Florida-based bank account credentials are increasingly listed for sale on dark web markets and criminal chat apps. FinCEN data shows compromised account reports jumped from 3,702 in 2023 to 5,840 in 2025, with 2026 on pace to break that record. The attack is called account takeover , criminals log in with your stolen credentials and use your account as their own. AI is now making the phishing campaigns that fuel this easier to run at scale.
What Account Takeover Actually Means
The term sounds technical. The reality is straightforward , and genuinely alarming.
Account takeover happens when a criminal gets hold of your bank login credentials , typically through phishing or smishing , and starts using your account from their own device. They don’t necessarily drain it immediately. Many criminals log in, check the balance, and either sell the access to someone else or sit quietly, mimicking your spending patterns, until they’re ready to act.
“We’re talking about a criminal actor essentially taking over your account by logging in after they got your password and username, and simply using your account as their own,” Dr. Maimon explained.
The sophistication here is what makes it dangerous. These aren’t random guesses. The credentials being sold on dark web markets typically come from data breaches, phishing campaigns, or infostealer malware , all producing stolen login combinations that work right now against real, funded bank accounts.
The CRIF Cyber Observatory’s H1 2026 data showed 2.5 billion unique records in circulation on the dark web in just the first six months of this year. Email-and-password combinations appeared together in 95.9% of examined records. Those combinations are the raw material for account takeover.
Florida Is Being Specifically Targeted
Dr. Maimon told WESH 2 he is seeing a specific increase in Florida bank accounts being advertised for sale. This isn’t random geographic distribution. Florida’s large and demographically diverse population , combined with its high concentration of retirees, seasonal residents, and small businesses , makes it an attractive targeting environment for criminals who prefer victims less likely to monitor accounts closely.
Federal data confirms the upward trend. Reports of compromised accounts filed with the Financial Crimes Enforcement Network (FinCEN) show:
- 2022: 3,960 reports
- 2023: 3,702 reports
- 2024: 4,488 reports
- 2025: 5,840 reports
- 2026 (through September only): 5,058 reports
That 2026 figure covers just nine months. The full-year total is tracking well above 6,700 , a 15% increase over 2025’s already elevated level.
FinCEN is the Financial Crimes Enforcement Network, the US Treasury bureau responsible for financial intelligence and anti-money laundering compliance. These are not consumer fraud reports , they’re formal reports from financial institutions about compromised accounts they’ve identified. The real number of affected people is substantially higher.
They’re Not Just Selling Your Login Credentials
This is the detail that WESH 2’s investigation surfaced that most general coverage misses. Dr. Maimon found that criminals selling access to bank accounts are increasingly bundling additional data alongside the credentials.
Remote Desktop Protocol (RDP) access is appearing alongside many bank account listings. RDP is the technology that lets someone control a computer remotely , the same tool IT departments use to log in to work machines from home. When criminals sell RDP access to a victim’s device, the buyer doesn’t just get the credentials. They can literally operate the victim’s computer as if they were sitting at the keyboard, using their saved passwords, their browser sessions, and their IP address to make bank logins look completely legitimate.
This kind of access appears directly in the account takeover infrastructure we covered when looking at how LLM-jacking attacks work , stolen credentials and remote access sessions bundled together as a package. The same criminal markets selling AI service accounts are also selling bank credentials and device access.
Bill payment histories are also being sold. If a criminal knows that you typically pay your electricity bill on the 15th for approximately $180, they can time transactions to avoid triggering fraud alerts that watch for unusual spending patterns. It’s fraud preparation , buying intelligence about how to look like you while they spend your money.
AI Is Making the Phishing That Feeds This Much Easier
Phishing and smishing , deceptive emails and text messages designed to steal your credentials , have been around for decades. What’s changed is who can run them effectively.
Dr. Maimon was direct about this shift. “In the past, in order to launch a phishing campaign, you needed to have some kind of a technical skill. You needed to know how to put together a website. You needed to know how to set up a tool which would allow you to send phishing emails and smishing text in a very high volume. Nowadays, you have AI that essentially helps you to do all that in an automatic way.”
This matches what we’ve tracked across 2026’s fraud landscape. The same AI acceleration Google’s Threat Intelligence Group flagged in September , where every threat actor is now using AI , applies directly to the credential theft that feeds the bank account market. Phishing campaigns are more convincing, more personalised, and faster to deploy than they were two years ago.
Dr. Maimon also noted that some of the activity he tracks appears to originate from outside the United States , Russia and Romania being among the countries he identified. International origin complicates law enforcement investigation and enforcement significantly.
What Banks Are Doing
The Nasdaq Verafin and Q6 Cyber partnership published earlier this year showed exactly why dark web monitoring for banking is now a core capability rather than a nice-to-have. That partnership found an average 10-day gap between a stolen account credential appearing on a dark web market and the first fraudulent transaction , a window that institutions with active monitoring can use to freeze accounts before damage occurs.
The FinCEN trend data suggests most institutions are still closing that gap reactively rather than proactively. The rising report numbers reflect more detection capability , but detection after fraud occurs is not the same as prevention.
What to Do Right Now
Dr. Maimon’s recommendations are practical and specific.
Don’t click links in unexpected texts or emails. This applies even when the message looks like it comes from your bank. Banks send alerts, but they don’t typically ask you to log in by clicking a link in a text. Go directly to your bank’s app or website by typing the address yourself.
Treat unexpected calls about your account with suspicion. A caller knowing your account balance , or your name, or your bank , doesn’t prove they’re from your bank. They may have a dark web listing in front of them. Hang up and call the number on your card or statement.
Check your accounts at least weekly. The earlier a fraudulent transaction is caught, the more options your bank has for recovery. Many fraudsters rely on a victim not noticing for days or weeks. Set up real-time transaction alerts for any amount.
Enable multifactor authentication on your bank account using an authenticator app rather than SMS codes. SMS codes can be intercepted; authenticator app codes cannot.
Report suspected fraud quickly. Contact your bank immediately. File a report with the FTC at IdentityTheft.gov if identity information was misused. Contact the Florida Office of Financial Regulation if you believe a Florida-chartered institution is involved.
For a full checklist on what to do when your personal data may already be in circulation, our dark web exposure response guide walks through the steps in order.
Frequently Asked Questions
How are Florida bank accounts being sold on the dark web?
Criminals obtain login credentials through phishing, smishing, or data breaches, then list those accounts on dark web marketplaces with the victim’s name, bank, and balance visible.
What is account takeover?
Account takeover (ATO) happens when a criminal logs in to your bank account using stolen credentials and uses it as their own , sometimes immediately, sometimes gradually to avoid detection.
How many compromised bank accounts were reported in 2026?
FinCEN received 5,058 compromised account reports through September 2026 alone , on pace to exceed 6,700 for the full year, up from 5,840 in 2025.
Is AI making bank fraud worse?
Yes. Dr. David Maimon of SentiLink notes AI now automates phishing and smishing campaigns that previously required technical expertise, enabling criminals to launch high-volume attacks with far less skill.
What should I do if I think my bank account was compromised?
Call your bank immediately, change your online banking password, enable multifactor authentication, and report identity theft to the FTC at IdentityTheft.gov.
