Account Takeover Fraud: The Anatomy of an ATO Attack