Account takeover detection at sign-in — signals that matter

Takeover is a login problem

Account takeover (ATO) rarely looks like a brand-new signup. It looks like a correct password from the wrong place: new device, unfamiliar ASN, scripted clients, or a session that does not match the user’s baseline.

Score the sign-in the same way you score signup

Use event: signin (or your product’s equivalent) with the same check client. Consistency matters — one scoring model across signup, sign-in, password reset, and email change means one console, one set of rules, and one review queue.

Signals worth caring about

• Device / TLS / browser consistency vs the claimed user agent
• Email and IP reputation context
• Velocity (too many attempts, too many accounts)
• Session bind: did this browser collect match the server check?
• Your lists and rules (known-good staff, known-bad ASNs)

Prefer step-up over silent failure

Hard blocks create support load. Many ATO cases want Verify first: MFA, email OTP, or a password reset challenge. AbuseGraph returns verdicts you can map to those flows without rebuilding detection.

Linked accounts after the fact

When one device or email cluster fans out across many users, the accounts graph helps security see the blast radius — not just the single failed login.

If your threat model includes stuffing at login, pair this with credential stuffing defense and session bind.

Further reading

• Credential stuffing defense
• Password reset fraud
• Session risk scoring
• How it works