The attacker becomes you — sees your data, acts on your behalf, locks you out. Every account-takeover breach starts with broken authentication.

In-app purchases, linked bank accounts, payment methods — an attacker with your token has everything they need to spend your money. Fortnite attackers bought V-Bucks on stolen accounts and resold them.

When login endpoints have no rate limiting, automated tools can test millions of stolen username/password pairs. One in fifty reused passwords is a taken account.

A compromised account becomes a foothold. From one user's session, attackers probe for BOLA, escalate privileges, or pivot to internal services. Broken auth is often step one of a larger attack chain.

Name, address, email, phone, payment history — a taken account contains everything needed to steal an identity or commit fraud in the victim's name.