Last updated: September 2026
Email account takeover (ATO) is what happens after the phish lands: an attacker signs in to a real mailbox with stolen credentials or a hijacked session, then uses it for invoice fraud, vendor impersonation, and further attacks. Below is a compiled, citable breakdown of the latest account takeover, identity-attack, and multi-factor authentication (MFA) data for small and midsize businesses. For phishing, BEC, and DMARC figures, see our companion email phishing and security statistics roundup.
Quick answer: In 2025, the FBI's Internet Crime Complaint Center received 4,700 account takeover complaints with $359.7 million in reported losses, and Microsoft says phishing-resistant MFA can stop over 99% of identity-based attacks. Yet in a 2024 survey of nearly 2,300 small and midsize businesses worldwide, 65% said they do not use MFA and do not plan to.
Account Takeover and Identity Attacks by the Numbers
| Metric | Figure | What It Means | Source |
|---|---|---|---|
| FBI account takeover complaints (2025) | 4,700 | The first year the FBI's annual report called out account takeover as a growing threat | SpyCloud, analysis of the FBI 2025 IC3 report |
| FBI reported account takeover losses (2025) | $359.7 million | Direct losses only; SpyCloud notes account takeover often enables fraud the FBI counts in other categories | SpyCloud, analysis of the FBI 2025 IC3 report |
| Rise in identity-based attacks (first half of 2025) | 32% | Attacks aimed at sign-ins rose sharply in a single half-year | Microsoft, Digital Defense Report 2025 overview |
| Identity attacks that are password spray or brute force | 97% | The vast majority are simple guessing attacks, which MFA is built to stop | Practical 365, Microsoft Digital Defense Report 2025 summary |
| Identity-based attacks blocked by phishing-resistant MFA | Over 99% | Holds even when the attacker already has the correct username and password | Microsoft, Digital Defense Report 2025 overview |
| Phished identity records recaptured (2025) | 28.6 million | Stolen credentials and session data circulating in criminal markets | SpyCloud, analysis of the FBI 2025 IC3 report |
| Share of phished victims who were corporate users | 49% | Nearly half of phished identities came from work accounts, not personal ones | SpyCloud, analysis of the FBI 2025 IC3 report |
How Stolen Access Gets Used
Stolen access rarely stays with the person who stole it. Microsoft reports that access brokers now sell stolen credentials and entire inboxes to BEC operators, who automate target selection and payment fraud at scale. The FBI data shows how fast that can escalate: some account takeover cases involved more than 50 simultaneous ACH transactions across multiple banks, which makes recovering the money difficult. The FBI's fund-recovery team also noted that account takeover and tech support scams now trigger emergency fund-freeze requests at a rate that rivals BEC.
Resetting a password does not always end the problem. According to SpyCloud, stolen session cookies let attackers bypass logins and MFA, so they must be invalidated in addition to resetting credentials.
What MFA Stops, and What It Does Not
Microsoft's 2025 report found that identity-based attacks rose 32% in the first half of 2025, and that 97% of them were password spray or brute-force attempts, the exact pattern MFA is designed to defeat. Verizon's 2026 Data Breach Investigations Report shows the picture is shifting, though. Exploiting software vulnerabilities (31%) overtook stolen credentials as the top way into a breach for the first time in the report's 19-year history, and credential abuse fell to 13% of breaches. MFA remains essential, but it is one control among several.
| Metric | Figure | What It Means | Source |
|---|---|---|---|
| Vulnerability exploitation as initial access (DBIR 2026) | 31% | First time it has led the report's entry-point ranking | Verizon, 2026 DBIR announcement |
| Credential abuse as initial access (DBIR 2026) | 13% | Stolen credentials now rank behind vulnerability exploitation | Abnormal AI, 2026 DBIR takeaways |
| Breaches involving the human element (DBIR 2026) | 62% | Covers credential reuse, phishing susceptibility, and AI-assisted deception | Mimecast, 2026 DBIR findings |
| Success rate of mobile social engineering vs. email phishing | 40% higher | Fake texts and voice calls are outperforming traditional email lures | Verizon, 2026 DBIR announcement |
| Breaches involving a third party (DBIR 2026) | 48% | Up 60% from the previous report | Verizon, 2026 DBIR announcement |
| Phishing share of breaches (IBM 2026) | 17% | Includes voice and SMS phishing; the top initial vector for the fourth consecutive year | HIPAA Journal, IBM 2026 study summary; eSecurity Planet, IBM 2026 key findings |
| Global average breach cost (IBM 2026) | $4.99 million | Covers organizations of all sizes, so treat it as a benchmark, not a small business average | IBM, 2026 Cost of a Data Breach announcement |
| Mean time to identify and contain a breach (IBM 2026) | 247 days | 183 days to identify and 64 days to contain | Security Boulevard, IBM 2026 report analysis |
IBM also lists valid account abuse and social engineering, including help desk impersonation and MFA fatigue, among the leading causes of 2026 breaches.
