Business Banking Security: Controls That Reduce Fraud Risk

Protect the email and identity layer first

A bank account can be compromised without the attacker ever breaking the bank’s systems. If an employee mailbox is taken over, the attacker may capture password resets, imitate vendors or watch payment conversations. CISA therefore recommends multifactor authentication across business systems and favors phishing-resistant methods where possible. Start with administrators, finance staff and anyone who can approve money movement.

Use unique accounts, a password manager and strong recovery procedures. Avoid shared finance logins because they make it difficult to revoke one person’s access or determine who approved an action. Review recovery phone numbers and email addresses as carefully as the primary login credentials because weak recovery methods can bypass otherwise strong authentication.

Finance teams should also review who controls the domain registrar and email administrator accounts. Those systems can become indirect routes into payment fraud if an attacker can redirect messages or create convincing internal accounts.

Reduce privileges to what each role actually needs

Role-based access limits the damage from a stolen credential or an internal error. A bookkeeper who prepares ACH batches may not need authority to release wires. A store manager may need deposit reporting without access to payroll. An accounts-payable employee may need to enter beneficiaries but not approve them.

Review permissions at least when an employee changes roles, leaves the company or receives new treasury responsibilities. Pay special attention to administrators who can add users or raise limits. The number of powerful accounts should be small, and their actions should generate alerts or secondary review.

Use a quarterly entitlement report if the bank provides one. Comparing current users against payroll and job responsibilities is a simple way to catch former employees, duplicated administrators and privileges that were never removed after a temporary project.

Make high-risk payments require independent confirmation

Wire transfers and payment-instruction changes deserve a stricter process because they can be difficult to recover once released. The FTC recommends verification procedures for payment requests and specifically advises businesses not to trust email alone when wire instructions change. Use a known telephone number or another independent channel to confirm a new beneficiary or changed bank details.

For high-value payments, combine callback verification with dual approval and predefined limits. The approver should review the beneficiary, amount and business purpose rather than merely clicking approve. Avoid urgency exceptions such as “the CEO needs it now.” Fraudsters deliberately create pressure because rushed staff are more likely to bypass the normal control.

Create a dollar threshold above which verbal or secondary confirmation is mandatory. The threshold should be low enough to catch meaningful losses but high enough that employees do not become trained to bypass the control during ordinary work.

Harden devices and connections used for banking

Finance workstations should receive prompt software and browser updates, use endpoint protection appropriate to the business and avoid unnecessary administrator privileges. CISA’s small-business guidance emphasizes software updates, backups, strong authentication and logging as core practices. If remote access is allowed, protect it with strong MFA and restrict it to managed devices where practical.

Treat public or unmanaged computers as unsuitable for treasury activity. A dedicated or tightly managed finance device reduces exposure to browser extensions, credential-stealing malware and unrelated downloads. Keep backups of accounting and payment records so ransomware does not force the company to choose between operations and data recovery.

Where practical, separate everyday browsing from the workstation used for bank administration. Reducing the number of websites, extensions and downloaded files on a finance device decreases the number of opportunities for credential theft or malicious software.

Use bank alerts and reconciliation as detection controls

Prevention will never be perfect, so the company needs to detect unusual activity quickly. Configure alerts for large payments, new recipients, password changes, profile edits and failed login patterns when the bank offers them. Send critical alerts to more than one responsible person so one compromised mailbox does not suppress the warning.

Reconcile bank activity to the accounting system frequently. A monthly close is not enough for a company moving large daily amounts. Review outstanding checks, unmatched ACH items and unusual merchant settlements. The shorter the detection window, the greater the chance the bank can still assist with a recall or freeze.

Alerts need escalation rules. A high value transfer alert sent at 4:45 p.m. is useful only if someone knows who must review it, how quickly they must respond and what action to take if the payment is unexpected.

Test the incident response process

Write down who calls the bank, who disables user access, who preserves evidence and who communicates with vendors if a payment account is compromised. The FBI recommends contacting the financial institution immediately after discovering a fraudulent transfer and requesting a recall. Employees should not have to search for the fraud department number during an incident.

Run a tabletop exercise using a realistic scenario such as a vendor email that changes wiring instructions or an administrator account that receives an unexpected MFA prompt. Test whether staff know how to stop the payment, preserve the evidence and switch to a backup payment path. A plan that has never been rehearsed is likely to fail at the exact moment speed matters most.

After an exercise, record what failed and assign corrective actions. A tabletop test is valuable only if it changes passwords, permissions, contact lists, backup access or approval procedures before the next real incident.

Editorial Verdict

Sources

• CISA multifactor authentication guidance
• CISA small and medium business cybersecurity resources
• FTC cybersecurity for small business
• FBI IC3 Business Email Compromise advisory

Primary and regulatory sources were checked for this update. Product-specific bank requirements can change after publication.