies that relay one-time codes, MFA-fatigue push bombing, session token theft via infostealer malware or adversary-in-the-middle kits, and helpdesk social engineering to reset credentials. Defenses: phishing-resistant methods, number matching, session protections and EDR, and hardened reset procedures.
What are the warning signs of a taken-over account?
Sign-ins from impossible locations or new devices, new mailbox rules that forward or delete, unusual OAuth application grants, MFA method changes the user did not make, password-reset storms, and dormant accounts turning active. These signals are only useful if something, or someone, watches for them continuously.
What should we do the moment a takeover is confirmed?
Revoke every active session first (a password change alone leaves live sessions working), reset credentials, remove persistence, inbox rules, OAuth grants, attacker-registered MFA devices, then scope the damage: what was read, sent, forwarded, or accessed while compromised. Mailbox takeovers deserve incident treatment, not just a reset.