Misleading title; it's not pwnage, or at least not known. The customers authorized the agents. The "unauthorized" part is that the bank didn't want customers using agents.

This was the most concerning part of that report for me:

>Some banks also saw agents contact call centers or take actions that appeared independent of user instructions, and executives say they often can't tell a human from an agent, or an authorized agent from a rogue one.