Account takeover fraud statistics, and the one number your program can actually move
Most security metrics tell you how your controls performed. Account takeover statistics don’t. They tell you how somebody else’s customers fared against somebody else’s attackers, and then they get pasted onto a board slide as though they described your company.
Measure account takeover anyway. Four published figures are plenty for any program review, and what makes them useful is where they point rather than how big they are. All four point at the same place, and it’s the place most teams go quiet when a board member asks: how long the page stealing your customers’ logins stayed up after somebody found it.
What an account takeover statistic is actually counting
Account takeover is a criminal signing in as your customer with credentials that work. Nothing gets exploited, nothing breaks, and no alert fires on a vulnerability, because there wasn’t one. From the inside, it looks like the customer arriving on a Tuesday.
A breach is your systems being entered. An account takeover is your front door being used correctly by the wrong person. One lands in incident response and the other lands in customer support, so different people count them differently.
The FBI’s Internet Crime Complaint Center recorded approximately 4,700 account takeover complaints and $359.7 million in losses for 2025 in its 2025 Internet Crime Report. Read that as a floor, not a total. Account takeover rarely gets filed under its own name once the money has moved through some other mechanism, and the same report puts business email compromise at 24,768 complaints and $3.05 billion. Business email compromise is account takeover of a mailbox with a payment attached.
So the scatter in the published figures isn’t a data quality problem. It’s a reporting boundary, and it runs straight through the middle of an account takeover. The half inside your systems gets counted one way. The half outside them, which is where Bolster AI works, mostly isn’t counted at all.
How an account takeover is actually assembled
The credentials arrive from somewhere else
Most of the logins used against you were never typed into your site. They came off a laptop you don’t manage, copied by infostealer malware that lifts saved passwords and the cookies that keep a browser signed in, or out of a breach somewhere your customer reused a password.
The volume is steadier than most teams assume. Verizon’s 2026 Data Breach Investigations Report puts small organizations at a median of seven credential leak events over the year and larger ones at around 20. Exposure is a rate, not an event, which means it can be trended.
The fresh ones get typed into a page built to look like yours
Old credentials go stale, so fresh ones come from pages that imitate your login screen. There are a lot of those. Interisle Consulting Group counted 1,542,922 phishing domains in the year to April 2025 in Phishing Landscape 2025, and found that 77% of them were registered specifically to commit the crime rather than being legitimate sites somebody had hijacked.
That share matters, because a domain registered to imitate you exists before the first customer types anything into it.
Somebody has to be sent there
A convincing fake login page earns nothing in a browser nobody opened. Victims arrive through search ads bought to imitate a real company’s ads, through texts, and through support numbers that route to a criminal. Pretending to be a company pays well at that scale. The Federal Trade Commission says people reported losing $3.5 billion to imposter scams in 2025, with nearly $1 billion of that going to business impersonators, and bank impersonators drawing the highest reported losses inside that group.
Why your own login data can’t see any of it
Every stage above happens on infrastructure that belongs to somebody else. The laptop isn’t yours. The domain sits with a registrar you have no account at, on a host that has never heard of you. The ad runs on a platform where your only standing is as another advertiser.
Your tooling, meanwhile, records what your own systems did. It logs a successful sign-in, because that is what it was. It logs a completed password reset, an approved prompt, a support agent releasing an account to a caller who answered every question correctly. What it can’t log is the thing that made all of those succeed, which was a lookalike domain collecting passwords for as long as it stayed up.
So your report reads clean while the attack is working. That distance between what you can record and what actually decided the outcome is the gap, and it’s the gap Bolster AI was built to close. Every lever that ends one of these attacks sits on the far side of it, and none of those levers are yours.
What an account takeover program has to cover outside the login box
A program that covers the outside half measures five things. Each is a standard worth holding a vendor to, Bolster AI included, and all five share a bar most tooling quietly fails: the detection has to arrive with enforcement already attached. A finding somebody then has to go and act on by hand is where these programs stall.
