According to the Federal Reserve, account takeover reports filed with the Financial Crimes Enforcement Network (FinCEN) rose more than 36% in 2024 compared to 2023, a sharp climb that puts every organization moving money electronically on notice. That kind of growth signals that attackers have found reliable ways past the defenses businesses already have in place, and the losses that follow rarely come back.
The organizations most at risk for corporate account takeover are often the ones that assume the bank, the email provider, or a single control already protects them. When a criminal gains control, money can leave in the time it takes to notice a missing confirmation. The danger often lies in the gaps between safeguards that appear sound on their own.
This guide walks through how these attacks progress, the layered controls that keep them from succeeding, the signals that expose one already under way, and the response steps that decide whether the money comes back.
Key Takeaways
A corporate account takeover unfolds as a sequence, from stolen credentials or hijacked sessions through quiet persistence to fraudulent payments, and every stage gives defenders a place to break the chain.
Layered prevention pairs phishing-resistant identity controls with payment approvals that no single compromised person, device, or session can complete alone.
Detection works when identity, email, session, and payment signals are read together, because a new login or a new payee looks routine until it appears next to the other.
Response is a race measured in minutes. Fund recall and technical containment must run in parallel.
What Is Corporate Account Takeover?
Corporate account takeover (CATO) is business identity theft in which criminals obtain an employee's valid credentials or authenticated session and operate the company's bank, payroll, or email accounts as that employee. Once inside, they add fake payees or reroute direct deposits, then originate Automated Clearing House (ACH) batches and wire transfers to accounts they control. Any organization that moves money electronically is a target: companies of every size, municipalities, school districts, and large nonprofits.
CATO differs from consumer account takeover in what happens afterward: a consumer whose account is drained has federal liability caps and mandatory error resolution behind them, while a business generally does not, so whatever the bank cannot claw back stays with the business. It also differs from business email compromise (BEC), where the criminal impersonates an executive or vendor and persuades an employee to send the money. In CATO the criminal holds the keys and sends it personally, and a compromised mailbox is a common starting point for both.
How Does a Corporate Account Takeover Attack Happen?
A CATO attack moves from initial access through expanded control and persistence to monetization, and the stages depend on each other closely enough that interrupting one ends the attack.
Gaining Initial Access Through Credentials or Sessions
Phishing email attacks and pretext calls harvest passwords outright, credential stuffing attacks and password spraying replay leaked and common passwords, and infostealer malware tools collect saved browser passwords along with session cookies. Increasingly the prize is the session rather than the password. An adversary-in-the-middle (AiTM) phishing page relays the user's one-time code to the real login page and captures the cookie issued after multi-factor authentication (MFA) succeeds.
MFA fatigue attacks flood a user with approval prompts until one gets tapped, and subscriber identity module (SIM) swapping moves a phone number to the attacker's device. Phishing and push bombing can bypass weaker MFA methods. SIM swap attacks can do the same. Open Authorization (OAuth) consent abuse skips credentials entirely: a user approves a malicious application, which then holds its own token to the mailbox.
Expanding Access and Establishing Persistence
Attackers commonly watch a compromised mailbox for days or weeks before using the access, learning payment and approval patterns, including vendor names. During that time they may create a mail forwarding rule that sends copies of messages to an outside address and keeps working after a password reset, or register a new MFA method under their control that survives a forced re-enrollment. If the account can administer others, the attacker may also grant a role that edits payment templates or approves transfers. Each of these moves leaves an audit event behind, the raw material for detection later.
Redirecting Payments and Moving Stolen Funds
The attacker adds a new payee or edits a vendor template, sends a small test payment, often a dollar, to confirm the route works, then pushes ACH batches or wires through in a single afternoon, sized to fit under the account's limits. Payroll diversion is a quieter variant: a change to one employee's direct deposit details sends that paycheck to the criminal.
Corporate Account Takeover Best Practices for Layered Prevention
No single safeguard prevents CATO, because an attacker blocked at the identity layer can pivot to a stolen session, and one blocked there can still talk a person into approving a payment.
