Q2 Releases New Fraud Intelligence Report on Account Takeover Signals

Credential phishing accounted for 55.2% of detected account takeover signals in Q2's sample of financial institutions.

(Low)

(Neutral)How Sentiment works

Sentiment and the balance of points

Rhea-AI Sentiment reads the wording of the document, how positive or negative its language is on a 1 to 5 scale. The balance of points shown with the takes weighs what the document actually discloses, so the two can disagree, for example when a trial that missed its main goal is described in upbeat language.

How Sentiment works How the balance works

Tags

See more from StockTitan in Google Search and AI answers. Adds StockTitan as a preferred source · opens Google

Add on Google

10/14/2026 - 10:00 AM EDT

Benchmark analysis of fraud signals from nearly 200 U.S. banks and credit unions finds fraudsters increasingly using patience and trust to bypass point-in-time defenses.

AUSTIN, Texas--(BUSINESS WIRE)-- Q2 Holdings, Inc. (NYSE:QTWO), a leading provider of digital transformation solutions for financial services, today released The Fraud Intelligence Report: Account Takeover Signals. The new report analyzes proprietary fraud signals across nearly 200 financial institutions in the US, equipping banks and credit unions with the insights necessary to combat account takeover attacks.

Account takeover losses were the costliest type of fraud in 2025, exceeding $15 billion according to Javelin Strategy and Research. These attacks can be difficult to spot and stop because they rarely appear as a single event. Instead, the scam unfolds across the digital session and reveals itself through patterns of behavior, which can surface over long periods of time. No single event in that sequence is suspicious; the sequence is. The report categorizes these signals, unmasking where suspicious account takeover activity is emerging across the digital banking journey and providing a clearer view into the behaviors and tactics financial institutions should be watching.

Key Findings

Credential phishing accounts for 55.2% of all detected account takeover signals. Generative AI has lowered the cost and skill required to replicate legitimate bank and credit union websites and craft convincing phishing lures. Fraudsters are consolidating around this single, scalable attack vector rather than diversifying their tactics.
Mule account activity appears at twice the rate in credit unions as in banks. The finding underscores that fraud exposure is not uniform across the industry. A financial institution's charter type and size materially shape which threats demand the most attention.
Across the Q2 sample set, the median of Dual Approval Bypass fraud is over 13x the median of other fraud amounts, reflecting the outsized commercial impact when fraudsters successfully circumvent maker-checker controls. Low frequency should not be mistaken for low risk.

"Increasingly, fraudsters succeed by exploiting the trust between account holders and their financial institutions rather than relying on technical brute force," said Q2 Senior Director of Product and Engineering, Fraud Intelligence, Daniel Wagner. "The report reinforces that fraud prevention isn't one-size-fits-all, as every institution calibrates trust with its account holders differently. Fraud teams need visibility into behavioral signals across the entire digital banking journey to protect their customers effectively.”

Methodology

To create the report, Q2 analyzed anonymized account takeover signal data from its User Activity Monitoring product across 199 U.S. financial institutions, 109 banks and 90 credit unions, ranging in size from under $2 billion to more than $10 billion in assets. The data was gathered over a two-month period, from early June through early August 2026. Detected signals were grouped into six categories to understand which types of account takeover activity are emerging during digital banking sessions, how frequently signals appear, and how that mix differs by institution size and charter type.

Q2 Fraud Intelligence

These findings are possible because of User Activity Monitoring, which continuously analyzes behavioral signals throughout the digital banking session, surfacing the patient, trust-building tactics that traditional point-in-time fraud controls are not built to detect. User Activity Monitoring is a cornerstone product of Q2 Fraud Intelligence, the connected fraud defense system purpose-built for regional and community financial institutions that helps enable earlier detection, faster interdiction, and automated resolution that sharpens with every event.

To download the report, visit: https://www.q2.com/ato-signals

To learn more about Q2 Fraud Intelligence, visit https://www.q2.com/solutions/fraud-intelligence

About Q2 Holdings, Inc.

Q2 is a leading provider of digital transformation solutions for financial services, serving banks, credit unions, alternative finance companies, and fintechs in the U.S. and internationally. Q2 enables its financial institutions and fintech customers to provide comprehensive, data-driven digital engagement solutions for consumers, small businesses and corporate clients. Headquartered in Austin, Texas, Q2 has offices worldwide and is publicly traded on the NYSE and NYSE Texas under the stock symbol QTWO. To learn more, please visit Q2.com. Follow us on LinkedIn and X to stay up to date.