Business Banking Account Takeover
- Business banking ATO means someone gets into your bank account, not your customer's.
- Business and consumer ACH debit deadlines differ. Report an unauthorized debit immediately and ask your bank to check the return rules. A later bank warranty claim is a separate route
- Recovery is limited and time-sensitive. Wires are measured in hours, not days.
- Prevention is everything. MFA, dual authorization on transfers, dedicated banking devices, and real-time alerts are non-negotiable.
- Someone changed the payout bank in your Stripe, Square, Shopify or PayPal login? Start here
The ATO page covers someone taking over your customer's account. Credential stuffing, device fingerprinting, session hijacking. That matters, but it isn't the only ATO risk you carry.
This page is about someone getting into your bank account. Your operating account. The one that pays vendors, takes processor settlements, and funds payroll. Different attack surface. Different controls. And far fewer legal protections.
Is the exposed credential a Stripe key? Use the processor-key response for that incident.
How This Differs from Customer ATO
Most fraud content treats ATO as a customer problem. This one is a different animal.
| Dimension | Customer ATO | Business Banking ATO |
|---|---|---|
| Target | Customer's account on your platform | Your business bank account |
| Attacker goal | Make purchases, steal stored value | Wire transfers, ACH debits, drain operating funds |
| Your liability | Depends on the payment, claim and liability-shift rules | Depends on the payment, applicable law, bank agreement and security procedures |
| Recovery options | Chargeback, Reg E dispute, account freeze | Ask the bank immediately about a wire recall or the applicable ACH return route |
| Detection | Your fraud rules, device fingerprinting | Bank alerts, balance monitoring, transaction review |
| Legal framework | Consumer EFT protections may apply; bank error claims and merchant chargebacks differ | For covered payment orders, state UCC Article 4A and the bank agreement; other payment types can differ |
| Loss exposure | Purchases and stored value the attacker can reach | Transfer limits and accessible business funds |
The worst part: your fraud tools probably catch a customer takeover. They aren't even in the picture when it's your own bank account. This one hits the back office.
Attack Vectors
Credential Compromise
The most common vector. Your CFO reuses one password across LinkedIn and your bank portal. LinkedIn gets breached. The attacker tries those credentials at every major bank, and they're in. This isn't hypothetical. Credential stuffing hits banking portals constantly.
Password reuse is the number one risk. Period.
Session Hijacking
The attacker steals a live banking session token. Malware, a compromised browser extension, or a man-in-the-browser attack. The session is already authenticated, so MFA does nothing after login. They ride your session and move money while the real user still looks logged in.
Social Engineering the Bank
The attacker calls your bank pretending to be you. They have your EIN and account number, off a stolen check or statement. They have enough personal detail to pass verification. Then they reset a password, add an authorized user, or wire money by phone.
Ask your bank how it verifies phone requests, new users and payee changes. Bank size alone won't tell you how strong those controls are.
Insider Threats
A departing employee who still has banking credentials. A bookkeeper with full transfer authority and no oversight. An IT admin who can read stored banking passwords. Insiders aren't always malicious. Sometimes it's a compromised laptop handing an outsider the saved credentials.
Shared Logins
"Everyone in accounting uses the same bank login." That's shockingly common in small businesses. Three people on one credential means you can't audit who did what. You can't revoke one person without resetting everybody. And the password ends up in a shared doc or an email.
Why Business Accounts Have Fewer Protections
This is the part most business owners don't know until it's too late.
Reg E vs. UCC Article 4A
Consumer accounts get Regulation E, from the Electronic Fund Transfer Act. Drain a consumer checking account and the bank usually eats the loss. The consumer has to report it within 60 days.
For payment orders governed by UCC Article 4A, an agreed, commercially reasonable security procedure matters. So does whether the bank followed it and accepted the order in good faith. Declining a bank's security feature can hurt your position, but it doesn't settle every loss by itself.
