TFGBV Taxonomy
Abuse Type:

Account access control

Last Updated 8/4/25
Definition: Gaining access to someone's digital accounts without permission or exploiting access to someone’s accounts to monitor, control, or harm them.
Sub Types:
Internet of things (IoT) abuse
Perpetrators:
Personal connection Stranger
Perpetrator Intents:
Compliance Punitive intent
Targets:
Private individual Public figure
Impact Types:
Psychological & emotional harm Infringement of rights & freedoms Social & political harm
Skill Required:Low

Perpetrators gain access to a target’s digital accounts through various means - knowing or guessing passwords, exploiting password reset features ("Password-reset attacks"), using shared devices with saved credentials, or social engineering/coercing victims to share login information (Brown et al., 2024). They may also exploit access given under a previously innocuous set of circumstances. In a threat model of intimate partner violence, the perpetrator is likely to either have physical access to the target’s device or know the credentials to their online accounts.

Once inside, perpetrators can use that access for a number of forms of abuse, such as /cyberstalking/ (read private messages, monitor activity, etc), to restrict a target’s access to their own or shared accounts, services, and data, (changing settings, locking victims out by changing passwords, etc) or impersonate[/online impersonation/] them, often as part of a broader pattern of digital abuse.

Skill level

Low to Medium - Basic attacks, like using an intimate partner’s saved account information on a shared device, require minimal skill. However, more sophisticated methods, like exploiting security vulnerabilities, require moderate technical knowledge.

Additional notes on mitigation strategies

  • Default to highest privacy settings - e.g. force two factor authentication (aka 2fac, 2FA). Because of country/context specific security awareness and abilities, avoid SMS.
  • Know your customer (KYC) - Automated detection of unusual behavior patterns is commonplace in the financial services world.
  • Safety onboarding & awareness training - e.g. increase awareness of two factor authentication.

References

  • Brown, A., Harkin, D., & Tanczer, L. M. (2025). Safeguarding the “Internet of Things” for Victim-Survivors of Domestic and Family Violence: Anticipating Exploitative Use and Encouraging Safety-by-Design. Violence against Women, 31(5), 1039–1062. https://doi.org/10.1177/10778012231222486
  • Lopez-Neira, I., Patel, T., Parkin, S., Danezis, G., & Tanczer, L. (2019). “Internet of Things”: How abuse is getting smarter.. Safe – the Domestic Abuse Quarterly, 63, 22–26. https://discovery.ucl.ac.uk/id/eprint/10070024/1/Safe%20Article%20FINAL.pdf
  • Janickyj, M., & Tanczer, L. M. (2025). Tech Abuse Personas: Exploring Help-Seeking Behaviours and Support Needs of Victim/Survivors of Technology-Facilitated Abuse - UCL Discovery. Ucl.ac.uk. https://discovery.ucl.ac.uk/id/eprint/10208803/

AI Risks and Opportunities

Risks

Perpetrators may develop AI tools that allow them to perform current tactics more easily: AI-powered password cracking tools, deepfaking voices for account recovery calls, and automated credential-stuffing attacks.

Opportunities

Similarly, AI may enable trust & safety teams to make the recognition of suspicious behavior more effective: AI-enhanced behavioral authentication, anomaly detection for unusual login patterns, and improved multi-factor authentication systems .

Prevalence

In a recent analysis of 1,525 tech abuse referrals to UK charity Refuge, 49% of tech abuse cases involved "monitoring [the target's] mobile phone, controlling smart home devices, or depriving them of technology" (Janickyj, 2025).

Cultural Variation

In some cultures, family members (especially the parents of a child) or intimate partners may feel more entitled to account access as part of relationship expectations.

Mitigation Strategies

Defaulting to 2 factor authentication (with high preference for non-SMS, considering prevalence of shared devices in many countries).
Default to highest privacy settings
Default Privacy Settings to Minimize User Vulnerability.
Mirror the automated detection of unusual behavior patterns that is commonplace in the financial services world.
Know your customer (KYC)
Require proof of identity for functions with a higher potential for abuse.
Increase awareness of 2 factor authentication and its purpose.
Safety onboarding & awareness training
New user onboarding and ongoing awareness raising.
Is something missing, or could it be better?
About This SiteGet InvolvedContactCopyrightPrivacy
Loading...