Business bank account fraud rarely starts with someone breaking into your bank. It usually starts inside your own company, with one person who can change payment details and send money without anyone else looking. The fewer people who hold that power, and the more of them who must agree before money leaves, the harder your company is to rob.
Most owners believe they know exactly who can touch the company’s money. In practice, the list is longer than they think, and it grows every year without anyone deciding it should. This article explains where that access comes from, how fraudsters use it, and the few rules that protect a small business without slowing anybody down.
Who Can Actually Reach Your Financial Data
Start with the obvious names: you, your bookkeeper, perhaps a business partner. Then keep going.
Your outside accountant probably has a login to your accounting software. Your payroll provider can see every salary and every employee’s bank account. The office manager may have been given banking access years ago to pay one urgent bill while you were traveling. A contractor who set up your invoicing system might still have a working account. And somewhere in a browser, there may be a saved password that opens the accounting software for anyone who sits at that computer.
None of these people did anything wrong. Access simply piles up as a company grows, one reasonable request at a time. However, it is rarely taken away, because nothing breaks when it stays. That is how a 40-person company ends up with a dozen ways into its money and no single list of them.
Seeing, Changing and Sending Money Are Three Different Risks
It helps to split financial access into three levels, because each one carries a different risk.
Seeing means reading balances, payroll, invoices and vendor records. The risk is exposure: salaries leak, or a fraudster learns which vendors you pay and how much.
Changing means editing a vendor’s bank details, an employee’s direct deposit or a payment amount. This is where most fraud happens, because one quiet edit redirects money that was going to be paid anyway.
Sending means releasing a payment, a wire transfer or a batch of automatic bank transfers. Whoever can send money alone is the last line of defense, whether they know it or not.
Most small companies give the same people all three levels, mainly because it is simpler. As a result, a single tricked or compromised person can complete a fraud from start to finish.
How Business Bank Account Fraud Usually Happens
The most common pattern needs no hacking at all. A vendor you pay every month appears to send an email announcing new bank details. The message looks right, the invoice looks right, and the person who receives it can update the vendor record and approve the next payment. The money goes out on schedule, to the wrong account. Often, the real vendor only calls weeks later to ask why they were never paid.
A second pattern targets payroll. An “employee” emails your office manager asking to change their direct deposit before the next pay run. Because the request is routine, it gets processed, and the next paycheck lands in a criminal’s account.
A third pattern uses urgency. Someone posing as the owner asks for an urgent transfer, often late on a Friday, and insists it must stay confidential. In each case, the weak point is the same: one person who can act on a request without a second check.
The FBI groups these schemes under business email compromise, which simply means fraud that arrives through an email that looks like it came from someone you trust.
What It Costs When the Money Leaves
In its Internet Crime Report for 2025, the FBI recorded 24,768 business email compromise complaints, with reported losses of more than $3 billion. That works out to roughly $123,000 per complaint on average.
Read that average with care. It is pulled upward by a few very large losses, and it only counts victims who reported to the FBI. Many small companies lose less, and many never report at all. Still, for a company with 30 to 60 employees, even a fraction of that amount can wipe out a quarter’s profit or a month of payroll.
Speed matters as much as the amount in business bank account fraud. The sooner your bank hears that a payment was fraudulent, the better the chance of stopping or recovering it. After a few days, the money has usually moved on.
The Principle Behind the Fix: Only the Access Each Job Needs
The American security standards written for businesses and government contractors rest on a simple idea: each person should have only the access their job requires, for as long as they need it, and no more. Security specialists call this least privilege.
For your finances, that means asking a practical question about each person, however much you trust them: which of the three levels, seeing, changing or sending, does their work actually require? In most companies, very few people need all three.
Five Rules That Protect a Small Business Without Slowing It Down
These rules block most business bank account fraud, and none of them requires new software.
- Separate entering from approving. The person who prepares a payment should not be the person who releases it. Most banks and accounting tools can require a second approval, so the setup is usually already there.
- Confirm every change of bank details by phone. Call the vendor or the employee on a number you already had on file, never on the number written in the request. Do this before any money moves.
- Give everyone their own login. Shared passwords for banking, payroll or accounting make it impossible to know who did what, and impossible to remove one person cleanly.
- Require two approvals for large or unusual transfers. Set a dollar amount above which a second person must agree, and apply the same rule to wires and to batches of automatic bank transfers.
- Review the list every quarter, and after every departure. Print who can see, change and send money. Then cross off every name that no longer belongs, including former contractors and test accounts.
Questions to Ask Your Bank, Your Accountant and Your IT Provider
Your bank: Can we require two people to approve a wire or a new payee? Who at our company is currently allowed to send money, and from which logins?
Your accountant or bookkeeper: Who can edit vendor bank details in our accounting software today? Does the system keep a record of who changed what, and when?
Your IT provider: Which of our financial tools still run on a shared login? Is every account that touches banking or payroll protected by a code on the person’s phone, so a stolen password alone is not enough?
The answers will tell you more about your exposure to business bank account fraud than any report. In other words, if nobody can produce the list in a day, the list is the first thing to build.
If a Payment Already Went to the Wrong Account
Call your bank immediately rather than emailing, and ask them to recall the payment and contact the receiving bank. Then file a complaint with the FBI at ic3.gov, because the FBI works with banks to freeze fraudulent transfers when it hears about them quickly.
Next, ask your IT provider to check the mailbox of whoever received the fake request. Fraudsters sometimes take over a real email account and hide their tracks with forwarding rules, which means the scam may not be over. Finally, warn the vendor or employee whose identity was used, so they can alert their own contacts.
A Short List Is the Best Protection
Business bank account fraud succeeds when one person can do everything alone. The fix is mostly organizational: know who can see, change and send money, make sure no single person does all three on a large payment, and confirm every bank-detail change on a number you trust. A short, current list of names protects your company better than most software you could buy.
