Why this matters
Account takeover (ATO) is when a fraudster gains access to your account and uses it as if they were you — moving money, changing your details, or locking you out. It's one of the most damaging types of fraud because everything the attacker does looks legitimate: it's your account, doing things you appear to have approved.
The good news is that takeovers almost always start with a step you can block: a stolen password, a shared code, or access to your device. Understanding the chain helps you break it.
How account takeover happens
Stolen or reused passwords. If your password leaked in a data breach elsewhere and you reused it, attackers can try it on your accounts.
Phishing. You're tricked into entering your login on a fake site or sharing it in a message. → See: Phishing Explained: Fake Emails, SMS & Websites
Shared verification codes. A fraudster convinces you to read out a one-time code, giving them the final key to your account.
Malware or malicious apps. Harmful software on your device captures your logins or activity. → See: Recognising Malware & Malicious Apps
Device theft or unlocked access. Someone gets hold of your unlocked phone or knows your device passcode.
SIM swap. An attacker takes over your phone number to intercept messages and reset access.
Warning signs your account may be compromised
You receive notifications about logins, changes, or payments you didn't make.
Your personal details (email, phone, address) changed without your action.
You're unexpectedly logged out or your password no longer works.
You see transactions you don't recognise.
Friends receive messages or requests from you that you didn't send.
→ For more detail, see: Recognising Suspicious Login Activity
How to protect your account
Use a strong, unique password for your account — never one you reuse elsewhere. → See: Strong Passwords & Password Managers
Never share your password or verification codes with anyone, including people claiming to be support. We will never ask for them.
Be alert to phishing. Don't log in through links in messages; open the app or official website yourself.
Keep your device secure with a screen lock, and keep your apps and system updated. → See: Device Security Essentials
Only install apps from official app stores, and never install remote-access software at someone's request.
Act on unexpected alerts. If you get a notification about a change you didn't make, check your account and contact us straight away.
What an attack often looks like
You receive a text: "Suspicious login detected — verify your identity: [link]." You enter your login on the fake page. Minutes later, the attacker is inside your account, changing your email so you can't get back in. The scam succeeded at the very first step — the fake link. Not clicking it stops the whole chain.
What to do if you think your account is taken over
Change your password immediately if you can still access your account.
Contact us right away through the 24/7 support chat in the Blackcat or Blackcatcard app so we can help secure your account and freeze suspicious activity.
Review your details and recent transactions for anything you didn't do.
Check your device for unfamiliar or remote-access apps and remove them.
Report it so we can investigate and protect you.
If you've lost access entirely, reach out through the app support chat on another device or contact us via the official channels so we can verify your identity and help you recover.
→ See: I Think I've Been Scammed: Immediate Steps