1. Exposure tied to your organization, reported as a rate. A dump count is trivia. A searchable feed you have to go fishing in is barely better. The standard is credential and card exposure already matched to your organization and trended month over month, and that’s how Bolster AI runs dark web monitoring: criminal forums and marketplaces, executive personal data, and stolen card data, with every finding tied to you when it arrives.
2. Lookalike infrastructure found at registration, with intent already judged. Coverage means fuzzy matching across brand variations, newly registered domain monitoring, and the public logs that record every new security certificate. Then it means deciding which of those domains is actually hostile. Bolster AI pairs that discovery with intent validation inside domain monitoring, because a list of every string resembling your brand is a workload that buries the one page that matters. A domain bought at 2 am to imitate your sign-in page is detectable hours before it collects anything.
3. The delivery layer, traced back to an advertiser. The page is the weapon and the ad is the aim. Knowing that scam ads exist changes nothing on its own. Platforms act when you can show them which account bought the ads, and Bolster AI traces that through fraudulent ads monitoring, including for cloaked ads that show reviewers something different from what they show your customers.
4. A real route for what your customers tell you. Your customers see the scam before you do. In most companies that arrives in a support queue, where it becomes a ticket and dies as one. Bolster AI’s customer abuse mailbox turns a forwarded scam into a detection with the underlying infrastructure attached. That’s the difference between knowing customers are complaining and knowing what to take down.
5. Time from discovery to removal, on relationships that already exist. Detection with no enforcement attached is a report, and a report doesn’t reduce anybody’s losses. The standard is one workflow where the submission relationships are already in place before your incident starts, which is what automated takedowns run on. Bolster AI publishes a 60-second mean time to response here. That measures how fast Bolster AI acts on a confirmed threat, and a registrar still moves on its own schedule.
Where account takeover measurement breaks down
Authentication logs and the MFA dashboard. They record your actions and never the attacker’s. Because a successful takeover is a successful login, the event that matters arrives labeled as normal. Enrollment percentages describe your coverage, and they say nothing about what happened to your customers.
Transaction fraud analytics. These catch the money moving, which is the last step in the sequence. By the time one fires, the page that harvested the credential has been running for hours, and the login has often been resold already.
Customer education and warning banners. They move some share of customers, and they do nothing at all to the ad or the imitation page, which keep working on everyone who didn’t read the banner.
Filing abuse reports yourself. Every registrar, host, and ad platform has its own form, its own evidence standard, and its own queue, and doing this by hand means nobody owns the follow-up once the report disappears into a portal.
All four share one defect. Each measures or acts on something inside your own systems, while the levers that end the attack sit outside them, and that outside half is what Bolster AI operates on. Closing the distance isn’t a process change your team can make on a Monday, because it runs on standing relationships with the registrars, hosts, and ad platforms that actually switch these things off.
How Bolster AI closes the account takeover gap
Bolster AI detects external threats including phishing sites, lookalike domains, fraudulent social accounts, fake mobile apps, fraudulent ads, and marketplace abuse, connects the related infrastructure into a single campaign, and removes it. Detection and enforcement sit in one platform rather than two, which is what makes the fourth number on that list measurable at all.
Detection and removal run as one workflow. Most tooling stops at the alert and hands you a queue. Bolster AI carries a confirmed phishing and scam site from detection through evidence collection to submission, on direct API partnerships with over 1,500 registries and hosting providers rather than a generic abuse form, and submits it to global blocklists in about 6.5 seconds. Removal itself still lands on a registrar’s schedule. You don’t control the registrar, you control who stands in front of it and how much of the work is already done when the request arrives.
One fake page is rarely one fake page. The same operator usually stands up a set, and taking down the instance leaves the rest collecting. Bolster AI Signals links related infrastructure into a campaign so enforcement covers the set, then keeps watching for the same fingerprints to come back. They usually do, because an operator who has built one convincing sign-in page has every reason to rebuild it from the same template on a new domain next week.
