---
title: What is Account Takeover (ATO) and how does it happen?
description: Learn how account takeover (ATO) happens through credential stuffing, SIM swapping, and password reuse—and how to secure your account.
---

[Skip to content](https://help.panaceafinancial.com/what-is-account-takeover-ato-and-how-does-it-happen#main-content)

English

Show submenu for translations

[Contact Us](https://help.panaceafinancial.com/kb-tickets/new?hsLang=en)

[![Logo-150](https://help.panaceafinancial.com/hs-fs/hubfs/Logo-150.png?width=180&height=54&name=Logo-150.png)](https://panaceafinancial.com/)

Open main navigation

Close main navigation

- English
  
  Show submenu for translations
- [Contact Us](https://help.panaceafinancial.com/kb-tickets/new)

 How can we help?

- There are no suggestions because the search field is empty.

1. [Help Site](https://help.panaceafinancial.com/?hsLang=en)
2. [Account Security](https://help.panaceafinancial.com/account-security?hsLang=en)

# What is Account Takeover (ATO) and how does it happen?

## Account takeover (ATO) occurs when a fraudster gains access to your online banking account and makes unauthorized transactions. Understanding how it happens can help you prevent it.

### **How does account takeover happen?**

**1. Credential stuffing:** scammers use stolen usernames and passwords from other data breaches to try logging into bank accounts. If you reuse passwords across sites, your account may be at risk.

**2. SIM swapping:** fraudsters trick mobile carriers into transferring your phone number to a new SIM card. This allows them to receive your verification codes and reset account passwords. 

**3. Password reuse:** using the same password across multiple accounts increases risk. If one site is compromised, scammers may try those same credentials elsewhere. 

**4.** **Phishing/Smishing/Vishing:** An unsolicited email, text, or phone call where a scammer will send an email or text with a link to trick the victim into giving away their login credentials. These links will usually take you to a phishing website that appears as a legitimate online banking or payroll website to trick you into giving away their login credentials.

**5. Malware:**  A cybercriminal obtains victim's login credentials via malware on the victim’s device. Usually installed via clicking on a phishing email.

### **How to secure your account:**

- Use [**strong unique passwords**](https://help.panaceafinancial.com/what-are-best-practices-for-strong-passwords?hsLang=en) for every account.
- Enable [**multi-factor authentication (MFA)**](https://help.panaceafinancial.com/what-is-two-factor-authentication-2fa?hsLang=en).
- Never share verification codes.
- Monitor your account regularly for unusual activity.

***Important:** Panacea will never ask for your password, PIN, or one-time verification codes. If someone requests this information, it is a scam.* 

### **What to do if you suspect ATO:**

- Change your password immediately.
- Review recent transactions.
- [**Contact our support team**](https://help.panaceafinancial.com/how-do-i-contact-support?hsLang=en) right away.

- [Getting Started](https://help.panaceafinancial.com/getting-started?hsLang=en)
- [Account Security](https://help.panaceafinancial.com/account-security?hsLang=en)
- [Accounts and Transactions](https://help.panaceafinancial.com/accounts-and-transactions?hsLang=en)
- [Transfers and Payments](https://help.panaceafinancial.com/transfers-and-payments?hsLang=en)
- [Customer Support](https://help.panaceafinancial.com/customer-support?hsLang=en)
- [Self-Service](https://help.panaceafinancial.com/self-service?hsLang=en)

[![Logo-150](https://help.panaceafinancial.com/hs-fs/hubfs/Logo-150.png?width=180&height=54&name=Logo-150.png "Logo-150")](http://panaceafinancial.com)

Panacea Financial Holdings partners with Primis Bank, Member FDIC, to deliver banking services through its Panacea Financial Division.

Copyright © 2025, Panacea Financial