Q2 Account Takeover Report: Phishing Drives 55% of Signals at US Banks

Dateline: Q2 Holdings, research report, 14 October 2026

Q2 Holdings, the Austin-based digital banking software provider, released its Fraud Intelligence Report on account takeover signals on 14 October 2026, finding that credential phishing made up 55.2% of all detected account takeover signals across 199 US banks and credit unions between early June and early August 2026. The release, Fintechbits notes, gives percentages and ratios but no absolute numbers: Q2 does not say how many account takeover signals its 199 institutions generated, or what dollar median sits behind the claim that Dual Approval Bypass fraud runs at more than 13 times other fraud amounts. The data comes from Q2’s User Activity Monitoring product, according to the release.

What the Q2 account takeover data shows

Three findings lead the report. Credential phishing accounts for 55.2% of detected account takeover signals, which Q2 links to generative AI making it cheaper to copy bank websites and write convincing lures. Mule account activity shows up at twice the rate in credit unions as in banks. And the median Dual Approval Bypass fraud, where criminals get around maker-checker controls on business accounts, is more than 13 times the median of other fraud amounts.

The sample covers institutions from under $2 billion to more than $10 billion in assets, and Q2 grouped the signals into six categories. The window is short: about two months, from early June to early August 2026.

Q2 frames the problem as one of sequence rather than single events. In the release’s words, no single event in an account takeover is suspicious, “the sequence is.” That is the pitch for monitoring a whole digital banking session rather than checking at login alone.

How account takeover losses compare

The release cites Javelin Strategy and Research for the scale of the problem, saying account takeover losses were the costliest type of fraud in 2025 at more than $15 billion. Q2’s own data does not put a dollar figure on losses at its client institutions.

Daniel Wagner, Q2’s senior director of product and engineering for fraud intelligence, puts it this way: “Increasingly, fraudsters succeed by exploiting the trust between account holders and their financial institutions rather than relying on technical brute force.”

Fintechbits has covered how banks are responding, from U.S. Bank’s Protect 360 fraud bundle to Unit21’s Corelation Keystone integration aimed at the credit union core market Q2 also sells into.

Fintechbits analysis

Fintechbits analysis

Why the credit union account takeover finding matters most

The credit union number is the most useful line in the report. Mule activity at twice the bank rate tells smaller institutions something specific: criminals use their accounts to move stolen money as well as to steal it. That is a different control problem, closer to anti-money-laundering than to login security, and it carries regulatory exposure as well as losses.

The Dual Approval Bypass figure is the most striking and the least usable. A multiple of more than 13 times the median of other fraud means little without the base. A median of a few hundred dollars for other fraud would make it a serious but contained business-banking risk, and a higher base would make it a much bigger one. Q2 has the data and chose not to print it.

The publisher matters here. Q2 sells User Activity Monitoring, and the report’s conclusion is that institutions need session-wide behavioural monitoring, which is what the product does. That does not make the findings wrong. It does mean the most decision-useful numbers, the counts, are the ones a vendor is least likely to share.

Frequently asked questions

What drives most account takeover signals at US banks?

Credential phishing accounted for 55.2% of all detected account takeover signals in Q2’s data from 199 US banks and credit unions. Q2 attributes the concentration to generative AI lowering the cost of copying bank websites and writing phishing lures.

How was the Q2 report compiled?

Q2 analysed anonymised signals from its User Activity Monitoring product at 109 banks and 90 credit unions from early June to early August 2026. Institutions ranged from under $2 billion to more than $10 billion in assets.

What does the Q2 report leave out?

Fintechbits notes that the release gives shares and ratios but no absolute numbers. It does not say how many account takeover signals were detected, or what dollar median sits behind the 13-times Dual Approval Bypass figure.

What to Watch Next

The full report is the place to start. The test is whether it publishes signal counts and the dollar median behind the Dual Approval Bypass figure. Q2’s third-quarter 2026 results are the next chance to see whether Fraud Intelligence is becoming a material revenue line.

Why this matters

The release, Fintechbits notes, gives percentages and ratios but no absolute numbers, including no dollar median behind the claim that Dual Approval Bypass fraud runs at more than 13 times other fraud. What it does show is useful: credential phishing drives 55.2% of account takeover signals across 199 US institutions, and credit unions see mule activity at twice the bank rate. For smaller lenders that points to money-laundering exposure, not just login security.

Primary sources

businesswire.com | PRESS RELEASE | https://www.businesswire.com/news/home/20261014205817/en/Q2-Releases-New-Fraud-Intelligence-Report-on-Account-Takeover-Signals

q2.com | COMPANY WEBSITE | https://www.q2.com/ato-signals