For example, Maine's enacted section 4-1202 requires the bank to prove good faith and compliance with the agreed procedure. Ask counsel which state's law and agreement govern your transfer. Don't assume a phishing incident automatically settles liability.
Wire Irrevocability
Consumer wires have some clawback options. Business wires are hard to reverse once they clear. Domestic wires can clear in hours. Fedwire clears the same business day. An international wire into a non-cooperative jurisdiction can be gone in minutes. Sent one to a fraudster? Call your bank immediately and ask what it can stop or recall. Recovery isn't guaranteed, so speed matters.
ACH Dispute Windows
| Account Type | Unauthorized Debit Return Timing |
|---|---|
| Consumer | About 60 days after settlement (consumer rule) |
| Business | 2 banking days after settlement, R29 (business rule) |
These are the banks' Nacha return deadlines. Regulation E's consumer notice clock starts from the statement. A separate bank authorization-warranty claim can follow the ordinary return deadline. Contact your bank as soon as you spot the debit.
The "Commercially Reasonable Security" Standard
The question isn't just what security the bank offered. For a covered payment order, check the agreed procedure, whether it was commercially reasonable, whether the bank followed it in good faith, and the law governing your agreement. Preserve that evidence for counsel.
Banks document everything they offer you. Decline a security feature and that's evidence against you later.
Prevention Controls
Prevention isn't optional here. Recovery is unreliable at best. Four layers of control.
Authentication
| Control | Why It Matters |
|---|---|
| MFA on every banking login | Non-negotiable. Hardware keys (FIDO2) or authenticator apps - never SMS alone |
| Unique credentials per user | Every person who accesses the bank account gets their own login. No sharing. |
| IP allowlisting | If your bank supports it, restrict login to your office IP and VPN. Blocks attacks from anywhere else. |
| No saved passwords in browsers | Use a password manager. Browser-stored credentials are trivially extractable by malware. |
Authorization
| Control | Why It Matters |
|---|---|
| Dual authorization on transfers | Two different people approve transfers above a limit you set from your cash exposure and normal payment sizes. Ask the bank which transfers and payee changes it covers |
| Daily transfer limits | Cap single-day outbound transfers. If compromised, limits the damage. |
| Positive pay for checks | Bank matches presented checks against your issued check register. Rejects mismatches. |
| Payee allowlisting | Pre-approve ACH destinations. New payees require out-of-band approval. |
Monitoring
| Control | Why It Matters |
|---|---|
| Real-time alerts on all transfers | Email and SMS for every wire, ACH, and check over $0. Not $1,000 - every dollar. |
| Daily balance verification | Someone reviews the balance and recent transactions every business day. Report anything unauthorized immediately; ask the bank which return or recall deadline applies |
| Login alerts | Get notified of every login, failed or successful. Unknown login = immediate lockdown. |
| Statement review within 24 hours | Don't let statements sit. Review them the day they post. |
Operational
| Control | Why It Matters |
|---|---|
| Dedicated banking device | One computer or browser profile used only for banking. No email, no web browsing, no downloads. Eliminates drive-by malware and phishing vectors. |
| Immediate credential revocation | The moment an employee with banking access leaves the company (or gives notice), their access is revoked. Not tomorrow - today. |
| Quarterly access review | Who has access? Do they still need it? Review every 90 days. |
| Separation of duties | The person who initiates a transfer should not be the person who approves it. |
Fintech Banking Specifics
Bank with Mercury, Relay, Bluevine, Brex or similar and the risk profile shifts.
