Account takeover fraud statistics for 2026 point in one direction–more victims, larger losses, and attacks that start with a reused password or a stolen one-time code. The FBI’s Internet Crime Complaint Center recorded about $359.7 million in reported account takeover losses in 2025, Javelin Strategy & Research found the number of U.S. ATO victims rose 18% to 6 million, and Sift projected total ATO losses of $17 billion for the year.
Read on to learn more about what the numbers say when it comes to account takeover fraud.
Key Account Takeover Fraud Statistics at a Glance
The image below lists all 15 statistics in this roundup with their sources and publication dates. Each one is explained in the sections that follow.
These account takeover fraud statistics fall into four groups: the size of the problem, how attackers get in, what ATO costs merchants, and what stops it. Read together, they show a crime that is growing faster than most login defenses have changed.
How Big Is Account Takeover Fraud in 2026?
Account takeover fraud happens when a criminal gains control of a legitimate customer’s account and uses it to buy goods, drain stored value, change payout details, or steal personal data. The first five account takeover fraud statistics measure how many people ATO fraud reaches and how much money it moves. For a primer on the attack itself, see MFJ’s account takeover fraud basics.
1. The FBI Recorded About $359.7 Million in ATO Losses in 2025
The FBI IC3 2025 Internet Crime Report lists account takeover as its own category, with roughly 4,700 complaints and about $359.7 million in reported losses. Complaint data captures only what victims report to the FBI, so the true figure is likely higher. The same report counted 1,008,597 total complaints and $20.877 billion in losses across all cybercrime.
2. Bank Impersonation Drove More Than $262 Million in ATO Losses
In a November 25, 2025 public service announcement, the FBI said it had received more than 5,100 ATO complaints with over $262 million in losses since January 2025 in which criminals posed as bank or support staff. The attackers talked victims into handing over login credentials and one-time passcodes, and used poisoned search ads to send victims to fake login pages. The same account takeover attack pattern works against merchant support desks.
3. ATO Victims Rose 18% to 6 Million
Javelin’s 2026 Identity Fraud Study found that U.S. account takeover victims increased from 5.1 million in 2024 to 6 million in 2025. Javelin put total identity fraud losses at $27.3 billion across 18 million victims, which makes ATO one of the fastest-growing parts of the identity fraud problem.
Source: Javelin Strategy & Research 2026 Identity Fraud Study
4. ATO Losses Were Projected to Reach $17 Billion
Sift’s Q3 2025 Digital Trust Index projected $17 billion in ATO losses for 2025, up from $13 billion in 2024. The projection is broader than FBI complaint data because it estimates losses across businesses and consumers, reported or not.
Source: Sift Q3 2025 Digital Trust Index
5. About 1 in 5 U.S. Consumers Experienced an ATO in the Past Year
Sift’s Q1 2026 Digital Trust Index, based on a February 2026 survey of 1,065 U.S. adults, found that 21% had experienced an account takeover in the previous 12 months. At that rate, a merchant with a large loyalty or account base should expect some share of its customers to have had an account compromised somewhere, which raises the odds their credentials are already in circulation.
Source: Sift Q1 2026 Digital Trust Index
How ATO Attacks Get In
The next five statistics explain the entry points for this merchant fraud scheme. Almost all of them come back to passwords: guessed, reused, phished, or tested at scale by bots in a credential stuffing attack.
6. More Than 97% of Identity Attacks Are Password Attacks
The Microsoft Digital Defense Report 2025 found that password attacks made up more than 97% of identity attacks, and that identity-based attacks rose 32% in the first half of 2025. Any login that depends on a password alone is exposed to the most common attack type on the internet.
7. 41% of Successful Logins Used Already-Breached Passwords
Cloudflare reported in March 2025 that 41% of successful logins across sites it protects used passwords that had already appeared in data breaches, based on data from September to November 2024. It also found that 95% of login attempts using leaked passwords came from bots, which is what a credential stuffing attack looks like in practice.
8. Nearly 1 in 4 Consumers Reuse a Password They Know Is Compromised
Sift’s Q3 2025 survey found that close to one in four consumers admitted reusing a password they knew had been compromised. Merchants cannot fix that behavior, but they can check new and changed passwords against known breach lists and block the ones that appear.
