Young UK adults report far more bank account takeover

Outseer, a supplier of fraud detection and prevention technology to banks, card issuers and payment providers, says 21.0% of UK survey respondents aged 18–24 told it they had personally experienced account takeover, compared with 2.1% of respondents aged 65 and over. The finding was published in a release dated 20 October 2026, drawn from online fieldwork carried out in August 2026.

These are answers to a survey, not cases verified against bank records. Account takeover means a criminal gaining control of an account the customer already holds — logging in, changing details, moving money — as distinct from an authorised push payment scam, where the customer is deceived into making the payment themselves. Nothing in the published material establishes whether the respondents who said they had experienced takeover were describing a completed takeover, an attempt, or an incident they interpreted that way, or over what period it happened. Neither the release nor Outseer's UK ebook landing page says how many UK respondents fell into each age band, so the base behind each percentage is unknown.

It matters for UK banks because the two numbers sit at opposite ends of the age range their authentication and communications are designed to serve, and because a difference of that size, if it holds up, raises questions about how controls and warnings work for each group. It matters for customers because an account takeover can cost money, and the route to getting it back runs through the bank and the Financial Conduct Authority's published guidance, not through the supplier that commissioned the research.

What the survey measured

The study covered 7,029 consumers across seven markets — the UK, US, Sweden, Australia, India, Brazil and Singapore — of whom 1,005 were UK adults. Fieldwork was online, in August 2026. The global total is not the denominator for the UK findings, and the UK total is not the denominator for either age group.

Source: Outseer release dated 20 October 2026; online fieldwork August 2026; UK sample 1,005 adults within 7,029 across seven markets.

The release and Outseer's UK ebook landing page, as accessed on 21 October 2026, do not disclose how many UK respondents fell into each age band, nor the weighting, recruitment method, questionnaire wording or any test of statistical significance. The full report and any technical appendix were not retrieved, so no claim is made here that they lack that detail — only that it is absent from the accessible release and the landing page.

What the figures cannot establish

Outseer's headline describes UK under-25s as ten times more likely than over-65s to have had a bank account taken over. The disclosed data support a tenfold difference in what respondents said within one sample: 21.0 divided by 2.1 is 10, and the arithmetic difference is 18.9 percentage points, both calculated from rounded published figures. They do not establish that young UK adults face ten times the verified incidence of bank account takeover, or ten times the future risk. That is a gap between the headline framing and the underlying disclosure, and it is worth naming.

Four things are missing before the comparison can carry more weight: the unweighted and weighted base for each age group, the recall period respondents were asked about, whether reported incidents were checked against any bank record, and whether the sample was representative of UK adults by age. Subgroup bases should not be reconstructed from rounded percentages, and the uncertainty around the difference cannot be assessed reliably without them. Nor does anything in the material explain why the gap arose. Differences in digital activity, in recall, in how respondents understood the term, and in who joins an online panel are all possibilities to investigate rather than findings.

What it means for bank controls

UK authentication requirements already reach the activity in question. The FCA says strong customer authentication — additional checks that the person accessing an account or making a payment is entitled to do so — applies to online access to a payment account, to electronic payment initiation, and to certain remote actions carrying a risk of fraud, subject to exemptions. The FCA identifies the Payment Services Regulations 2017 and related technical standards as the UK framework, and gives 14 September 2019 as the application date, with phased implementation arrangements around it. Those requirements originated in EU law rather than as a domestic UK initiative, and the FCA page is the authority for the UK position now in force. The same FCA page expects firms to offer authentication methods suitable for all consumer groups, including alternatives for customers without a mobile phone.

That expectation cuts both ways against an age-skewed survey finding. A control tightened for younger customers because a supplier's research suggests higher exposure still has to let older and less digitally equipped customers in. The release carries commentary from Yogesh Patel, identified as Outseer's chief technology officer, and points towards technology responses of the kind Outseer sells. The survey does not test whether those tools reduce takeover, and Outseer has a commercial interest in the conclusion.

Messaging: appeal is not comprehension

Outseer also asked which security message respondents found most appealing. Among UK 18–24s, 5.7% picked the continuous threat-monitoring message against 28.6% of those aged 65 and over, while 36.2% of the younger group picked a message framed around the prevention outcome. Those are stated preferences. A preference for one form of words does not establish that it works, whether measured by what a customer understands, how they behave or how much fraud follows.

For firms in scope, the FCA's Consumer Duty rules require communications that are clear, fair and not misleading and that support customer understanding, and, where appropriate, require firms to test communications and monitor their impact — PRIN 2A.5.3R and PRIN 2A.5.10R, with 31 July 2023 shown as the effective date for the cited provisions and the chapter updated on 26 June 2026. Testing whether a message changes what a customer notices and reports, across age groups, is a different exercise from asking which slogan sounds best. The survey does the second.

The recorded-fraud comparison

Cifas recorded nearly 40,000 facility takeover cases in January–June 2026, a 5% increase on the same period in 2025, in its National Fraud Database. That series covers a broader range of facilities than bank accounts, and it records cases filed by member organisations rather than a representative population sample. It can neither confirm nor contradict Outseer's age-specific percentages, and it carries no matching 18–24 against 65-and-over breakdown for bank takeover. One further wrinkle for anyone citing it precisely: the Cifas page is dated 4 August 2026 while its body refers to release "today (5 August)".

If money has gone

An account takeover is not by itself proof of loss. Where an unauthorised payment has left an account, the FCA's consumer guidance, last updated 15 May 2026, says to contact the bank immediately, that a claim should normally be made within 13 months, and that a refund should normally arrive by the end of the next business day — subject to exceptions, including circumstances in which a bank can refuse. That guidance covers unauthorised payments; payments the customer was tricked into authorising are treated differently. Reimbursement is not automatic in every case.

What to watch

Whether Outseer publishes UK subgroup tables, the questionnaire, the recall period and the agency and panel behind the fieldwork. Whether any UK bank or independent researcher responds to the age comparison; FinTechPulse has not obtained a bank response or an independent assessment, and no enquiry was sent before publication. Customers who think a payment has left their account without authorisation should start with their bank and the FCA's own page on fraudulent payments (opens in a new tab) rather than with any commercial intermediary.