Account takeover fraud involves cybercriminals using stolen credentials to access online accounts, with financial institutions often targeted due to their monetary value. Despite growing adoption, the effectiveness of cybersecurity measures like two-factor authentication (2FA) remains underexplored. This study evaluates 2FA as a target hardening strategy within the situational crime prevention (SCP) framework. Using a natural experimental design, we analyzed cyber threat intelligence from illicit markets between March 2021 and February 2022, during which three major Canadian banks implemented 2FA, two optionally and one mandatorily. Bayesian time series analysis revealed that mandatory 2FA significantly reduced the number of compromised bank accounts, whereas optional 2FA did not. These findings inform crime prevention policy and contribute to theoretical developments in cybercrime research.
Kamar et al. (Tue,) studied this question.