Design account takeover detection
PremiumSecurity systemMedium
- Credential stuffing
- Risk scoring
- Step up authentication
Quick answer
This security system interview question asks you to design account takeover detection. Aim for a design that protects users and data without blocking legitimate use, then explain the threats, controls, detection and trade-offs. Interviewers want to see how you model threats and layer defences.
The problem
Design account takeover (ATO) detection for a digital wallet with 60 million accounts, like the risk engines behind logins at banks and large shops. It scores every login and sensitive change and decides to allow, ask for more proof, or block. The hard parts are catching credential stuffing from thousands of IPs while barely bothering real users.
Attackers use leaked email and password lists, phishing kits that relay one-time codes, SIM swaps and stolen session cookies. A takeover usually ends with the attacker changing the email or phone and moving money out, so account changes and payouts matter as much as login.
What must the system do?
- Score every login: Return allow, step-up or block for each login attempt within 100 ms p99, using device, network, behaviour and credential signals.
- Guard sensitive actions: Re-score and require step-up for email, phone or MFA changes, new payees and payouts above a limit.
How well must it do it?
- Catch rate: Stop at least 95% of stuffing logins that use a correct password before they reach a full session.
- Friction budget: Step-up for at most 3% of legitimate logins.
What scale should you design for?
Use these numbers in your estimates.
The scale numbers unlock with this questionUnlock
Key concepts
- Credential stuffing
- Risk scoring
- Step up authentication
- Device fingerprinting
- Breached password check
- Impossible travel
How you’ll practise
- Requirements and assets
- Threat model
- Identity and access
- Data protection
- Detection and response
- Wrap-up
Lala, personalized to you, gives a hint when you ask and reviews your design when you are ready.
What do interviewers look for?
In any security system design round.
- Starts with a clear threat model
- Layers defences instead of relying on one control
- Covers authentication, authorisation and secrets
- Plans detection, alerting and response
- Protects data in transit and at rest
- Balances security against usability and cost
Questions people ask about this interview question
- Which design type is this question?
- It is a security system question. You design account takeover detection and explain your choices the way you would in an interview.
- Is this question asked at entry level?
- It is marked Medium. Entry-level engineers can practise it, but it expects you to reason about requirements and trade-offs, not only list components.
- What should I cover first?
- Start with what must be protected, from whom and what a breach would cost. Agree on scope with the interviewer before you design anything.
- Can I practise it for free?
- It is a premium question. Sign up and unlock it once for 10 credits; it then stays unlocked. When you finish, Lala, your personalized AI mentor, can review your design for 30 credits.
Related questions
Updated · Written by the SevyDevy team