Allstate Identity Protection is proudly compliant with the new California Consumer Privacy Act. View our privacy policy here.

How Account Takeovers Happen and What You Can Do to Protect Yourself


Get more Allstate Identity Protection news

Sending emails to clients and employees. Sharing photos of your kids on Facebook. Tweeting pictures of your breakfast, lunch, and dinner. No matter how you use the internet, you’re at risk of experiencing an account takeover.

Account takeover, commonly referred to as “hijacking,” occurs when an unauthorized user takes control of a victim’s online account. With 15 percent of internet users reporting they have been victims of such attacks, Google launched an investigation to determine how this occurs and what steps they can take to best protect users.  

Let’s take a look at what they found.

The most common ways criminals hijack accounts and compromise privacy   

Together with the University of California, Berkeley, Google researched multiple black markets that trade third-party password breaches and tracked over 25,000 blackhat tools used for phishing and keylogging. You can read the report in its entirety here, but these are a few highlights:

● Google identified 788,000 credentials stolen by keyloggers; 12.4 million phishing kit victims; and 3.3 billion credentials exposed in third-party breaches

● Of the billions of third-party data breaches, 12 percent of the discovered records included a Gmail address    serving as a username and a password

● Attacks are becoming much more sophisticated:

◦ 82 percent of phishing tools attempted to collect a victim’s IP address and physical location

◦ 74 percent of keyloggers tried to obtain a victim’s IP address and physical location

○ 18 percent of blackhat tools collected phone numbers along with the device make and model

● 12 to 25 percent of attacks involving phishing and keyloggers were successfully obtained a valid Google password

● Phishing attacks pose the most significant threat to users, with keyloggers coming in second, and third-party breaches last

● These findings allowed Google to proactively secure 67 million Google accounts before they were compromised

Google takes actions to protect users from hijacking  

To protect the accounts of users worldwide, Google is continually evolving. They refer to this as a “defense in-depth” approach to security, which consists of focusing on three key areas: prevention, detection, and mitigation.

When it comes to prevention, Google’s Safe Browsing feature protects more than 3 billion devices by alerting users before they visit a site identified as dangerous. Google monitors every login attempt to detect suspicious activity and may require additional information before granting access to the account. As part of their mitigation efforts, Google routinely scans activity across all Google products, and if they find any evidence of hijackers, they lock down the account and notify the affected user of corrective steps they can take to remedy the problem.  

Reduce the risk of account takeover and better protect your privacy

No matter how determined Google is to protect users’ accounts from being hijacked, we cannot depend on one company to keep us safe. To protect your accounts, privacy, and identity, it’s imperative you take personal action. 

Here are few ways to improve your online security:

● Make sure the recovery information associated with your accounts, like your phone number, is up to date

● When possible, always use two-factor authentication

● When warned about a dangerous site or malicious link, do not proceed

● Make sure your anti-virus software is up to date and continually scanning for new threats

● If an email seems suspicious, do not click on any links or respond

○ Suspicious emails might include:

▪︎ Numerous grammatical and spelling errors

▪︎ Intimidating language threatening you to take action, even if it comes from a company with whom you’re familiar

▪︎ Limited contact details provided in the signature

▪︎ URL links direct you somewhere other than described

● Verify a site’s security before visiting

● Trust your gut — if something seems off, do not proceed

For the latest news about identity and privacy protection, as well as updates about emerging cyber threats, be sure to subscribe to our blog. Want to learn more about Google’s number one rated threat, phishing? Then be sure to download our complimentary ebook, Phishing for Dollars: How Identity Theft Is Leaving Businesses and Employees on the Hook.

New Call-to-action