How to Defend Against Account Takeover Attacks