Cybersecurity fraud · account takeover
Let the owner in. Not the attacker.
Account takeover runs on stolen credentials: credential stuffing, MFA push bombing, recovery emails changed from unknown devices, and help desks talked into bypassing MFA. Omnareth checks every sign-in, security change and privileged action before it is granted, and recognizes the attacker's address or device across accounts.
| # | Event | Decision |
|---|---|---|
| 1 | Genuine sign-in from a known laptop | ALLOW |
| 2 | Credential stuffing: wrong password from the attacker's address | DENY BAD_CREDENTIALS · MFA_NOT_PASSED |
| 3 | MFA push bombing with a leaked password, same address ▲ Repeat offenders; address and device watched |
DENY MFA_FATIGUE · MFA_NOT_PASSED |
| 4 | Recovery email changed from an unknown device ▲ One address across three accounts: case opened |
DENY CHANGE_NOT_VERIFIED · WATCHLIST_MATCH · REPEAT_OFFENDER · SOURCE_HOPPING |
| 5 | Genuine sign-in from the owner's new phone | FLAG NEW_DEVICE |
| 6 | An employee exports 48,000 records against a 5,000 limit | DENY EXPORT_OVER_LIMIT |
| – | Analyst confirms the address case ▲ Address blocked everywhere |
analyst · state |
| 7 | After the helpdesk trusts its device, the attacker signs in with MFA bypassed | DENY WATCHLIST_BLOCK · REPEAT_OFFENDER · SOURCE_HOPPING |
| 8 | Genuine sign-in | ALLOW |
How it fits
A check before access is granted
Attackers test stolen passwords across thousands of accounts. Each attempt looks like one user mistyping; the campaign only shows across accounts. Your system sends each request to Omnareth and acts only on what it allows.
The account
Status, the devices the account has verified, the roles it holds and how much data it may export.
Sign-ins, changes, actions
A sign-in needs the password and MFA; a security change from a new device needs step-up; an action needs a granted role, within limits.
One address, many accounts
The attacker's address, device and recovery email are held responsible, never the account owners.
Reference rules
14 rules, ready to adapt
Authorization checks fail closed, and every rule names who it holds responsible when it fires.
| Threat | What Omnareth checks | Rule code | Decision |
|---|---|---|---|
| Account Not Active | Locked or disabled accounts cannot sign in or act. | ACCOUNT_NOT_ACTIVE | DENY |
| Export Over Limit | A data export may not exceed the account's export limit. | EXPORT_OVER_LIMIT | DENY |
| Role Not Granted | A privileged action needs a role granted to the account. | ROLE_NOT_GRANTED | DENY |
| Security Change Unverified | Password, MFA or recovery-email changes from a new device need step-up. | CHANGE_NOT_VERIFIED | DENY |
| Wrong Password | A sign-in needs the correct password. | BAD_CREDENTIALS | DENY |
| Impossible Travel | Deny a sign-in that would require travelling faster than an airliner since the last one. | IMPOSSIBLE_TRAVEL | DENY |
| MFA Fatigue | Three or more declined push prompts in one sign-in indicate push bombing. | MFA_FATIGUE | DENY |
| MFA Not Passed | A sign-in needs a completed second factor. | MFA_NOT_PASSED | DENY |
| New Device | Flag a successful sign-in from a device the account has not verified. | NEW_DEVICE | FLAG |
| Source Across Accounts | Flag an IP, device or recovery email implicated in denials on 2+ other accounts in 24h. | SOURCE_HOPPING | FLAG |
| Session Token Reuse | A session token belongs to one account; seen on another, it was likely stolen. | SESSION_REUSE | FLAG |
| Repeat Offender | Flag events involving an identity implicated in two or more denied events in the last 30 days. | REPEAT_OFFENDER | FLAG |
| Blocked Identity | Identities blocked on the fraud watchlist may not take part in any account event. | WATCHLIST_BLOCK | DENY |
| Watched Identity | Identities under watch may proceed only with a flag for review. | WATCHLIST_MATCH | FLAG |
The insider case
MFA bypassed. Still locked out.
After the analyst confirms the case, a helpdesk agent, talked into it on the phone, trusts the attacker's device and bypasses MFA. The sign-in passes every account check. Omnareth refuses it on the watchlist, and the audit record shows the block it acted on.
Victims are not suspects
Only the identities a rule implicates are held responsible. Genuine customers named in a fraud attempt are never counted against.
Policy as rules
Your checks run on every request, with the reason and a remediation step recorded.
For auditors and regulators
Every refused request is sealed with what was known at the time, and verifiable later.
Adapt the model
The UserAccount model, its rules and its fraud identifiers are plain JSON you can change.
Pilot program
Put cybersecurity fraud prevention to work in 90 days
One lane, facility or process, in shadow mode, with results measured against criteria we agree with you. Qualified companies and organizations can apply.