Account Takeover in Insurance: How It Happens in Policyholder Portals

Account takeover in insurance happens when someone other than the policyholder gets into a policyholder’s online account and uses it to move money or change the policy. Attackers get in with reused passwords, phishing, SIM swaps or stolen sessions, then change the contact details, swap the payout bank account, change the payment method, pull documents or edit the policy. Many of these sessions pass the login checks, including MFA, which is why carriers need to watch what happens after login as closely as the login itself.

What is account takeover in insurance?

Account takeover (ATO) is unauthorized use of a real customer’s account. In insurance, the target is the policyholder portal or app, and sometimes the agent portal. The account already holds what a fraudster wants: a verified identity, policy documents, payment methods and a bank account that refunds and payouts are sent to. Because the account is real and the credentials are valid, the activity can look like ordinary self-service.

The problem is large across industries. Javelin Strategy & Research’s 2026 Identity Fraud Study reported: “Account takeover losses decreased by 4% in 2025 but remained the costliest fraud type, exceeding $15 billion.” The same study found: “Despite lower losses, account takeover affected 6 million consumers, an 18% increase from 2024.” The study is not insurance-specific, but carriers face the same attackers and the same stolen credentials, and they keep moving more servicing online.

How account takeover happens at insurance carriers

Credential stuffing

Attackers take usernames and passwords leaked in other breaches and test them against carrier login pages at scale. Wherever a policyholder reused a password, the attacker gets in with valid credentials. Network-level bot management handles much of the high-volume version of this attack. Slower, distributed attempts that mimic people are harder to separate at the login page alone.

Phishing and fake login pages

A text or email that appears to come from the carrier (“your policy will lapse,” “your payment failed”) sends the policyholder to a lookalike page. Simple kits capture the password. More advanced kits relay the session to the real portal in real time, which lets them capture a one-time passcode or the logged-in session itself.

SIM swap and account recovery abuse

In a SIM swap, the attacker convinces a mobile carrier to move the policyholder’s phone number to a new SIM. Every SMS passcode and password-reset text then goes to the attacker. A related route runs through account recovery and the contact center, where an attacker with enough personal details asks for a reset or a contact change.

Session hijacking

Malware on the policyholder’s device, or a phishing kit, can steal the session cookie or token issued after a successful login. The attacker replays it from another device and is inside the account without ever facing the login page or an MFA prompt.

AI agents automating takeovers

Browser agents can work through a portal the way a person would: log in, open settings, change an email, add a bank account, request a document. We expect attackers to use these agents to run takeover playbooks across many accounts at a human-like pace. Legitimate policyholders will use the same agents for routine servicing, so the presence of an agent alone settles nothing. What the agent does after login is what matters. More on agentic AI in insurance.

Where account takeover hits a policyholder account

Takeovers show up where money moves, and the first change is usually the one that cuts the real policyholder out of the loop.

The pattern matters more than any single change. A new device, then an email change, then a bank account change, then a refund request within one session or one day is a classic takeover sequence. Each step on its own can look like routine servicing. See how carriers protect these moments in account servicing.

When a takeover reaches a claim

Some takeovers end in a claim: the attacker files a loss from the taken-over account, or edits the payment details on an open claim. That path has its own warning signs at registration, mid-claim and after payout, and we cover it in a separate post on account takeover in claims.

Why login checks and MFA are only part of the answer

Multi-factor authentication blocks a large share of attacks that rely on a stolen password alone, and every carrier portal should use it. It still leaves gaps that matter for insurance:

• SMS codes follow the phone number. After a SIM swap, the attacker receives the code.
• Real-time phishing kits relay codes. The policyholder types the code into a fake page, and the kit passes it to the real portal within seconds.
• Stolen sessions skip the prompt. A hijacked session token is already authenticated.
• Recovery flows can reset the factor. If an attacker can change the phone number or email through recovery or the contact center, MFA protects the attacker’s access.
• Login is one moment. MFA confirms the person at login. It doesn’t tell you whether the session that changes the payout account twenty minutes later is still the policyholder.

Phishing-resistant methods such as passkeys close some of these gaps. A passed login still only tells you the credentials were right. It doesn’t tell you who is using the account, or why. Applying heavy MFA to every session also has a cost, because genuine policyholders get locked out or abandon the task. The better design adds friction where the session’s behavior and intent call for it. ForMotiv’s registration and login page shows that tiered approach.

Detect > Determine Intent > Act: a framework for account takeover

Detect

Compare each session with how this policyholder, and policyholders in general, behave on the same flow. Useful signals include typing rhythm and familiarity with personal details, pointer movement, navigation that heads straight for sensitive settings, pasted values where people normally type, and device and network consistency against the account’s history. Look before, during and after login. A takeover rarely reveals itself in the login alone.

Determine intent

Read the sequence of actions. A policyholder updating a mailing address after a move looks different from a session that changes the email, adds a new bank account and requests a refund within minutes. Intent questions include:

• Is this session heading for a contact, payout or beneficiary change?
• Did a contact change come shortly before a bank-detail change, payment-method change or refund?
• Is the same device or behavioral pattern showing up across several unrelated accounts?
• Is an AI agent driving a sequence that matches a takeover playbook?

Act

Match the response to the risk, in real time and before money leaves:

• Allow routine changes with no added friction.
• Step up verification on a sensitive change, with the reason recorded.
• Hold a payout, refund or bank-detail change for review.
• Notify the policyholder through the contact details that were on file before the change.
• Refer to SIU when sessions link across accounts, so investigators work one case instead of many files.

An account takeover checklist for carriers

• Do you see behavior after login, or only at the login page?
• Can you tie a payout or bank change to the contact change that came before it?
• Do you notify policyholders through prior contact details after a sensitive change?
• Are SMS codes still your only second factor for payout changes?
• Can your fraud team search for other accounts touched by the same device or behavior pattern?
• Do your rules treat a policyholder’s AI agent differently from a takeover playbook run by an agent?
• Does every step-up or hold carry a reason a servicing rep or investigator can act on?

How ForMotiv helps carriers stop account takeover

ForMotiv analyzes behavior before, during and after login and adds each session to the policyholder’s behavioral record. It weighs behavior, device and network signals together, so a single quirk such as a new phone or a VPN doesn’t flag a genuine customer. The aim is to catch a taken-over account before a sensitive account change, policy change or payout, and to give each login the friction its intent deserves: straight in, a light check, step-up verification or a block. The same view covers credential stuffing at registration and login, and takeovers attempted by AI agents.

Fraud and SIU teams can link sessions that share a device, network or behavioral pattern into one case. Learn more on our insurance fraud detection page, or read how to detect AI agents in insurance applications.

Trusted by 6 of the top 10 P&C carriers and several additional top 10 life carriers.

Frequently asked questions