A new Q2 report quantifies a threat that happens gradually: account takeover. Built on anonymized data from nearly 200 banks and credit unions, the report sorts the pattern into six categories of account takeover signals. In this episode, report authors Daniel Wagner and Angelica Gascon share the data and the stories behind it, including why some fraudsters wait almost a year to act.
[Report] The Fraud Intelligence Report: Account Takeover Signals
Jim Young
Welcome to The Purposeful Banker, the podcast brought to you by Q2, where we discuss the big topics on the minds of today's best bankers. I'm your host, Jim Young, senior content strategist at Q2. Welcome to the show.
Most fraud tools check a moment. Is this the right password? Did this device pass the MFA challenge? Does this transaction look legitimate? The problem is that the biggest fraud threat to banks and credit unions, account takeover, rarely presents itself clearly at a single point in time. Instead, it unfolds across the entire digital banking session. A settings change here, a navigation pattern there, a transfer timed just so. These are what our guests today call signals.
About a week ago, Q2 published a new benchmark study on this topic. It's called the Fraud Intelligence Report: Account Takeover Signals. There'll be a link to this report in the show notes at q2.com/podcasts. You can also access it directly at q2.com/ato-signals. That's ato-signals.
Now, the report is based on anonymized data from Q2's user activity monitoring product across nearly 200 banks and credit unions. In this episode, we're going to get into what that report found, the signals data, and some of the stories from the field that show how these attacks actually play out.
Joining me to do that are two of the authors of that report, Daniel Wagner, senior director of product and engineering for Fraud Intelligence at Q2, and Angelica Gascon, senior product manager for Fraud Intelligence at Q2. Daniel, Angelica, welcome to the show.
Daniel Wagner
Thank you.
Angelica Gascon
Thank you for having us, Jim.
Jim Young
All right. Well, let's start off with a little bit of background on each of you and your roles in Fraud Intelligence at Q2. Daniel, why don't you go first?
Daniel Wagner
Sure. Angelica and I both came to Q2 via the Sensibill acquisition. Sensibill was a Toronto-based company specialized in machine learning, and where I was the VP engineering. I was leading all of the technology. Ever since we joined Q2, we started to work alongside the great folks here to build new products that fit the skill set that we had. And through that, very early, we started to work with fraud alongside the ETMS team on check fraud. And about two years ago, Angelica and I were invited to host a workshop on fraud and to help us figure out which was going to be our next big bet that ended up being this project called user activity monitoring. I'm currently leading both product and engineering within digital banking fraud and having a lot of interesting products to build along the way.
Angelica Gascon
Yes, just as Daniel said, also came from the Sensibill acquisition, started learning about fraud from fraud experts on the ETMS check positive pay team, and now taking on this new project user activity monitoring that focuses on identifying account takeover fraud and mule detection for digital banking users. And I'm serving as the senior product manager, so I'm in charge of roadmap and vision and strategy for the product.
Jim Young
All right, great. Well, let's go ahead and dive into this report. As I mentioned before, it frames account takeover as something that shows up via a set of signals. You guys can't see my script, but I’ve got signals in quotes on that. Angelica, can you explain to our listeners what we mean when we say signals and then also how we categorize them for the report?
Angelica Gascon
Sure. So I'll start by saying that we approached this new problem really grounding ourselves on fraud case data. So we started really digging into how fraudsters were behaving. We wanted to focus on the highest volume of cases, the category that was most seen by our clients, just to make sure that we were solving a significant pain point, and that turned out to be account takeover. When we started looking at the data, what jumped out almost right away was that most of those cases involved some type of social engineering. So it wasn't the authentication that was broken in a technical sense, but it was just users handing over their credentials or security access codes. So once we looked past that moment of compromise, we noticed something more useful, which was that once a fraudster was inside an account in a live session, they tended to take the same kinds of actions like navigating to security settings, disabling alerts, maybe updating emails and phone numbers, maybe testing out transaction limits, and that sequence of those repeatable patterns is what became a signal.
Once we could see those same sequences showing up across different users, maybe regions, financial institutions, we realized that these are signals that we can then formalize into detectors to help us identify these type of attacks in the future. So in this report, we took everything that we were seeing and sort of organized it into six categories, and each of those categories is built around one of those distinct signals or patterns that are tied to an account takeover or mule account fraud.
Jim Young
And those are things like credential phishing, geographic anomalies, deposit fraud, just to name a few.
