The Phases Of Account Takeover Attacks And How To Stop Them At the heart of an ATO is an account and the value therein. To capture that value, attackers traverse an entire life cycle that goes from stealing credentials to validating them, to using them to take over accounts, to committing post-login fraud, and then doing it all over again.