Account Takeover Fraud: How One Scheme Took $1.6 Million

This summer, federal prosecutors in NewYork charged three people with running an account takeover scheme that allegedly took more than $1.6 million from dozens of bank customers over roughly two years. What caught my attention wasn't the size of the loss. It was how ordinary the method was.

‍

According to the complaint, members of the group called the bank and gave a customer's name, personal details and debit card number. They then asked for a card to be mailed to an address they could reach, and once the cards arrived, they used them at ATMs. At other times, one of them called or walked into a branch posing as the account holder and asked for a wire transfer or a withdrawal to another account. Prosecutors say the customer information came from a former bank employee. As with any criminal case, these are allegations until proven in court.

‍

There was no malware involved, and no deepfake. The people on the other end of those calls simply knew the answers to every question the bank asked.

Why didn't the bank's security questions stop it?

Each of those requests got through because the bank's verification was built around information. The agent asked for a name, a date of birth, the last four digits of a Social Security number, card number and possibly a PIN — and the callers had all of it. From an agent's point of view, someone holding complete and accurate customer data looks exactly like the customer. Agents are trained to help callers who answer correctly, and that is what they did.

‍

Where the data came from matters less than you might think. It could come from an insider, a breach or a phishing page. Once it's out, any control that depends on someone knowing it stops protecting the account. And call centers are a growing target. TransUnion's most recent fraud trends report found that high-risk calls reached 6.8% of U.S. contact center traffic in 2025. That was a 13% increase over the prior year and the fourth consecutive year of growth.

‍

It's also worth noticing that this group didn't stay in one channel. They used the phone when the phone worked and the branch when the branch worked. That's the pattern I see across the industry. When one door gets harder to open, attackers try the next one.

How can call centers prevent account takeover?

Several times in this scheme, the bank was about to do something consequential and hard to reverse. It sent cards to new addresses, moved money to outside accounts, and handed over cash at the teller line. Each of those moments was an opportunity to ask for proof of identity rather than proof of knowledge.

‍

That proof doesn't require bringing the customer into a branch. During a call, an agent can text a secure link that asks the caller to scan their driver's license and confirm they match the photo before any change goes through. Intellicheck authenticates the hidden security layer that each issuing DMV builds into the license barcode. That layer isn't public, and stolen data can't reproduce it. The real customer scans their own license on their phone and is verified in seconds. A fraudster who only has stolen information doesn't have the customer's real license, and a counterfeit one fails because it doesn’t have that hidden layer. The same check works in the branch and in a digital account recovery flow, so the standard doesn't change depending on which door an attacker tries.

‍

No single control stops every scheme, but the requests that turned stolen information into stolen money all ran through moments where identity could have been verified rather than assumed.

Where else is account takeover risk hiding?

The New York case involves one group and one bank, but the gap it exposed is common. The question for every institution is whether it verifies identity at the points attackers actually target, such as card reissues, address changes, wire requests and password resets — or only when an account is first opened. Our new executive brief shows where account takeover exposure most often hides, and what to prioritize first.

‍

[Get the brief]