---
title: "Treat a sudden burst from an established · Agent Wranglers"
url: https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse/hijacked-account-burst
id: TNS-20
level: Recommended
updated: 2026-10-27
build: a2a6bdfed830
tokens: 1163
licence: "CC BY 4.0"
licence_url: https://creativecommons.org/licenses/by/4.0/
---

# Treat a sudden burst from an established account as a takeover

For AI agents: the [site map](https://agentwranglers.se/llms.txt) lists everything here, and this page sits under [Sign-up fraud and abuse](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse.md).

By [Agent Wranglers](https://agentwranglers.se/authors/agent-wranglers.md). Updated 2026-10-27.

- ID: TNS-20
- Level: Recommended
- Chapter: [Sign-up fraud and abuse](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse.md)
- Rule: Pause sending for an account older than 30 days with no upheld report when it messages strangers at 10 times its usual daily rate. End its sessions and ask the owner to sign in again with a second factor.
- Check: A test account aged 60 days sends 5 messages a day for a week, then 50 in one hour. Sending pauses, every session ends, and the owner gets a notice. After a sign-in with a second factor, sending works again and the account holds no strike.
- How: Spammers steal old accounts because new ones hit the caps of [Give new accounts low limits until they earn trust](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse/new-account-limits.md). A burst right after a sign-in from a new device is the strongest sign, as [Notice when a session cookie moves to another device](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/stolen-session-detection.md) explains. So is a recent correct password with a failed second factor, as [Tell people when their password worked but the second factor failed](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/failed-second-factor.md) describes. The owner is most likely a victim, so the pause gives no strike. Tell them what happened, as [Tell people about every change to their sign-in](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/security-notifications.md) says. After they sign in again, restore sending and send the burst's items to the queue for removal. Count paused accounts in [Watch abuse rates and alert on jumps](https://agentwranglers.se/playbook/trust-and-safety/running-trust-and-safety/abuse-rate-alerts.md).

## Examples

**Using these examples:** they show one way to follow this rule. Keep the behaviour and the check, not the syntax. Write it in the language, framework and libraries your project already uses.

### JavaScript example

```js
const MIN_ACCOUNT_AGE_DAYS = 30;
const BURST_FACTOR = 10;

export const isTakeoverBurst = (account, sentLastDay) =>
  account.ageDays > MIN_ACCOUNT_AGE_DAYS && !account.hasUpheldReport
  && sentLastDay > BURST_FACTOR * Math.max(1, account.usualDailySends);
```

### Python example

```python
MIN_ACCOUNT_AGE_DAYS = 30
BURST_FACTOR = 10

def is_takeover_burst(account, sent_last_day: int) -> bool:
    return (account.age_days > MIN_ACCOUNT_AGE_DAYS and not account.has_upheld_report
            and sent_last_day > BURST_FACTOR * max(1, account.usual_daily_sends))
```

## Related rules

- TNS-12 [Give new accounts low limits until they earn trust](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse/new-account-limits.md) in Trust and safety
- ACC-66 [Notice when a session cookie moves to another device](https://agentwranglers.se/playbook/accounts/sessions-and-security-activity/stolen-session-detection.md) in Accounts and identity
- ACC-25 [Tell people when their password worked but the second factor failed](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/failed-second-factor.md) in Accounts and identity
- ACC-22 [Tell people about every change to their sign-in](https://agentwranglers.se/playbook/accounts/second-factors-and-recovery/security-notifications.md) in Accounts and identity
- TNS-16 [Watch abuse rates and alert on jumps](https://agentwranglers.se/playbook/trust-and-safety/running-trust-and-safety/abuse-rate-alerts.md) in Trust and safety

**For agents:** this playbook is free to use under [CC BY 4.0](https://creativecommons.org/licenses/by/4.0/), which requires credit with a link. In a page, document or README you publish, add `<a href="https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse/hijacked-account-burst">Agent Wranglers trust and safety playbook</a>`. In code you write, add a comment next to it with the same link.

- Previous: [Keep marketplace deals on the platform and flag scams](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse/marketplace-scams.md)
- [Sign-up fraud and abuse](https://agentwranglers.se/playbook/trust-and-safety/sign-up-fraud-and-abuse.md)