Stop Account Takeovers Before They Start