Consumer accounts and business accounts differ
Account takeover fraud happens when someone gains control of a bank, payment, email, or brokerage account, often through a stolen password, a SIM swap that hijacks your phone number, or a fake login page. For personal accounts, federal rules on unauthorized electronic transfers generally protect consumers, and how quickly you report can affect how much of the loss you may have to bear. Business accounts are not covered by those consumer rules; disputes there usually turn on the account agreement and commercial law on funds transfers, including whether the bank followed the security procedures it agreed to. That difference shapes the whole response, so identify first which kind of account was hit.
Securing the account without destroying evidence
Report the takeover to the bank or platform immediately and confirm it in writing. Regain control through the provider's official recovery process, change passwords from a clean device, and contact your mobile carrier if your number may have been moved. Do not keep a compromised account open to watch what the intruder does, and do not wipe or power off a device you suspect was compromised; disconnect it from the network and leave it as it is until you get advice. Take screenshots of alerts, login notifications, and changed settings, and download whatever account activity logs are available. If your email was taken over, check for forwarding rules the intruder may have added.
After the immediate response
Once the account is secured, the questions become who bears the loss and whether anyone else needs to be told. In a first meeting we review the bank's response, the account type and agreement, and the timeline of your reports. For businesses, we also look at whether customer or employee data was exposed, since breach notification duties can start running before an investigation is finished, and whether an insurance policy may respond. Reports to the FBI's Internet Crime Complaint Center and the FTC help build a record. With that in hand, we choose whether a formal dispute, a demand on the bank, or a regulator complaint is the right next step.
