What an account takeover means
In an account takeover, or ATO for short, an unauthorised person gains full or partial control over someone else’s account. This does not necessarily mean that suchen.expert itself has been technically attacked. Perpetrators often gain access through stolen or reused passwords, a compromised email or Google account, phishing, malware or a session left open.
With a compromised account, perpetrators can, for example:
- change profile details and contact information,
- publish listings belonging to others or edit existing listings,
- send messages on behalf of the affected person,
- persuade other users to make payments or disclose data,
- view available personal information,
- make it more difficult to recover the account,
- exploit the trust placed in a long-standing profile.
Phishing refers to a potential method of attack. Account takeover is the potential outcome if the stolen data is actually used to take over the account.
Typical ways in which an account can be taken over
ATO attacks can occur in various ways:
- Reused passwords: If a password is stolen from another service, attackers can automatically try it on other platforms.
- Weak or easily guessable passwords: Personal details, common words and simple patterns can make attacks easier.
- Fake sign-in pages: A message leads to a page that looks like suchen.expert, Google or an email provider and asks for sign-in details.
- Compromised email accounts: Anyone with access to an email inbox can read password reset messages and target other accounts.
- Compromised Google accounts: If Google is used to sign in to a personal suchen.expert account, unauthorised access to the Google account can also jeopardise access to suchen.expert.
- Stolen one-time codes or security links: Attackers may pose as support staff, buyers, sellers, banks or payment service providers and demand confirmation.
- Malware and remote access: Malicious programmes can intercept passwords, keystrokes or session data. Attackers can use remote maintenance software to carry out actions directly on the device.
- Open sessions: An account may remain logged in on shared or lost devices.
- Stolen session cookies: Depending on the service, a stolen session key may allow access without the password needing to be re-entered.
- Social engineering: Attackers collect personal details and use them to try to persuade the victim or a support service to change access to the account.
- Shared sign-in details: Shared passwords within families, teams or companies make it difficult to control who actually has access.
No single security measure can prevent all these types of attack. However, several coordinated measures significantly reduce the risk.
Recognising potential warning signs
Be on the lookout for changes that you did not initiate yourself:
- unexpected activation or password reset messages,
- unrecognised security alerts from your email or Google account,
- a password that suddenly stops working,
- changes to profile, contact or company details,
- new or edited listings,
- unknown messages, reviews or other activities,
- reports from other users about unusual contact attempts,
- paid bookings or payments that you do not recognise,
- new forwarding rules or connected applications in your email account,
- unknown devices or sessions, provided the relevant service offers such an overview.
A single sign does not in itself prove that the account has been taken over. An approximate sign-in location may, for example, differ because of a mobile network, VPN or the technical attribution of an IP address. An unsolicited reset message may also be generated if someone enters your email address by mistake. However, you should treat several unexplained changes as a serious warning sign.
Use a unique password for each account
Use a separate password for suchen.expert, your email account and other important services. If a password falls into the wrong hands with another provider, the damage is more likely to be limited to that service.
Above all, a good password should be long, unique and difficult to guess. A password manager can generate and store secure passwords. Change a password if it may have been disclosed, is reused with another service or unauthorised access is suspected. Changing it solely according to a calendar schedule without a specific reason is no substitute for length and uniqueness.
Further guidance can be found in How do I create a secure password for my suchen.expert account? and Why is password security verification important?
Protect your email and Google accounts with extra care
The email account associated with suchen.expert may be important for activation and recovery processes. You should therefore protect it with at least as much care as your suchen.expert account:
- use a unique password,
- enable multi-factor authentication or a passkey if the provider supports this,
- keep your recovery details up to date,
- check signed-in devices and connected applications,
- review forwarding, filtering and deletion rules,
- remove any unrecognised access,
- also protect the device on which you receive emails or verification codes.
Further recommendations can be found in How can I make sure my email address is protected?
If you use Google to sign in to a personal suchen.expert account, the security of that access also depends on your Google account. Continue using the same Google account and review its security section regularly. An account used exclusively through Google may not have a separate suchen.expert password that can be changed.
Recognising phishing and fake support
Where possible, open suchen.expert, your email provider, Google or a payment service using an address you entered yourself, your own bookmark or the official app. Do not sign in through an unexpected link or QR code.
Never disclose the following information to anyone else:
- passwords,
- one-time and confirmation codes,
- PINs or TANs,
- full activation or reset links,
- recovery codes,
- session cookies or other sign-in details.
These secrets are not required for a routine support review. Remain cautious even if a message contains your name, a genuine logo or information from an actual listing. The padlock icon and ‘https’ confirm only an encrypted connection to the displayed domain and do not prove that the website is genuine.
Detailed guidance can be found in How do I recognise phishing attempts and fake messages?
Securing devices and sessions
Keep your operating system, browser and security software up to date. Only install programmes and extensions from trusted sources, and check what permissions they are granted. Do not open unexpected attachments, and do not allow strangers to access your device remotely.
Protect computers and mobile devices with a screen lock. Do not sign in to sensitive accounts on someone else’s or a publicly accessible device. If this was unavoidable, sign out afterwards and remove saved sign-in details and website data where this can be done safely on that device.
If a service provides an overview of active sessions or logged-in devices, check this from time to time and terminate any unknown access attempts. Bear in mind that changing your password does not automatically terminate all existing sessions on every service.
Do not confirm any sign-in request or security approval that you did not initiate yourself. Repeated unexpected approval requests may be part of an attack.
Use your suchen.expert account with care
Check your publicly visible profile details, listings, messages and settings from time to time. This will help you spot any unauthorised changes sooner. Also respond to feedback from other users if they claim to have received unusual links or payment requests from your profile.
A familiar, long-standing or highly rated profile is no guarantee that it is still being used by the original person. Bear this possibility in mind when receiving messages from other users and independently verify unusual changes in the communication.
For a business account, access details should be known only to people who are actually authorised. Do not distribute shared passwords without controls. If responsibilities change or an authorised person leaves the company, internal access and recovery methods should be reviewed promptly. If several people need access, ask support which procedure is intended for the business account.
Limit the potential consequences by sharing data sparingly
Only store and send the data required for the specific transaction in messages. Do not share complete copies of identity documents, payment details or confidential documents without a clear purpose and a suitable method of transmission.
If an account is compromised, the information it contains can be read by unauthorised persons or used for further fraudulent activities. Data minimisation does not prevent account takeovers, but it can limit their potential consequences.
If personal data has already been affected, guidance can be found in What should I do if my personal data has been misused?
React immediately if you notice specific signs
If you notice unrecognised changes, messages sent by someone else or a loss of access, follow the immediate measures in What should I do if I suspect unauthorised access to my account?
It explains in detail the steps needed to secure the email or Google account, change the password, review sessions, preserve evidence and check possible payments. Where possible, carry out these measures on a trusted device and do not create a replacement account to work around the loss of access.
If you can no longer control the account or need help establishing the account association, use the official suchen.expert contact form. Do not send passwords, one-time codes, complete security links or session keys. A particular processing time or full recovery cannot be guaranteed.
