Which method is commonly used to gain information for account takeover?

• A. Secured multi-factor authentication
• B. Publicly available vendor catalogs
• C. Regular password changes by the user
• D. Social engineering, phishing, bots, malware, or social media

Answer: (D)

Gaining information to carry out an account takeover almost always hinges on tricks that extract credentials or other sensitive data directly from the victim, or harvest it through malicious software. Social engineering and phishing are the classic techniques: they deceive people into revealing usernames, passwords, or one-time codes, often by pretending to be a trusted entity. Malware and bots automate the stealing of data by infecting devices, logging keystrokes, capturing screen data, or harvesting credentials from infected systems. Social media plays a big role too, because attackers can gather personal details, reset questions, or impersonate someone the target trusts, making it easier to bypass security controls.

That’s why this option is the best choice: it captures the real-world ways attackers collect information to break into accounts. The other choices describe protective measures or less relevant sources. Secured multi-factor authentication is a defense that helps stop takeover, not a method used to obtain information. Publicly available vendor catalogs aren’t a common route for gathering the victim’s credentials. Regular password changes are a protective practice that can mitigate risk, not a technique attackers use to gain information.