Cybercriminals are increasingly targeting business bank accounts through sophisticated social engineering schemes
Business owners face a growing threat from corporate account takeover (CAT) scams, a type of fraud in which criminals gain unauthorized access to company bank accounts and initiate fraudulent transactions. Financial institutions, including KeyBank, and cybersecurity professionals warn that these attacks are becoming more sophisticated, often combining technology with psychological manipulation to target employees and business leaders.
Corporate account takeover scams can lead to significant financial losses, operational disruption, and reputational damage. In some cases, fraudsters are able to move funds from business accounts within minutes of gaining access.
How Corporate Account Takeover Works
Corporate account takeover occurs when criminals obtain access to a business’s online banking credentials or banking systems. Fraudsters commonly use phone calls, emails, text messages, or fraudulent websites to trick employees into sharing sensitive information, downloading malicious software, or authorizing payments.
“Most account takeovers start with one thing: manufactured urgency. This could take shape as a frantic phone call, an email labeled ‘high Importance,’ or a fake website link that looks like the real thing,” said John Carney, Head of Commercial Operational Risk at KeyBank. “If you feel at all uncertain or suspicious about any communication you receive regarding any of your accounts, slow down, call your banker, and authenticate everything. Don’t let someone else’s false urgency cost your business money.”
Another increasingly common tactic involves phishing websites that closely resemble legitimate bank login pages. Unsuspecting users who enter their credentials on these sites may unknowingly provide fraudsters with direct access to company accounts.
Cybercriminals may also attempt to establish remote access to computers or mobile devices, enabling them to observe banking activity and conduct unauthorized transactions.
A Business Example
One scenario that shows how CAT could be executed involves a business owner who received a phone call from an individual claiming to represent the owner’s bank. The caller stated there was an issue with the company's account and instructed the owner to provide login credentials to resolve the problem. The criminal then uses the access to transfer a substantial amount of money from the business account.
This highlights how some CAT scams often rely on trust and urgency rather than technical hacking alone.
Steps Businesses Can Take to Reduce Risk
While no organization is immune from cybercrime, financial security experts recommend several measures to help protect against account takeover schemes.
- Educate Employees
Employee awareness is one of the strongest defenses against fraud. Businesses should provide regular cybersecurity and fraud-prevention training to help staff recognize phishing attempts, suspicious phone calls, and social engineering tactics. - Verify Identities Independently
Unexpected requests for passwords, account details, software downloads, or payment authorization should be treated with caution. Businesses should independently verify the identity of any individual requesting sensitive information by using trusted contact information rather than links or phone numbers provided during the interaction. - Strengthen Authentication
Companies should use strong, unique passwords for online banking and financial systems. Multifactor authentication (MFA), biometric authentication, and other layered security measures can provide additional protection against unauthorized access. - Access Banking Platforms Directly
Fraud prevention specialists advise businesses to navigate directly to their financial institution’s website by typing the web address into their browser. Users should avoid clicking links from unsolicited emails, text messages, or online advertisements and should not rely on search engine results when accessing online banking services. - Monitor Accounts Frequently
Regularly reviewing account activity can help businesses identify unusual transactions early and respond before additional losses occur. - Consider Cyber Insurance
Cyber insurance policies may help offset financial losses associated with fraud, cyberattacks, and data breaches. Businesses should consult with insurance professionals to determine whether coverage aligns with their risk profile.
What to Do If You Suspect a Scam
Time is critical when responding to a suspected corporate account takeover incident.
Businesses that believe they have been targeted should immediately:
- Contact their bank’s fraud department.
- Request that affected accounts be reviewed or restricted if necessary.
- Change online banking passwords and other potentially compromised credentials.
- Review account activity for unauthorized transactions.
- Monitor business credit reports and related financial records for signs of fraudulent activity.
For KeyBank clients, suspected fraud should be reported immediately to the Fraud Client Service Center at 1-800-433-0124 or 711 for TTY/TRS services.
Acting Quickly Can Limit Losses
As cybercriminals continue to refine their tactics, businesses of all sizes face increased exposure to corporate account takeover scams. Experts say that employee education, cautious verification practices, strong authentication controls, and rapid incident reporting remain among the most effective ways to reduce risk and limit financial losses.
Organizations that build a culture of cybersecurity awareness are better positioned to recognize threats before they become costly incidents.
Stay up to date on the latest scams, common hoaxes, and fraud trends at key.com/fraud.
This material is provided as general information only; the information contained herein may not apply to all situations. Nothing in this material shall be regarded as an offer or solicitation by KeyBank or its affiliates. This is not intended to be a recommendation or advice for your specific situation (including financial, accounting, legal, or tax advice). Consult appropriate professionals for your specific circumstances.
©2026 KeyCorp®. All rights reserved. KeyBank Member FDIC. CFMA 260720-4749128
