Contain, then reconstruct. The agent ends the intruder's sessions, freezes cards and blocks new payees, then rebuilds a timeline from login, device, contact-change and payment records to find how the attacker got in and what they took. It alerts receiving banks and links related cases. An investigator confirms the takeover, decides liability and reporting, and restores the customer's access.
What is an account takeover investigation, and who owns it?
Account takeover is when someone other than the customer gains control of their account, usually by stealing credentials, intercepting one-time codes, persuading a contact centre to change details, or taking over the customer's phone number. The pattern is familiar: a new device logs in, contact details change, a new payee appears, money leaves.
An investigation has to answer four questions fast: is the attacker still in, what did they do, how did they get in, and is this part of something larger? The head of fraud investigations owns the process. Named investigators own each case. Financial crime owns any suspicious activity reporting. The wider frame is in our guide to AI agents in banking.
What does the agent prepare, and what does a person approve?
- Agent, depth 3: contains. Ends all active sessions, freezes cards, blocks new payees and outbound payments above a minimal level, and suspends credential resets until an investigator acts. These are protective and run at once. Evidence: containment actions with timestamps.
- Agent, depth 1: rebuilds the timeline. Logins with device and location, credential and code resets, contact detail changes, contact centre interactions, payee additions, payments, all in one sequence. Evidence: the timeline with a source for each event.
- Agent, depth 1: identifies the likely entry point. A login from a new device after a password reset by email; a phone number change after a contact centre call; codes sent to a new number. Evidence: entry hypothesis with the events that support it.
- Agent, depth 1: quantifies losses. Every outbound payment after the first suspicious event, with receiving accounts. Evidence: loss list.
- Agent, depth 3: alerts receiving banks through the agreed inter-bank route. Evidence: alert references.
- Agent, depth 1: links related cases. Same device, same location pattern, same receiving accounts. Receiving accounts that collect from several victims may be mules, a separate investigation covered in investigating suspected money mule accounts with an AI agent. Evidence: links with the shared attribute.
- Agent, depth 2: drafts the investigation report. Timeline, entry point, losses, links, open questions. Evidence: draft.
- Person, investigator: confirms and decides. Whether takeover occurred; reimbursement and liability; whether a suspicious activity report is needed; whether any control failed. Evidence: decisions and reasons.
- Person, investigator: restores access. After verifying the customer's identity through a route the attacker cannot control. Evidence: verification record and restoration.
| Step | The agent does | Depth | Stays with a person |
|---|---|---|---|
| Contain | Ends sessions, freezes, blocks payees | 3 | Lifting any containment |
| Timeline | Rebuilds events from logs | 1 | Nothing |
| Entry point | Proposes how the attacker got in | 1 | Investigator confirms |
| Losses | Lists outbound payments | 1 | Nothing |
| Alert | Notifies receiving banks | 3 | Nothing |
| Link | Finds related cases | 1 | Investigator decides scope |
| Report | Drafts the investigation | 2 | Investigator finalises |
| Decide | Nothing | none | Liability, reporting, control failures |
| Restore | Nothing | none | Investigator, after verification |
Which controls matter, and what evidence do they leave?
Containment before analysis. Evidence: containment precedes the first analysis entry.
Containment is complete. Ending app sessions is not enough if the attacker registered a new device, added the card to a digital wallet or set up a standing order. The agent checks each and reports what it found. Evidence: a containment checklist per case.
Contact through details the attacker did not set. If the phone number changed during the takeover, the agent does not use it. Evidence: contact channel and its history checked.
Timeline from your own records. Logs are signed sources; the customer's recollection is declared. Both matter; they are labelled. Evidence: provenance on each event.
Restoration held. Giving access back to the wrong person completes the attack. Evidence: held verdict and verification record.
Reporting by people. Under the FATF Recommendations, suspicious transaction reporting is a core duty; deciding to report is a judgement for trained staff, not an agent. Whether an agent can investigate financial crime more broadly is discussed in whether an AI agent can investigate an AML case. Evidence: reporting decision by a named person.
What should you measure?
- Time from first alert to containment.
- Funds recovered through receiving bank alerts.
- Entry points by type, over time. A rise in one type points to a control to fix.
- Linked cases found, and how many became wider investigations.
- Re-takeovers after restoration. Each is a serious failure.
Where does it usually go wrong?
Analysis before containment. The agent builds a fine timeline while the attacker is still logged in.
The customer is contacted on the attacker's number. The verification code goes to the fraudster.
The contact centre is left out. Many takeovers start with a convincing call. If contact centre logs are not in the timeline, the entry point is missed.
Your own agent was the way in. If an attacker talked a customer-facing agent into changing details, treat it as an incident in that agent's conduct too; the method is in how to investigate an AI agent incident.
Failed payments are ignored. Attempts that failed show what the attacker tried and where. The same techniques apply as in investigating failed payments with an AI agent.
Questions people ask
Can the agent tell the customer how the attacker got in?
It can share what the investigator confirms, in approved wording. Early hypotheses may be wrong, and some details could help an attacker.
Should the agent reset the customer's credentials?
It can start the reset route after containment, but the final step, giving the customer access again, follows identity verification by an investigator.
What if the customer is the suspect?
Some claims of takeover hide first-party fraud. The agent records the evidence as it finds it; the investigator weighs it.