Everything is digital, and everything leans on MFA. No branch to walk into. No banker to call. No physical fallback. Compromise the MFA and they own the account, with nothing in person to stop them.
| Fintech Risk | Mitigation |
|---|---|
| All-digital access | MFA is your only gate - use hardware keys, not SMS |
| API key exposure | If you use banking APIs (for accounting sync, etc.), rotate keys quarterly. A leaked API key is a direct path to your funds. |
| No branch fallback | Compromised account recovery relies entirely on email/phone support, which may be slow |
| Integration tokens | Third-party integrations (QuickBooks, payroll providers) that connect to your bank account create additional access paths. Audit which integrations have access. |
| Session persistence | Many fintech platforms maintain long-lived sessions. Set the shortest session timeout your workflow allows. |
One advantage: fintechs log better and alert faster than traditional banks. Use it. Turn on every alert they offer.
Someone changed the payout bank in your processor account
Your bank login's fine. Someone got into your Stripe, Square, Shopify or PayPal login instead, and pointed your payouts at their own bank account. Sales keep coming in. The money doesn't reach you.
Only received a suspicious request? Check whether it's really your provider before acting on it.
If it's just you, start today. On Shopify, contact Support immediately, then do the steps below if you can:
- Secure your email first. Whoever has it can reset everything else. Square says a takeover only needs your email address and password. Shopify needs your email for any account verification. VENDOR Square, Shopify
- Change the processor password and turn on two-step verification. Type the address yourself. Don't log in from a link in an email. VENDOR PayPal, Stripe. The paths are in the table
- Report it to the processor, using the route in the table
- Check the payout bank on file, then every recent payout. Write down each one that went to an account that isn't yours, with its date and amount. Ask the processor what it can do for each one. Nothing here promises the money comes back
- Then finish First 24 Hours: every other credential, the IC3 report and your insurer
| Lock it | What warns or protects you | Report it | |
|---|---|---|---|
| Stripe | Change the login email and password. Turn on two-step authentication on the Dashboard's Personal details page, and avoid SMS | Your security history records bank account changes. Stripe emails you about logins from unknown IPs and devices | Send the request from the Dashboard once you're logged in. Stripe authenticates support requests |
| Square | Settings > Account & Settings > Personal information > Sign in & security, then Enable under Two-step verification | Changing the linked bank needs two-step verification. A change made in the Square app emails you a link to confirm within 24 hours | Contact Square right away about a change you didn't authorize. Can't get in? Contact Square Support |
| Shopify | Change your password, then review staff accounts and their permissions. Only the store owner can edit Shopify Payments banking | A switch to a new external bank account pauses payouts for 3-5 business days. Payout emails go to your store email address if you've enabled them | Contact Shopify Support immediately if you think the account's been compromised |
| PayPal | Settings > Security, then Set Up under 2-step verification. Change your password | PayPal may send a notice asking you to change your password because of unusual activity. Log in by typing paypal.com before acting on it | Call PayPal if an unauthorized party has accessed your personal data. It can temporarily freeze the account while it investigates. Report a payment you didn't make in the Resolution Center |
VENDOR Stripe security, Stripe two-step, Stripe login alert, Square bank accounts, Square two-step, Shopify Payments setup, PayPal security, PayPal account access, PayPal unauthorized activity
One thing's on your side, with a catch at Shopify. A payout already in transit at Stripe, or already scheduled at Shopify, goes to the old account. At Shopify, if that scheduled payout fails, it retries to the new bank account within 72 hours. Check which payouts actually reached you before you count the loss. VENDOR Stripe payouts FAQ, Shopify Payments setup
Someone else logs in too? Give them their own login, never yours. Shopify says to add staff rather than share your account. On Stripe, a team administrator can require two-step authentication for everyone on Team settings. VENDOR Shopify, Stripe
If You've Been Compromised
Time is the only thing that matters. Every minute counts.
First 30 Minutes
- Call your bank immediately - phone, not email, not chat. Say the business account is compromised. Ask for an emergency freeze on all outbound transfers.
- Request wire recall immediately - ask your bank to contact the receiving bank and attempt a freeze or recall. Don't assume recovery is impossible because the wire settled. IC3 response steps.
- Freeze all ACH origination - stop any pending ACH debits or credits from processing.
