A form of identity theft in which a criminal or other attacker obtains control over a user's online account (normally but not exclusively a financial account).