Skip to main content

​
What is account takeover?

Account Takeovers happen when a malicious actor breaks into a victim’s online account. In the crypto and fintech world, this is generally with the purpose of:
  • draining the funds in the account,
  • obtaining a credit line in the name of the victim,
  • moving funds through the account to obfuscate the flow of funds in order to circumvent money laundering controls,
  • place market manipulative trades, such as spoofing or wash trading, in the case of crypto exchanges.
Malicious actors use a variety of methods to gain access to the online credentials of the victim, including: phishing, credential stuffing, malwares, keyloggers, SIM-card swapping attacks to obtain SMS-based two factor authentication codes, and social engineering customer support agents. Fraudsters then take steps to conceal their activity in the account. They do so by changing details on the account such as the address and the phone number to prevent the proper account owner from getting notifications of money movement, or spoof their device operating system and IP address to avoid being detected. The best way to stop account takeovers in its tracks is to closely monitor account logins or risk account updates such as changes to email, password, or phone number, and check for anomalies in the device, IP, or network traffic characteristics of the activity. Changes in the type of device or IP address used or behavioral characteristics of the session, such as swiping and typing speed all might indicate a suspicious login. Since fraudsters will want to drain funds in an account as quickly as possible after gaining access to the account to maximize their profit, checking for sudden changes in the transaction pattern - i.e. money movement - is also a great tool to ascertain risk of unauthorized activity. For example, withdrawal requests that come in quicker succession or in greater amounts compared to the standard baseline activity on the account can indicate presence of malicious actors.

​
How can Sardine help?

Sardine’s Risk Solution combines three powerful tools to detect account takeovers in a single platform:

​
1. Device Intelligence

Our proprietary device intelligence product is an embedded SDK that collects and analyzes hundreds of signals, and compares them to known risky behavior to detect suspicious activity. Some of these include:
  • presence of operating system emulators,
  • rooted devices,
  • proxy and VPN detection, and
  • remote desktop control software.

​
2. Behavioral Biometrics

We collect and analyze behavioral signals such as anomalous copy-paste behavior, toggling between windows (distraction events), and mouse movement.

​
3. Anomaly detection

Our no-code rule engine can be used to alert when anomalous transaction behavior, such as uncharacteristic movement of funds, occurs. Since the definition of anomalous behavior is different for each platform, our rule engine offers a flexible way to adjust monitoring and catch complex typologies with great granularity.

​
Next Steps

Contact us to schedule a demo and get access to our Integration Guides and API docs.