Identity Controls That Resist Credential and MFA Attacks
MFA that cannot be phished is the strongest identity control. Options include Fast Identity Online (FIDO)/Web Authentication (WebAuthn) authenticators such as passkeys and hardware security keys, or public key infrastructure (PKI)-based certificates. These bind each login to the real site's domain, so an AiTM page cannot relay it, and they leave nothing for the other bypass techniques: no code to type into a fake form, no push prompt to bomb, no text message to intercept after a SIM swap. Any authenticator whose output a user types in by hand, including app and text codes, does not count as phishing-resistant. Where app-based push remains in use, number matching at least blunts push bombing.
Authentication decides who gets in; the rest of the identity layer decides what a compromised account can do and for how long. Role-based access and just-in-time elevation keep payment-template rights out of standing use, and access comes off promptly when staff or contractors leave. Because stolen session cookies can let attackers authenticate to web applications without completing the normal login flow and can bypass some MFA controls, access should be granted per session with the least privilege necessary, with well-defined session lifetimes, periodic reauthentication based on risk and assurance level, and revocation when risk increases.
Restricting which applications users may approve and auditing existing OAuth consents closes a door password resets leave open. Password policies should screen passwords against known-compromised lists and avoid calendar-based rotation.
Payment Controls That Prevent One-Person Fraud
Payment controls assume the identity layer has already failed, so they stop one compromised person, device, or session from moving money alone. Dual authorization, with one employee initiating a payment and a second approving it from a different device, forces the attacker to complete two takeovers instead of one. Segregation of duties extends that to who may create payees, edit templates, and release files, while per-user and daily dollar limits cap what any single session can send.
At the bank, positive pay stops unexpected debits from clearing. ACH debit blocks and debit filters do the same. Out-of-band verification adds a channel the attacker does not hold, such as a callback to a number already on file. A dedicated banking computer that does nothing else, including email, keeps malware off the machine that touches the money, and daily reconciliation surfaces the test payment while a recall is still realistic.
Operational Controls That Reinforce Secure Decisions
Operational controls make the technical layers hold when a person has to decide. A written payment-change procedure that confirms new bank details by calling a number already on file, never one supplied in the request, turns a judgment call into a routine, and a code phrase shared with regular vendors adds a check voice cloning cannot pass.
A no-blame reporting culture, where an employee can flag a suspicious message without penalty, buys the security team hours. Training belongs behind those authorization controls, since attention lapses defeat knowledge. Finance and payroll staff should receive role-specific sessions, and help desk staff need training suited to their work. A generic annual module does not address those needs.
Vendor due diligence covers the payment processors and platforms that hold company credentials or payment files, and the customer agreement with the bank records which security procedures the business has accepted.
How to Detect a Corporate Account Takeover Attack in Progress
CATO becomes detectable when identity, communication, session, and payment anomalies are evaluated together in one view.
Identity and Session Signals That Indicate Unauthorized Access
The first signals appear in sign-in and directory logs:
A login from a device or network the account has never used can indicate unauthorized access.
Two logins hours apart from places no traveler could connect can reveal impossible travel.
A payroll clerk active at three in the morning may indicate unusual account activity.
A burst of MFA prompts the user did not request is push bombing under way.
A newly registered or disabled MFA method is the attacker planting a key.
A valid token used from an unfamiliar location can point to stolen authenticated sessions.
Unexpected privilege grants and new accounts can indicate that the attacker is expanding access.
Each of these has an innocent explanation on its own, a new phone or a real trip; an unfamiliar sign-in followed within the hour by an MFA change has almost none, which is why these alerts belong in one view with the email and payment signals below.
Email and Payment Signals That Indicate Fraud Preparation
Email and payment systems show the attacker preparing to cash out. A new forwarding rule, particularly one sending mail outside the organization, is an indicator of a compromised business mailbox. On the banking side, a new payee or a change to vendor payment details can signal a redirection under way. That change may appear as an edited vendor template or a request to update the vendor's bank details. A small transaction at an unusual hour is a route test.
Deviations from the account's own history provide the strongest payment signal. A company that runs payroll on the same day, from the same network, in roughly the same amount produces an obvious outlier when transfers to new recipients appear midweek. Baselines built per account let a bank or treasury team hold a payment for a phone call.
Why Time-Critical Response and Recovery After Corporate Account Takeover Is Essential
Financial recovery and technical containment must begin the moment fraud is suspected and run in parallel, because finishing one before starting the other costs money on one track and access on the other.
