AUSTIN, Texas — Credential phishing accounts for more than half of detected account takeover fraud signals, while credit unions are experiencing mule account activity at twice the rate of banks, according to a new report from Q2 Holdings Inc.
The findings are included in Q2’s Fraud Intelligence Report: Account Takeover Signals, released Oct. 14, which analyzed fraud-related activity across 199 U.S. financial institutions, including 90 credit unions and 109 banks.
According to Q2, account takeover fraud is increasingly difficult to identify because attacks often unfold through a series of activities rather than a single suspicious transaction. Individual actions may appear legitimate, but patterns of behavior across a digital banking session can reveal fraudulent activity.
The report comes as account takeover fraud has become the costliest category of fraud in the United States. Citing research from Javelin Strategy & Research, Q2 said account takeover losses exceeded $15 billion in 2025.
Key Findings from the Report
Among the principal findings reported by Q2:
*Credential Phishing Dominates: Credential phishing accounted for 55.2% of all detected account takeover signals. Q2 said generative artificial intelligence has made it easier and less expensive for criminals to replicate legitimate financial institution websites and create convincing phishing messages. As a result, fraudsters are increasingly concentrating on this approach rather than using a broader variety of attack methods.
*Credit Unions Face Greater Mule Account Activity: Mule account activity appeared at twice the rate among credit unions as among banks in the study. Mule accounts are used to receive and transfer fraudulently obtained funds, often making it more difficult for financial institutions and law enforcement to trace stolen money. Q2 said the finding demonstrates that fraud exposure varies by institution type and size.
*Dual Approval Bypass Fraud Carries Higher Losses: The median fraud amount associated with dual approval bypass attacks was more than 13 times the median amount for other fraud types in Q2’s sample. These attacks involve circumventing controls that require one employee to initiate a transaction and another to approve it, commonly known as maker-checker controls. Q2 said the finding demonstrates that relatively infrequent attacks can still present substantial financial risks, particularly for commercial accounts.
Fraudsters Exploiting Trust
Daniel Wagner, Q2’s senior director of product and engineering for fraud intelligence, said the findings underscore how fraudsters are increasingly exploiting relationships between financial institutions and their customers rather than relying on technical attacks alone.
“More than ever, fraudsters succeed by exploiting the trust between account holders and their financial institutions rather than relying on technical brute force,” Wagner said.
He added that institutions need to recognize differences in their exposure to fraud.
“The report reinforces that fraud prevention isn’t one-size-fits-all, as every institution calibrates trust with its account holders differently,” Wagner said. “Fraud teams need visibility into behavioral signals across the entire digital banking journey to protect their customers effectively.”
According to Q2, detecting account takeover attempts requires financial institutions to examine sequences of customer activity, including behaviors that might not independently trigger a fraud alert.
The company said this approach can help institutions identify emerging threats before fraudulent activity results in financial losses.
How the Study Was Conducted
Q2 said the report was based on anonymized account takeover signals collected through its User Activity Monitoring product. The analysis covered 199 financial institutions ranging in size from less than $2 billion to more than $10 billion in assets. Data was collected over a two-month period from early June through early August 2026.
The company said it grouped detected signals into six categories to identify patterns of suspicious behavior and compare fraud exposure across institutions.
The findings reflect detected fraud signals within Q2’s sample rather than a comprehensive measurement of all account takeover fraud across the banking and credit union industries.