The Small Business MFA Gap
| Metric | Figure | Population | Source |
|---|---|---|---|
| SMBs not aware of MFA's security benefits | 58% | Global SMB survey, nearly 2,300 respondents (2024) | Cyber Readiness Institute, 2024 global MFA survey |
| SMBs not using MFA and not planning to | 65% | Same survey | Cyber Readiness Institute, 2024 global MFA survey |
| SMBs with an internal policy requiring MFA | 17% | Same survey | Cyber Readiness Institute, 2024 global MFA survey |
| SMBs that do not require MFA from customers or suppliers | 85% | Same survey | Cyber Readiness Institute, 2024 global MFA survey |
| Top barrier among SMBs yet to adopt MFA | Cost (44%) | Same survey | Cyber Readiness Institute, 2024 global MFA survey |
| Workforce MFA adoption (share of users, January 2025) | 70% | Okta Secure Sign-in Trends Report 2025 | Swif, MFA statistics roundup citing Okta |
These figures come from different populations and should not be read as one trend line. The Cyber Readiness Institute surveyed small businesses worldwide in 2024, while the Okta number comes from Okta's own sign-in report.
How to Use These Numbers
- Enforce MFA on every mailbox, admin accounts included. Phishing-resistant MFA stops over 99% of identity-based attacks, yet 65% of surveyed small businesses do not use MFA.
- Pair password resets with session revocation. Password resets alone do not remove stolen session cookies.
- Keep access current as staff join and leave. Managed onboarding and offboarding keeps MFA and mailbox access in step with your team.
- Do not rely on email training alone. Verizon found mobile-based social engineering succeeds 40% more often than email phishing.
FAQ
What is email account takeover? Email account takeover is when an attacker gains control of a real mailbox, usually through stolen credentials or a hijacked session, and uses it to send fraudulent messages or reach connected systems. Microsoft reports that access brokers sell stolen credentials and entire inboxes to BEC operators, which is how one compromised account turns into payment fraud.
How much did account takeover cost in 2025? The FBI's Internet Crime Complaint Center received 4,700 account takeover complaints and $359.7 million in reported losses in 2025, according to SpyCloud's analysis of the FBI report. SpyCloud notes the figure likely understates the real impact because account takeover often enables fraud that is counted in other categories.
Does MFA stop account takeover? MFA blocks the large majority of attempts. Microsoft says phishing-resistant MFA can stop over 99% of identity-based attacks, and 97% of identity attacks are password spray or brute force. It is not absolute, though: stolen session cookies can bypass logins and MFA, so a compromised account needs its sessions invalidated as well as its password reset.
How many small businesses use MFA? In a 2024 survey of nearly 2,300 small and midsize businesses worldwide, 65% said they do not use MFA and do not plan to implement it soon, and only 17% had an internal policy requiring it. Okta reports workforce MFA adoption of 70% of users as of January 2025, but that figure comes from a different population, so the two should not be compared directly.
Are stolen passwords still the main way into breaches? Not according to the latest Verizon report. Exploiting software vulnerabilities (31%) has overtaken stolen credentials as the top initial access method, and credential abuse fell to 13% of breaches. The human element still appears in 62% of breaches, so identity and email controls remain central.
How long does it take to detect a data breach? IBM's 2026 report found that the mean time to identify and contain a breach was 247 days, made up of 183 days to identify and 64 days to contain. The global average breach cost reached $4.99 million, across organizations of all sizes.
Related statistics: Email Phishing & Security Statistics for Small Businesses (2026) and Email Migration Statistics 2026: Failure Rates, Costs & Data Loss.
Compiled by EMNMS from FBI IC3, Microsoft, Verizon DBIR, IBM, Cyber Readiness Institute, and other primary and industry sources, current as of September 2026. For help enforcing MFA and securing your Microsoft 365 or Google Workspace mailboxes, get in touch with our team.
Recent Comments