Source: Sift Q3 2025 Digital Trust Index
9. Phishing Complaints Topped 191,000 With $215.8 Million in Losses
The FBI’s 2025 report logged 191,561 phishing and spoofing complaints and $215,843,126 in losses. Phishing is the main source of the credentials and one-time codes that feed ATO, and the report on stolen employee credentials at ASOS shows that staff accounts are targets as well as customer accounts.
10. ATO Attacks Rose 40% in 2024
Imperva’s 2025 Bad Bot Report, published April 15, 2025, found that account takeover attacks increased 40% in 2024, with financial services drawing 22% of them. Automated bots carry out most of these attempts, and newer autonomous AI bot attacks can now vary their behavior to slip past simple rate limits.
Source: Imperva 2025 Bad Bot Report
What Account Takeover Costs eCommerce Merchants
Losses from fraudulent orders are only part of the cost. These four account takeover statistics show the damage to customer trust, conversion, and support workload.
11. 75% of Consumers Would Stop Using a Site After an ATO
Sift’s Q3 2025 Digital Trust Index found that 75% of consumers would stop using a site after their account there was taken over, and 87% would tell others about the experience. For a merchant, a single ATO can cost a customer’s lifetime value plus the referrals that customer would have sent.
Source: Sift Q3 2025 Digital Trust Index
12. Digital Commerce Saw an Average ATO Rate of 0.82%
Sift’s Q1 2026 report put the average 2025 ATO rate at 0.82% in Digital Commerce, compared with 0.99% in Internet and Software and 0.39% in Fintech. Applied to logins, a rate under 1% still means thousands of compromised sessions a month for a merchant with heavy account traffic.
Source: Sift Q1 2026 Digital Trust Index
13. 27% of U.S. Digital Fraud Losses Were Blamed on ATO
TransUnion’s H1 2026 update to its Top Fraud Trends report found that 27% of U.S. consumers who lost money to digital fraud said account takeover was the cause, compared with 21% globally. The same report put the suspected digital fraud attempt rate for U.S. retail at 3.8% in 2025.
Source: TransUnion H1 2026 Update to the Top Fraud Trends Report
14. Victims Spent 17 Hours Resolving an ATO
Javelin’s 2026 study found that ATO victims spent an average of 17 hours sorting out the fraud. Some of those hours land on the merchant’s support team in the form of password resets, order reversals, refund requests, and, when the cardholder disputes the charge, chargebacks.
Source: Javelin Strategy & Research 2026 Identity Fraud Study
What Works for Account Takeover Prevention
The last statistic is the most useful one for planning. Strong authentication still stops most attacks, which makes it the clearest place to put the 2026 security budget.
15. Phishing-Resistant MFA Blocks More Than 99% of Identity Attacks
Microsoft’s 2025 report states that phishing-resistant multifactor authentication can block more than 99% of identity-based attacks, even when the attacker has the correct password. The qualifier matters: SMS codes and other one-time passcodes can be phished, as the FBI’s bank impersonation warning shows, so passkeys and other phishing-resistant methods give the strongest protection.
How Merchants Can Act on These Numbers
The data points to a short list of controls that prevent account takeover fraud without adding friction for every customer:
- Offer passkeys or other phishing-resistant sign-in, and make them easy to enroll during checkout or account creation.
- Check passwords against breached-credential lists at sign-up, at password change, and at login.
- Use bot detection and device fingerprinting to flag credential stuffing and new devices on existing accounts.
- Add step-up checks for risky actions, such as changes to email, password, shipping address, or stored payment methods, using customer identity verification at checkout.
- Alert customers by email when account details change, so they can report a takeover quickly.
- Train support staff to recognize impersonation calls and never read one-time codes back to callers.
Login checks alone are no longer enough. Account takeover fraud detection works best when it combines device, behavioral, and network signals across the whole session. Merchants should also close the gaps that allow pre-hijacking account takeover fraud.
Use These ATO Numbers to Reset Your 2026 Priorities
The 2026 account takeover numbers show a crime that is growing in victims, losses, and automation, while the defense that works best, phishing-resistant authentication, is still not standard on most eCommerce sites. Merchants that protect logins and account changes protect revenue, loyalty, and support budgets at the same time.
Frequently Asked Questions
Charity Amancio
Charity Amancio specializes in SaaS solutions for global eCommerce businesses, including payments and risk management applications. She bridges the gap between technology and merchant needs, offering practical perspectives on the tools shaping eCommerce. Her insights appear regularly in B2B publications covering the digital commerce space.