Account takeover (ATO) is unauthorized access to a legitimate mailbox, typically via phished credentials, password reuse, or OAuth consent phishing.
What good looks like#
- Done: Enforce phishing-resistant MFA (FIDO2 keys or passkeys) for admins and finance.
- Done: Review third-party OAuth grants monthly and restrict user consent.
- Done: Alert on impossible-travel logins and mass downloads.
- Done: Have a documented response: revoke sessions, reset, audit rules and forwards, notify affected parties.
What bad looks like#
- Seen in audits: SMS-based MFA for high-value accounts.
- Seen in audits: Not checking forwarding rules after remediation.
How to move from bad to good#
Work through the good list in order and re-verify after each change. Most teams find one or two items from the bad list already present; fixing those usually produces the largest improvement.
Frequently asked questions#
What are signs of a compromised email account?
Unknown sent items, new forwarding rules, missing mail, login alerts from unfamiliar locations, and contacts reporting odd messages.