Account takeover is the use of someone else’s account as if it were your own. Attackers get in with leaked passwords tested at scale, phishing for one-time codes, or stealing a logged-in session, then move money, change details or harvest personal data while appearing to be the customer.
Financial services is the most targeted sector. Thales’s 2026 Bad Bot Report found that 46% of account takeover attacks in 2025 were aimed at financial services. AI agents add two new routes: attacking agents test credentials at machine speed, and a customer’s own AI browser can be tricked by a poisoned web page into handing over a login code.
The strongest defences move the decision off the session. Phishing-resistant sign-in such as passkeys, and confirmation of high-risk actions like new payees on the customer’s own device, hold even when the session itself is in an attacker’s or a hijacked agent’s hands.