# Design an account takeover detection system: system design interview question

> The system must assess uncertain evidence, stop account misuse, and limit harm to legitimate users despite delayed confirmation of attacks.

Source: https://sysround.com/questions/design-account-takeover-detection-system
Updated: 2026-11-05


Difficulty: hard. Levels: Senior, Staff+.

## How the interviewer opens it

"Design a system that detects compromised accounts during user activity. The system must respond quickly and avoid unnecessary restrictions on legitimate users."

## What to clarify first

- Scale
- Read and write mix
- Actions and responses
- Available signals
- Latency
- Availability, consistency, and durability
- Legitimate-user impact
- Outcome evidence
- Retention and privacy
- System boundaries

## Scope of a strong answer

Core requirements:

- Collect device, location, and activity signals
- Score sign-ins and sensitive account changes
- Apply proportionate responses through existing account services
- Measure detection quality and harm to legitimate users

Usually out of scope:

- Build an identity provider or verification service
- Detect payment fraud unrelated to account takeover
- Detect malware on user devices
- Design new authentication protocols

## What interviewers probe

### Device and location evidence

Travel, shared networks, and device changes can resemble attacks. An attacker can also use a familiar device or a stolen session.

### Responses to suspicious activity

False alarms affect many legitimate users because takeovers are rare. Attackers may also control the channels that the system uses for verification.

### Activity volume and timeliness

The system must decide within 50 ms while context can lag. Concurrent restrictions and account changes must still produce one safe commit order.

### Evidence of detection quality

Labels arrive late and cover only some attacks. The system's own responses change which outcomes it can observe.

## Common mistakes

- The design treats a new device or location as proof of compromise.
- The system applies broad account locks when evidence or dependencies are uncertain.
- The detector treats client claims or successful verification as confirmed evidence.
- The action service checks restrictions before an uncoordinated sensitive change.
- The service acknowledges records before a durable commit across zones.
- The evaluation ignores delayed outcomes, user harm, or deletion from logs and derived data.

## The bar by level

- **Senior:** Meets latency with separate context updates. Coordinates restrictions with final action commits. Handles zone loss, stale data, and duplicate events. Measures delayed outcomes and user harm.
- **Staff+:** Defines one enforceable safety boundary across account services. Proves commit order and acknowledgement guarantees during failures. Controls feedback bias and policy releases. Implements deletion across logs, snapshots, context, devices, and backups.

Practice this question with an AI interviewer: https://sysround.com/practice/new?problem=account-takeover-detection


---
SysRound (https://sysround.com) is an AI practice tool for system design interviews. It has a voice or typed AI interviewer and a shared whiteboard. At the end, you get feedback on each skill and a model answer. The AI feedback can be wrong.