Account takeover prevention

These four strategies can help your team prevent account takeover fraud.

Build a culture of skepticism

Train employees—particularly those authorized to move funds—to question any unsolicited contact, regardless of how familiar or urgent the message seems.

“Unsolicited outreach is the common denominator in fraud attacks,” Geronimo said. “It can appear as if it’s from an institution you trust, which gives a sense of comfort. It often creates alarm or a sense of urgency. That’s the start of social engineering.”  

Distinguishing authentic messages from fraudulent ones can be challenging. Train employees to check emails, texts and URLs for signs of spoofing before sharing information. Better yet: don’t rely on inbound messages or links sent by text or email. Instead, call back using a verified phone number or go directly to your bank’s website.

Know what your bank will and won’t ask for

To recognize a fraudster impersonating your bank, employees need to know how your bank typically communicates and verifies your identity.

When a J.P. Morgan employee contacts you or a member of your team, they will never ask for your full account number, password or full token code. They also won’t ask you to click a link and enter your credentials.

Another red flag: a call or message from a purported bank employee alerting you to fraud rather than verifying a transaction.

“We call to validate account activity, we don’t come from the position that it’s fraud,” Geronimo said. “There’s not that sense of urgency—‘This is bad, now to help, you need to do this.’”

Regular training helps employees instinctively spot suspicious requests, even while multitasking or at the end of a long day.

Use the strongest available authentication method

Strong authentication technology—ideally passkeys—keeps fraudsters from taking over your account with a phished or stolen password alone.

Options include:

• Multifactor authentication (MFA) with a one-time passcode (OTP) requires a time-sensitive code—often delivered via email or text—in addition to a password. “MFA and OTP are table stakes,” Geronimo said. If a fraudster tricks an employee into revealing a password or obtains one in a data breach, they won’t gain access without the passcode. But codes can be intercepted or obtained through social engineering.
• Tokens combine passwords with time-sensitive codes generated on a physical security key or authenticator app you own. Unlike passcodes delivered via text or email, token codes can’t be intercepted in transit. But a fraudster can still manipulate an employee into sharing a token code.  
• Passkeys eliminate passwords altogether, which makes them resistant to phishing. When you use a passkey to protect an account, your device generates a pair of keys: a private key stored securely on that device and a public key shared with the website or application hosting the account. To log in, you confirm your identity on your device, often using a face scan or fingerprint. Your device then proves it has the private key—without ever sharing the key itself. Passkeys only work with the specific platform they were created for, so a fake site can’t trick your device into sharing its private key. You can also sync passkeys to the cloud for use across multiple devices.

If passkeys, tokens or OTP aren’t an option, a password manager can strengthen your defenses.

“It allows you to have a unique password for every application, so if a password is compromised, it will only affect that application,” Geronimo said. “And if you come across SEO poisoning or a spoofed site, a password manager will recognize it’s not authentic.”