Account Takeovers – Castle
Account Takeovers
Identify both bots and human attacks
Use a combination of scores and heuristics to highlight suspicious or hijacked accounts.
Real-time blocking
Rules execute in milliseconds to block account takeovers inline without noticeable delay.
Custom definitions
Define account takeovers your way using advanced filtering and real-time velocity queries.
Granular analytics
Leverage BI-grade analytics to expose account takeovers and fraud rings at scale.
Data enrichment
Enriched with device intelligence, risk scores, velocity metrics, and much more.
Segmentation
Define account takeovers using custom logic
Castle lets you use advanced filtering, real-time velocity queries, and custom lists to segment out account takeovers with high precision.
- deny
- ATO Score is > 90
- and Device Age is < 5 min
- and Proxy IP is true
- and Count of events Login Failed by ISP in the last 10 min is > 20
- or Signals include Reported Devices
Automation
Action on account takeovers in real-time
Rules execute in milliseconds and can be used to adapt the user experience based on risk in real-time.
deny
Abuse Score is > 90
and Disposable Email is true
and Count events Registration by Device Fingerprint in the last day is > 3
or Signals include Blocked country
Add User ID Warned Account Sharers
Remove User ID Allowed Users
Send webhook https://hooks.zapier.com/hooks/catch/4378238094/ch3dka
Send to Slack #security-alerts
Real-time decisions
Assessments of data like user count per device or hourly failed logins executed in the blink of an eye.
Inline blocking
Initiate request blocks or step-up verifications anywhere in your app without disrupting the user experience.
Alerts & notifications
Ensure your team and users stay informed with triggered Slack notifications or webhooks.
Analytics
A holistic view of account takeovers
Harness the power of BI-grade analytics to expose account takeover attacks and unravel fraud rings with precision.
Explore
- Event Name: Registration Attempted, Login Attempted, …
- Policy Action: deny, challenge
| Timestamp | Policy | Event | User | Location | Connection | Device | Lists | Signals |
|---|---|---|---|---|---|---|---|---|
| Sat, Aug 8 07:59:08 | Challenge | Medium Abuse Score | 732496 | Spain 33204, Gijón | Telefonica de Espana | Chrome on Windows 10 | Disposable email domains, New device | |
| Sat, Aug 8 07:59:08 | Deny | Bad email | 471896 | Ukraine 29000, Khmelnytskyi | Kyivstar | Chrome on Windows 10 | Trusted user devices | |
| Sat, Aug 8 07:59:08 | Deny | [ScAuth] Attempted Login | 956616 | South Africa 8001, Cape Town | Starlink | Chrome on Windows 10 | Challenged IPs, Timezone Area Mismatch, Multiple Accounts Per Device | |
| Sat, Aug 8 07:59:08 | Deny | Password Reset Policy | 849676 | India 400001, Mumbai | Jio | Chrome on Windows 10 | Multiple Accounts Per Device | |
| Sat, Aug 8 07:59:08 | Challenge | Trusted Device Policy | 753516 | Russian Federation 672000, Chita | Rostelecom | Chrome on Windows 10 | Disposable email domains, Multiple Accounts Per Device |
Enrichment
All the data you need to pinpoint account takeovers
Every interaction is enriched with comprehensive device intelligence, risk scores, location data, and much more.
- Battery State: Charging
- Emulator: Rooted
- Device Fingerprint: mXZ29K2RRXeDDkdX
- Memory: Storage 256GB
- ATO Score: 76
- Bot Score: 32
- Carrier: AT&T
- Headless Browser: Signups per IP over 1h 5
- Timezone: Europe/Berlin (UTC+1)
Risk Scores
Out of the box risk scores for account abuse, account takeover, and bot abuse.
Velocities
Compute personalized signals based on real-time metrics like counts, sums, averages, and more.
Device fingerprinting
Persistent device identifiers resilient to storage resets and resistant to privacy plug-ins.
Bot detection
Identify bot actions via bot scores, headless indicators, or velocity and rate limit checks.
Get started
Create your free account today
Start with a free quota, with transparent pricing that scales when you do.