Daniel Wagner
Yeah. And it's important to say that each item by itself is not necessarily weird or suspicious. So one of the signals that we may have is just navigating to check account balance. And by itself, everybody does that. That's nothing that's curious about that. But if the user is navigating through all of their account balances pages and they're also checking transfer limits and everything that's on the account, that may feel a little bit suspicious. So by itself, just checking the balance, it's fine. Checking all of the accounts, all of the limits, everything in the sequence, that is something that we're going to take a deeper look into and see if there's something else that can corroborate on this feels like a fraudulent event.
Jim Young
OK, and that makes sense. So let's dive a little bit deeper into the data. I mentioned the categories one of was credential phishing, and that is by far the largest signal category that we have here. So essentially of the account takeover signals that we picked up through them, 55.2% of everything detected fell into the credential phishing category. That's more than the other ones combined. Angelica, is this expected, unexpected? Would you go in thinking, yeah, this is going to be the one we're going to see as being really the dominant one?
Angelica Gascon
I’d say that it wasn't surprising just based on our initial analysis. As I mentioned, we were really grounding ourselves in the data that we had and we quickly recognized that those type of attacks where the user was socially engineered into giving out their credentials were one of the highest themes that we saw across. So it's not surprising from that standpoint of view. And it also matches our anecdotal conversations with our early adopters as something that they struggle with, just preventing and educating their end users to stop giving out credentials and start to recognize these types of scams.
Jim Young
One thing I wanted to note is that I won't get into the specific numbers, but this by percentage was a bigger deal for the bigger institutions in our study. The larger bank segment, I think it was around 60% roughly, and it goes down, I think around 15, 16% less. Again, if you want the specifics, you can get that report. But I'm sort of curious, and either one of you guys can chime in on this, what does that mean? How do you interpret that? Daniel, does that mean smaller institutions should worry less about credential phishing?
Daniel Wagner
I would say that there's credential phishing done right. So when the fraudster copies the website and is really doing a more targeted attack, does have a cost, which is why we see a little bit of that breakdown, why smaller FIs are not as targeted is because it is costly for the fraudster to do that target. But the thing is this is one of the things that the new generation of AI agents has made it a lot cheaper. So if you ask me three years ago, I would say, yeah, if you're very small, you shouldn't be so worried. These days I think everybody should be worried. So even if it's smaller proportionally, I would say that if you look two years ago, it was not as bad, so it is getting worse over time.
Jim Young
OK. All right, good to know. You mentioned that, so the data shows some differences between segments, also shows differences between banks and credit unions. Daniel, mule account signals show up at roughly twice the rate for credit unions. Do you have a theory for that or is there an explanation behind that?
Daniel Wagner
There is not a clear explanation, so we don't know exactly why because we can't just speak with every single bank and understand all of that system. We do know that historically most credit unions offer member-to-member transfer. Not all banks would offer an account-to-account transfer, that will be the equivalent. But it’s just how the data shakes up, how the fraudsters tend to attack credit unions, but it does matches what we hear anecdotally, like our FIs, most of our credit unions come to us and when they're interested in their product, that's typically the first thing that comes to mind to them is that they have this. So it may be the nature of they tend to be embedded in smaller communities. It may be just that they're smaller and so there is a little bit of less attention to some parts of the KYC process.
Some of them actually told us that they suspect that some members may be selling credentials. There are some curious reasons around it, so we can't fully explain why, but the combination of all of these factors just may be the reason why credit unions tend to be more targeted by this. It doesn't exclude banks, but it definitely is something that we see more with credit unions.
Jim Young
OK, so if I'm following you on that, with a mule account, just for some of our listeners, they might not be totally aware of that technical term, but basically you've got some people creating sometimes, I guess often synthetic sort of accounts and what they need basically is a place for when they've come in and taken money, say if you, Daniel, are a credit union member, they need a way to get that out. And the way to do that is to transfer it member to member to one of these synthetic mule accounts. And to your point, one of the theories here, again, not a definite explanation, but a theory is that credit unions offer that service, that member to member more often, which could make them more vulnerable. Did I sort of get that? OK, I want to make sure.
