Most account takeover (ATO) detection is focused on the wrong moment. It looks for the bad thing that's already happening: a successful login from an unfamiliar device, a password change, a new payee added. Those are takeover completion signals. By that point the attacker is already in the account, and the response is containment rather than prevention.
What we've found building per-account behavioral models is that ATO has a pre-takeover signature that precedes the successful compromise by anywhere from minutes to hours. The signature isn't subtle. It's detectable in real time. But it requires watching the right features, not just the obvious ones.
Here are the three behavioral signals that show up consistently before account takeover events across the patterns we see in digital banking and payment platforms.
Signal One: Login Timing Entropy Collapse
Real users log into financial apps with highly irregular timing. They check their balance when they wake up, when they're waiting for lunch, when they get a transaction notification. The distribution of login times over a 30-day window for a typical user is wide, with multiple modes corresponding to their daily routines. The inter-login interval variance is high.
Credential stuffing attacks have a very different timing profile. Automated stuffing runs on a schedule or in response to acquired credential lists. The inter-attempt intervals are either extremely regular (a credential tester running at a fixed rate) or clustered into narrow burst windows. When you measure the entropy of login timing over the preceding 24 to 48 hours and compare it against the account's baseline, credential stuffing creates a collapse in timing entropy that stands out sharply.
The signal is not "there was a login attempt." It's "the distribution of login attempt timing is anomalously regular compared to this account's historical baseline." This distinction matters because single-attempt stuffing runs (where the attacker tries each credential exactly once from a rotating proxy pool) won't generate multiple failed attempts against a single account. They'll show up as a single attempt. The regularity signal comes from the inter-attempt intervals across the broader authentication traffic, not from repeated attempts to the same account.
For accounts that haven't yet seen a stuffing attempt, the baseline is the existing login history. For new accounts with thin history, the peer baseline (how similar new accounts behave at this age) serves as a reference. We flag anomalous timing entropy against both baselines and weight the signal higher when both are violated simultaneously.
Signal Two: Device Discontinuity
A device switch by itself isn't a signal. Users get new phones, use their laptop instead of their mobile, travel with a tablet. The feature that matters is device discontinuity in context: a device switch that happens under conditions that don't match the account's prior pattern.
The contextual factors that make a device switch meaningful:
Time since last login from known device. If an account typically logs in daily from a known device and then a new device appears with no gap in activity, that's different from a user who last logged in 3 months ago now appearing from a new device (natural device replacement is plausible). Continuity-discontinuity, not just novelty, is the relevant feature.
Geographic consistency. A new device appearing from the same city as the account's usual location is lower risk than a new device appearing from a different country within hours of the last known-device login. Geographic displacement is not a reliable standalone signal (VPN and privacy tools are common), but as a modifier on device discontinuity it adds meaningful weight.
Session behavior on the new device. The first session from a new device by the legitimate user looks different from the first session by an attacker. A real user on a new device typically spends time on account overview, checks their balance, looks at recent transactions. An attacker goes straight to high-value actions: transfer initiation, payee setup, or payment method changes. The navigation path of the first new-device session is a strong discriminator.
We represent device continuity as a rolling feature: the device ID history for the account over the past 90 days, weighted by recency. A completely unfamiliar device gets a higher discontinuity score. A device seen occasionally in the past gets a lower one. The contextual modifiers (geography, session behavior, time gap) are applied on top.
Signal Three: Transaction Type Shift
Account takeovers are typically monetized through one of a few mechanisms: unauthorized transfers, fraudulent bill payments to attacker-controlled payees, changes to linked bank accounts to redirect future funds, or purchase authorization escalation. All of these involve transaction types that may be unusual for the account.
The signal isn't just "the user is initiating a transfer." It's "the user is initiating a transfer of a type or to a payee type that is inconsistent with their prior transaction behavior." An account with 18 months of transaction history consisting entirely of retail purchases and automated bill payments showing a same-day wire initiation to a new payee is anomalous at the transaction-type level, not just the amount level.
This matters because attackers often deliberately use amounts that fall below standard velocity thresholds. A $2,000 transfer might be below a hard block threshold. But if this account has never initiated a wire transfer before, the transaction type itself is the signal, regardless of amount.
We model this as a categorical shift: for each account, we maintain a probability distribution over transaction types based on prior history. A transaction whose type falls in the low-probability tail of that distribution (say, below the 5th percentile for this account's prior behavior) gets elevated risk weight. Combined with device discontinuity or timing anomaly signals, a transaction type shift at the tail creates a strong composite signal.
Why These Three Signals Together
Individually, each of these signals generates false positives at a rate that would make them unusable as hard blocks. Timing entropy collapses can happen during network issues or app updates. Device discontinuity is common and usually benign. Transaction type shifts happen whenever a user does something new.
The predictive power comes from the composite. When all three signals are elevated simultaneously, the false positive rate drops substantially while the true positive rate on ATO events remains high. A user who switched to a new device (signal two), is initiating a wire transfer for the first time (signal three), and whose recent login activity had anomalous timing (signal one) is in a very different risk category than a user showing any one of those signals alone.
The implementation we use is a composite score that weights each signal and applies a nonlinear combination, rather than requiring all three to exceed individual thresholds. This catches cases where two signals are strong and one is moderate, rather than requiring three independent threshold breaches that can each be individually gamed.
What These Signals Don't Catch
We're not saying this approach catches all account takeovers. SIM-swap attacks, for example, are specifically designed to look like a legitimate device change from a familiar number. Social engineering attacks where the user hands over credentials voluntarily will look behaviorally identical to a legitimate session. Insider-assisted takeovers where the attacker has full account context can mimic legitimate behavior closely.
These are real gaps. The composite signal approach catches the majority of credential-stuffing-driven ATO, which is the most common category at volume, but it's not a complete defense against all ATO vectors. A layered approach that includes these behavioral signals alongside MFA, transaction confirmation for new payees, and out-of-band verification for high-value actions is more complete than any single signal set.
The Intervention Point
The value of catching the pre-takeover signal is that the intervention can be lightweight. An account showing elevated composite ATO risk before a successful compromise can be prompted for step-up authentication on the next transaction rather than being blocked outright. That's far less disruptive to legitimate users who happen to be on a new device than an outright block.
Post-takeover intervention is more expensive: account lock, identity re-verification, potential loss recovery. Pre-takeover friction is a much better trade. The window between when the signal is detectable and when the takeover is completed is typically 10 to 60 minutes in credential stuffing scenarios. That's enough time to add friction that a real user will tolerate and an automated attacker typically won't.
