Q2 Holdings (NYSE: QTWO) has released The Fraud Intelligence Report: Account Takeover Signals, a benchmark study of fraud activity across nearly 200 U.S. banks and credit unions that finds criminals winning through patience and borrowed trust rather than brute force.
The stakes are high. Javelin Strategy and Research puts 2025 account takeover losses at more than $15 billion, making it the costliest fraud type of the year. Part of the reason is that these attacks rarely show up as one obvious event. They unfold over a digital banking session, sometimes across a long stretch of time, and no single step looks alarming. The sequence is what gives them away. Defenses that check one moment at a time tend to miss it.
What the data shows
Q2 grouped detected signals into six categories to see where suspicious activity is emerging in the digital banking journey. Three findings stand out:
- Credential phishing dominates. It accounts for 55.2% of all detected account takeover signals. Generative AI has made it cheaper and easier to clone a bank or credit union website and write convincing lures, and fraudsters are consolidating around this one scalable method instead of spreading out.
- Credit unions see more mules. Mule account activity appears at twice the rate in credit unions as in banks. Exposure isn’t uniform, and an institution’s charter type and size shape which threats deserve the most attention.
- Rare doesn’t mean harmless. In the Q2 sample, the median Dual Approval Bypass fraud amount was more than 13 times the median of other fraud amounts. When criminals get around maker-checker controls (the rules requiring one person to initiate and another to approve a transaction), the damage is outsized.
Daniel Wagner, Q2’s Senior Director of Product and Engineering, Fraud Intelligence, framed it this way: “Increasingly, fraudsters succeed by exploiting the trust between account holders and their financial institutions rather than relying on technical brute force. The report reinforces that fraud prevention isn’t one-size-fits-all, as every institution calibrates trust with its account holders differently. Fraud teams need visibility into behavioral signals across the entire digital banking journey to protect their customers effectively.”
How the study was done
Q2 analyzed anonymized signal data from its User Activity Monitoring product across 199 U.S. financial institutions: 109 banks and 90 credit unions, ranging from under $2 billion to more than $10 billion in assets. Data was collected over two months, from early June through early August 2026.
User Activity Monitoring tracks behavioral signals throughout a banking session, which lets it catch the slow, trust-building tactics that point-in-time controls aren’t designed to see. It’s a core piece of Q2 Fraud Intelligence, the company’s connected fraud defense system for regional and community financial institutions, aimed at earlier detection, faster interdiction, and automated resolution that improves with every event.
What to do with it
If you run fraud prevention at a bank or credit union, start by checking whether your tools evaluate whole sessions or only isolated events. Then compare your own institution’s profile (charter, size, commercial exposure) against these findings, and focus on the threats that fit you: phishing defenses and customer education for everyone, mule monitoring if you’re a credit union, and a hard look at maker-checker controls if you serve business accounts.