Corporate account takeover captures a business login, such as banking, payroll, or a supplier portal, and then uses that trusted access to move money or data.
It is the event itself, while the takeover rate is only the metric that counts how often such events succeed.
How it works
The attacker may arrive through a stolen password, a tricked employee, or a mailbox that can reset the business login, and once inside they change payees, add users, or download data while the activity still looks like the real company.
Losses are often larger than in a consumer account because one login can authorize many payments.
Defense centers on strong sign in for financial systems, dual control for payee changes, and alerts the bank and the company both see.
After an incident, assume the attacker read recovery paths and close those paths, not only the password that was first abused.
Concrete examples
- A payroll login is used at night to add a new bank account and to release a supplemental payment run.
- A supplier portal password from an old breach lets an outsider change the bank details the company will pay next month.
- A shared finance login hides which person acted, so the company cannot tell a colleague from an intruder in the log.
Protective measures
- Give every person on financial systems an individual login with a second factor, and remove shared passwords.
- Require two people to approve new payees and payment files, using a channel that is not the same mailbox.
- Alert both your team and your bank when payees, limits, or users change, and make those alerts reach a person.
- After any takeover, reset recovery methods and review recent payees, not only the password on the first account.
Related articles
The article What is an account takeover rate? defines the metric that counts these events rather than describing one takeover.
The article What is business email compromise? explains payment fraud through mail, which can prepare or follow a seized business login.
The article What is authentication in security? covers the sign in checks that a takeover has to defeat or bypass.