- Lock online banking access - have the bank disable online and mobile access while you assess.
First 24 Hours
- Change all credentials - every user's password, every API key, every integration token. Assume everything is compromised.
- Check your processor payout destination - attackers change where your processor sends settlements. Log in and verify the bank account on file. That one can bleed you for days before you notice. Changed? Lock the processor account.
- Review all recent transactions - go back 30 days. Look for small test transfers that came before the big one.
- File an FBI IC3 report at ic3.gov - law enforcement recovery needs it.
- Notify your insurance carrier - cyber policy or crime policy, report it immediately.
Recovery Reality
Don't budget from a general recovery percentage. Ask your bank what it can do for the actual transfer:
| Transfer Type | What to Ask Immediately |
|---|---|
| Domestic wire | Has the receiving bank frozen any funds? Has a recall been sent, and what documents are needed? |
| International wire | Which receiving or intermediary banks can be contacted? What recovery and reporting steps apply in that jurisdiction? |
IC3 says to contact the originating bank as soon as fraud is recognized, then file a detailed report. It doesn't publish the domestic/international odds used here. Recovery isn't guaranteed.
For an unauthorized ACH debit, contact your bank immediately. Ask it to check the ordinary return deadline and any late-return or warranty-claim route. Recovery isn't guaranteed.
Next Steps
Securing your business banking today?
- Enable MFA and dual authorization - These two controls block most attacks
- Set up real-time alerts - Know about every transfer the moment it happens
- Review your current access list - Remove anyone who doesn't need it
Worried about the broader attack surface?
- BEC & Phishing - The most common entry point for business banking compromise
- SMB Banking Integration - How your bank account connects to your payment stack
- Who Owns What - Map your vendor and access relationships
Already been compromised?
- Follow the immediate response steps - Every minute matters
- Survive a Fraud Attack - Full emergency playbook
- ACH Fraud - If ACH was the vector, understand your return options
Related Pages
- Account Takeover (ATO) - Customer-facing ATO: different target, different controls
- BEC & Phishing - Business email compromise as an attack entry point
- ACH Fraud - ACH-specific fraud vectors and return windows
- SMB Banking Integration - How your bank account connects to payments
- Who Owns What - Mapping access and vendor relationships
- Fraud Types Overview - Full fraud taxonomy
- Survive a Fraud Attack - Emergency response playbook
- Identity Verification - Authentication and verification methods
Sources
Processor rows checked on the public U.S. help pages, 22 October 2026.
| Source | What it supports |
|---|---|
| VENDOR Stripe: security | Security history records bank account changes; login emails for unknown IPs and devices; support requests from the Dashboard |
| VENDOR Stripe: enable two-step authentication | Personal details page; avoid SMS; team administrators can require it |
| VENDOR Stripe: unauthorized login attempt | Update the login email and password; enable two-step verification |
| VENDOR Stripe: account security tips | Sign in from a bookmark; don't click links in suspicious emails |
| VENDOR Stripe: bank accounts and payouts FAQ | A payout in transit goes to the previous bank account |
| VENDOR Square: recognize and report suspicious activity | Takeover needs email and password; contact Square about changes you didn't authorize |
| VENDOR Square: link and edit your bank account | Two-step verification to change the bank; 24-hour confirmation link for an app change |
| VENDOR Square: two-step verification | Dashboard path to turn it on |
| VENDOR Shopify: account security best practices | Email needed for verification; contact Support if compromised; staff accounts |
| VENDOR Shopify: configuring Shopify Payments | Owner-only banking edits; 3-5 business day pause; scheduled payouts go to the old account; payout emails |
| VENDOR PayPal: protect your account | 2-step verification path; unusual-activity notices; type paypal.com to log in |
| VENDOR PayPal: unauthorized access to your data | Call PayPal; temporary freeze while it investigates |
| VENDOR PayPal: report unauthorized activity | Resolution Center reporting steps |