Daniel Wagner
Right. The cornerstone of digital banking fraud is a mule account that might be a synthetic mule, like what you described, which is just somebody that doesn't exist or fake credentials that has an account created, or it might be somebody that just gets access to the account and then is a real user that has had their credentials stolen and is used. But at the end of the day, if digital banking fraud needs to happen, a fraudster is not going to take money into their own personal account. That will be too easy for the police force to find them. They need a place that doesn't truly exist or it's not their own that they can control. And mule accounts are, when we call mule account attacks, what we typically see is one centralized account in an FI, and then they will attack many members of that, again, if I talk about a credit union, many members of the credit union are attacked and then they funnel all of that money into that single account where it's easy for them to take out.
Jim Young
OK. All right. Angelica, going back a little bit to again, some of the differences we saw by institution size or segment, on the flip side where we saw there was more of the credential phishing at the bigger banks, we saw that geographic anomaly signals showed up more at smaller institutions and were not as common at the big institutions. Do you have a theory on why that might be?
Angelica Gascon
So these reports right now, the stats are based on user activities, volume of alerts during our early adopter space. So the working theory right now is that smaller institutions have a tighter, more predictable geographic norms for their account holders. So any deviation is more likely to register as anomalous, whereas for larger institutions that have more geographically dispersed customers, the same anomaly blends in a little bit more and may be harder to identify and often requires more corroborating signals to identify whether it is a true account takeover or just a user maybe traveling internationally, maybe using a VPN or other legitimate reasons why the geography is different for that session.
Jim Young
Gotcha. OK. Yeah, that makes sense. Let's turn to what we talk about in the report, we call the signal stories part of this. So we basically do a lot of the number crunching on it, but then we also went through this section called signal stories. Daniel, can you tell me what's the source material that was pulled from for these stories?
Daniel Wagner
It's a great question. It's important to differentiate the data that we know and what we know is what we see on our system. So Angelica was describing the signal, so somebody logging in, browsing to a page and et cetera. So this is the data that we know. We can see on the logs, we can follow step by steps the actions of a user, and then we can see what's there. But what happens before that, what happens until the digital session begins and we have those issues, the only way for us to know is to actually interview our customers, our FIs, and actually understand what were the steps that happened. And that typically is, again, the FIs themselves, they will often have the same issue. They can see the footsteps on their platform through our data, but it boils down to them calling the users and then doing that specific attack.
So they're not going to do that for every single time that they have an attack. They will do that for either when they see the pattern repeating or when they have to investigate something a little bit larger, that's when they're going to have the full story. So the way that we got access to these stories is by engaging with our FIs typically through the early access part of our program and just talking with their investigation team, going through the motions, and then as they're trying to help us build these detectors, that background information does help because if we do learn that, hey, they've seen a concentration of attacks around a specific date, it might help us, it might give us clues on how to build our attackers. So that's the origin of these signal stories.
Jim Young
OK, gotcha. Now we were just talking about mule accounts and one of those stories sort of builds off of that. Can you walk us through how this sort of thing unfolds, but also, I guess really almost the most important thing is when it unfolds. Can you take us through that?
Daniel Wagner
Yeah. Going back to the thing that we said in the beginning, it's just a member-to-member transfer by itself. That's nothing suspicious there. It's really hard to see a fraud pattern. It would be great if we had a library of mule accounts. We know everything that happens in the market, but the things with mule accounts is that, again, you're not going to commit crime every time in the same place. So for mule accounts, while we know about them, they typically have a very short-lived time span because when we discover that this account is used to commit fraud, commit crime, well, the bank's going to investigate, they're going to close the account. And so all of these accounts, they have a very limited short window when they're actually used for fraud. And for us, when we see that there is money movement into an account, it's important for us to take the steps back.
So if it's a mule account, the example that you gave was a synthetic account, which is a very common pattern. So somebody creates a new account and that's the account they're going to use for fraud. The only way that we can often figure out that it is an account is that if we see one or two or more than a few transfers to a destination account that was either never used or it was just created a few days ago, or even if it has more time, it hasn't seen a lot of movement and all of a sudden we see movement to it. So for us, we're going to identify that is not only the user doing the movement that is suspicious, it sometimes is the actual destination account or suspicious. And so that might be the moment where we are going to say, OK, this account that is the target of the account, we don't know whether it's mule, it's not on our data catalog yet, it's not on our consortium of data, but it's something that we only see that is a fresh account.
And that might be the moment that we may say, OK, it's the first or the second transfer that we see in the short period of time to an account that's not used to receiving money, that's what we may see. This is a mule account and let's pause or let's ask, we believe it might be mule, so let's ask the FI to do a review.
