What every business should know about corporate account takeover

What is Corporate account takeover (CAT)?

Corporate account takeover is a form of business identity theft and a common tactic in financial fraud. It’s also one of the top fraud trends you should watch out for.

Here’s how it works.

The fraudster either steals account credentials or manipulates an employee into divulging their log-in IDs or passwords. The criminal then uses the credentials to install malware or take direct control of the company’s bank account — essentially allowing them free rein to transfer funds, make unauthorized transactions, create fake invoices and payments to themselves, or manipulate financial data for their own benefit.

Why would an employee share their credentials?

Because fraudsters are skilled in the art of deception. They’ll contact an employee, usually by phone, and convincingly pose as a reputable business associate, such as a KeyBank representative. They’ll create a sense of panic by fabricating an urgent situation — typically about fraudulent activity on the business’s accounts. Then they’ll ask the employee to provide sensitive information, such as log-in credentials, so they can immediately "correct" the issue before there are dire financial consequences.

The second the employee provides this information, your business becomes a victim.

Fraudsters are using increasingly deceptive tactics — such as phone number spoofing, where the phone number they are calling from falsely shows up in caller ID as KeyBank or another reputable entity.

Details like this make their efforts appear more legitimate. And when combined with a sense of urgency and pressure to make split-second decisions — unfortunately, they often work.
 

How can I protect my business from CAT?

As with most types of business fraud, preventing CAT is a shared effort among all employees. Here are some measures your business can take to help avoid becoming a victim:

• Build awareness and educate employees about CAT and associated tactics such as phone number spoofing. 
• Never share sensitive information, including log-in IDs, passwords, or one-time passcodes.
• Be cautious of all unexpected phone calls requesting information — and watch for these red flags:
  • Urgent situation and pressure to act quickly
  • Requests for sensitive information
  • Claims of suspected fraud or that you need to authenticate or unlock your account
• Hang up on a suspicious caller and verify the situation immediately by calling a known phone number or contact at the business or financial institution.
• Report to us immediately any suspicious calls about your KeyBank accounts.
• Invest in continuous education to stay on top of emerging fraud tactics and trends.