Volume spikes around promotions trip ISP rate limits unless warmed and segmented.
What email account takeover is#
Account takeover (ATO) is unauthorized access to a legitimate mailbox, typically via phished credentials, password reuse, or OAuth consent phishing.
Why it matters#
A taken-over mailbox bypasses every authentication control and becomes a launchpad for BEC and internal phishing.
Implementation plan for ecommerce stores#
- Enforce phishing-resistant MFA (FIDO2 keys or passkeys) for admins and finance.
- Review third-party OAuth grants monthly and restrict user consent.
- Alert on impossible-travel logins and mass downloads.
- Have a documented response: revoke sessions, reset, audit rules and forwards, notify affected parties.
Priorities specific to ecommerce stores#
Volume spikes around promotions trip ISP rate limits unless warmed and segmented. Weight your effort toward the steps above that address this constraint first, and measure with metrics that match how ecommerce stores generate value from email.
Common mistakes#
- SMS-based MFA for high-value accounts.
- Not checking forwarding rules after remediation.
Frequently asked questions#
What are signs of a compromised email account?
Unknown sent items, new forwarding rules, missing mail, login alerts from unfamiliar locations, and contacts reporting odd messages.