A number you can put in the quarterly report. Bolster AI reports that SoFi cut analyst workload by 20% and shut down an international phishing campaign in 24 hours after moving detection and takedown onto one platform. Those are the two figures a program review can actually use, because both describe work your team either does or stops doing.
What Bolster AI can’t tell you. Bolster AI cannot report your account takeover rate. That number lives in your identity provider and your fraud systems; it depends on how you define a confirmed takeover, and no external platform can produce it honestly. Bolster AI also can’t pull a credential back out of circulation once it’s for sale, because nobody can confirm a copy was deleted. What it can do is tell you the exposure is there and take down the infrastructure built to use it, which is the part your own systems were never going to surface.
The point isn’t that Bolster AI replaces your identity provider, your fraud engine, or your MFA rollout. Those measure the inside, and they should. They go blind at the perimeter, and an account takeover is assembled almost entirely outside it.
Measure the half you can actually move
The published totals will keep disagreeing. Your own four numbers are steadier: exposed credentials matching live users, lookalike domains standing up against your brand, scams your customers report, and the hours between finding a fake page and seeing it gone. The first three tell you what’s happening, and most teams can build them in-house. The fourth is the one that changes the outcome, and you move it by choosing who carries the request to somebody else’s registrar, host, and ad platform.
Finding the page is where most programs already get to. See what happens to one after Bolster AI finds it, and what that clock looks like on your own domains.
TL;DR: Account takeover fraud statistics are worth quoting, but almost all of them describe someone else’s population and someone else’s attackers. The FBI’s Internet Crime Complaint Center counted roughly 4,700 account takeover complaints in 2025, and that figure is a floor rather than a total, because account takeover rarely gets filed under its own name once the money has moved. Four numbers describe your own program instead: how many credentials in circulation match your active users, how much lookalike infrastructure is standing up against your brand, how many scams your customers report, and how long a fake login page keeps collecting after you find it. That last one is the only figure on the list your program can move, and moving it means acting on domains, ads, and hosts you do not own. Bolster AI finds that infrastructure and removes it, which is the half of account takeover your login data was never going to show you.
Frequently asked questions
What is account takeover fraud?
Account takeover fraud is a criminal gaining access to a customer’s account using credentials that work, then using it to move money or harvest information. Nothing is exploited and no system is broken into, which is why it often looks like ordinary activity from the inside. It’s usually the end of a chain that started with stolen credentials and a fake login page.
Which account takeover fraud statistics belong in a board deck?
Use one external figure to set context and three internal ones to describe your program. The FBI’s complaint count works for context as long as you label it a complaint count rather than a loss total. The four that carry weight are exposed credentials matching active users, lookalike domains detected against your brand, scams your customers report, and time from discovery to removal.
Why do account takeover loss estimates vary so widely?
Because they count different populations. A federal complaint count includes only people who knew where to file. A consumer survey extrapolates from a sample. An industry report counts breaches rather than accounts. None is wrong, but setting a complaint count beside a survey estimate as though both were counts is how a board slide loses its credibility.
Does multifactor authentication stop account takeover?
It raises the cost, and it’s worth doing, but it doesn’t close the problem. Criminals socially engineer the one-time code, intercept it through the phone layer, or take over the account through a support or recovery path that never touches the second factor. Enrollment percentage is a coverage metric, not an outcome metric.
Can Bolster AI tell me how many of my accounts were taken over?
No. That number lives in your identity provider and your fraud systems, and it depends on how your team defines a confirmed takeover. Bolster AI measures and acts on the outside half of the problem: the credential exposure in circulation, the domains and ads built to harvest more, and the time it takes to get that infrastructure removed.
How fast does Bolster AI act on a fake login page?
Takedown speed is two numbers, not one, and any vendor should give you both. Bolster AI publishes a 60-second mean time to response, which measures how quickly it acts on a confirmed threat. Removal itself happens on the registrar’s or the host’s schedule, which is why direct API partnerships with over 1,500 registries and hosting providers matter more than any single speed claim.