Contacting Financial Institutions and Reporting the Fraud
The first call goes to the bank, by phone, before anyone has confirmed exactly what happened. Current IC3 fraud guidance is blunt: "Time is of the essence. First, contact your financial institution and request a recall of the funds along with any necessary indemnification documents." The originating bank then contacts the receiving bank, which can freeze funds that have not yet moved on, and an IC3 complaint filed within hours brings in the FBI's Recovery Asset Team, which can ask a domestic recipient bank to hold the account. Funds already forwarded or wired abroad are far harder to reach.
Alongside those steps, the organization notifies its FBI field office or local law enforcement, escalates to leadership and legal counsel, and logs every call, reference number, and transaction identifier.
Containing Access and Restoring Trusted Operations
While treasury works the phones, the technical team disables the compromised business accounts and revokes the password and every active session and token, because stolen cookies and OAuth consent grants survive a reset. The computer used for banking comes off the network, and the team exports the relevant sign-in, mailbox, and banking logs before anything is wiped. Forwarding rules, MFA methods registered during the compromise window, new accounts and changed access rights, and edited wire or ACH templates all need to be found and reversed against a known-good copy.
Before reopening, teams should test systems and security controls to confirm normal operation. Eradication and a lessons-learned review that adjusts the controls above close the cycle.
How Liability and Governance Shape Corporate Account Takeover Outcomes
Who absorbs a CATO loss depends on the security procedures the business agreed to with its bank and whether it followed them.
Commercially Reasonable Security for Business Payments
Regulation E, the rule that caps a consumer's liability for unauthorized electronic transfers, applies only to accounts established primarily for personal, family, or household purposes, and business accounts fall outside it. Commercial wires and ACH payments are governed instead by Article 4A of the Uniform Commercial Code (UCC), which treats a payment order as the customer's own, "whether or not authorized," when the bank's security procedure was a commercially reasonable method of guarding against unauthorized orders and the bank accepted the order in good faith and in compliance with that procedure.
A security procedure under Article 4A is one established by agreement between customer and bank, so the controls a business accepts or declines when it signs up for online banking directly shape who bears the loss. A Federal Deposit Insurance Corporation (FDIC) cyber fraud case study found the bank liable because the fraudulent ACH activity was completely out of character for the account and its procedures had not caught it. Article 4A also expects the customer to use ordinary care to discover erroneous payment orders and tell the bank within 90 days of notification, which gives daily reconciliation a legal role too.
Governance Across the Full Control Lifecycle
The controls in this article map onto the six functions of the National Institute of Standards and Technology (NIST) Cybersecurity Framework 2.0, which places Govern at the center: risk appetite for payment fraud, policies on credential use and payment authorization, board reporting, and oversight of the processors that touch company funds. Identify rates each account and payment type by exposure, and Protect, Detect, Respond, and Recover hold the controls, the combined monitoring, the playbook, and the validation before production access resumes.
Building a Control System That Holds Up Under Pressure
Every technique in a takeover exploits the seam between two safeguards: a phished code and a push prompt, a stolen cookie and a standing approval right, a convincing phone call and a payment procedure nobody wrote down. Tracing one fake payment change through your organization's real path, from inbox to released wire, shows where that handoff is missing. Prevention that holds treats identity, payments, people, detection, and recovery as one system with agreed handoffs.
Frequently Asked Questions
What Is the Difference Between Corporate Account Takeover and BEC?
In CATO, the criminal controls the account and executes transactions. In BEC, the criminal impersonates a trusted person so an employee carries out the instructions. A hijacked mailbox can support either attack, so the defenses overlap.
Can Multi-Factor Authentication Prevent Corporate Account Takeover?
MFA raises the bar against credential theft, but some methods remain vulnerable to phishing and session theft. Phishing-resistant authenticators reduce that risk, while session limits and dual payment approval provide additional safeguards.
Who Is Liable for Fraudulent Transfers From a Business Account?
Business accounts generally fall outside consumer protections. Under UCC Article 4A, the business generally bears the loss when the bank followed an agreed, commercially reasonable security procedure in good faith, though the agreement and facts determine the outcome.
What Should a Business Do First After Discovering an Account Takeover?
The first priority is contacting the bank immediately to request a recall of the funds, followed by filing an IC3 complaint. At the same time, the technical team can disable the compromised accounts, revoke sessions and tokens, and preserve logs and disk images before cleanup begins.