Jim Young
The thing that struck me about this one that quite frankly kind of freaked me out was the patience involved in it, the degree to which you would see someone wait seven, eight weeks before they suddenly take that step, basically. It's almost like breaking into a house and deciding to live in it for a couple of months before you decide to walk off with the TV in it. Is that the thing actually that gives it away, I guess, in its own sort of way that, hey, we didn't see anything and then all of a sudden we saw it?
Angelica Gascon
I think one of the things that we heard a lot from our customers is that a lot of the solutions that they have today miss this sort of attack because they look at a separate session behavior if they're looking at the session behavior at all. But if they are, they're usually looking at a session by itself, not at the history behind that fraudster starting to build that internal trust and trying to hide their tracks by attempting to behave like a normal customer. And so it does require a lot of patience, but it makes it more difficult to identify because it is often across multiple sessions where you can start seeing that whole story. And that is one of the things that's really cool about user activity monitoring is that we start building that story and understanding what it looks like to really help us identify these type of attacks where the user really is taking its time and trying to bypass some of the protections by building that internal trust and appearing like a normal user.
Daniel Wagner
And we see, actually last week I heard a case of 11 months, Jim. So it wasn't like a few weeks, I heard 11 months as a case. So some fraudsters do get a long background and it is kind of what you said, the fraudster may be in already and they're just lurking on the background. And a lot of what makes this possible is that criminals are getting specialized and sometimes the criminal that steals the credentials is not a criminal that will actually move the money. So there is some dark web dealings on this, and so sometimes that is part of the problem is that sometimes there's an action to breach several accounts and they are able to steal credentials to get the MFA target set, but it's maybe a separate criminal who might be actually the one actually withdrawing the money in the future. So that specialization also accounts for that extra time.
But yes, the patience is definitely something that makes this a lot harder to field because it used to be that, hey, if you've seen this device a few times, you're good. Now we have to patch together many, many different things to get a story that actually makes sense.
Jim Young
Yeah, I remember the first time I heard about this, one of the things people talk about is, OK, that person who comes in and they immediately go to the settings and immediately turn to change, and that's your sort of signal that somebody … I mean obviously these are not dumb adversaries involved in this. It's a game of sort of cat and mouse, so to speak with this. Where does this go next? The report sort of argues that the same sort of logic here that we're using for account takeover goes past that, even to scams where there's no stolen credential at all. Can you dive into that a little bit?
Angelica Gascon
So going back to when we were looking to solve this problem, we wanted to take the complexity of finding these signals from the financial institutions and really putting the onus of tuning those detectors and updating those signals and recognizing when patterns change or new patterns emerge. And so the methodology behind user activity monitoring allows us to be able to generalize into other categories of fraud. So the same approach that we use to identify account takeover and mule patterns can be used by going back and looking at other cases of potentially first-party fraud. We can look at what changes are visible in the session, maybe a first-ever wire or a brand-new payee paid within minutes, an ACH payee with the same name, but updated ABA and account number is another one that we've seen starts to creep in a little bit more. And what these attacks have in common is that it's not the account being compromised, it's the legitimate user logging in and being led by the fraudster over the phone to perform a transfer.
And so we really need to start looking at other signals outside of compromise, but the way that we build user activity monitoring and the way that we can analyze the data to generate new detectors is a great foundation to really get us in a good place to start looking at other types of fraud. Even to date, we are looking into business email compromise. We have a detector that is in production today that doesn't require that account takeover step, but it's helping us flag when business email has been compromised and the attacker is asking to send the payment to a different account number. We're starting to be able to identify those type of patterns as well.
Jim Young
It's fascinating stuff. Daniel, Angelica, thank you so much for coming on and breaking this down with us here on The Purposeful Banker.
Daniel Wagner
Thank you for having us.
Angelica Gascon
Thank you, Jim.
Jim Young
Again, could have kept talking for a while on this, but I want to make sure that you, the listener, gets a chance to take a look at the report. There'll be a link to it in the show notes at q2.com/podcast, or you can reach it directly at q2.com/ato-signals.
And that'll do it for another episode of Purposeful Banker. You can subscribe to the show wherever you listen to podcasts, including YouTube, Apple, and Spotify, and you can see our archive of podcasts again at q2.com/podcast. Until next time, this is Jim Young. Thanks for listening.