The most common entry points into a business checking account

Your business checking account was likely hacked through one of four routes: compromised login credentials (username and password), malware on a computer or phone used to access the account, a breach at your bank or payment processor, or social engineering that tricked an employee into revealing access or moving money.

The majority of business account breaches start with stolen credentials. A hacker obtains your username and password through a data breach at another company where you reused the same password, phishing emails that look like they came from your bank, or keylogging malware installed on a device you use for banking. Once they have login details, they can access your account from anywhere, often without triggering alerts because they are logging in from a location or device the bank has not yet flagged as suspicious.

Malware is the second common vector. If a computer or phone you use to access your business account has been infected with spyware, a trojan, or ransomware, the attacker can see everything you type, including passwords and account numbers. Malware typically arrives through infected email attachments, compromised websites, or downloads from untrusted sources.

The third route is a breach at your bank or a third-party payment processor you use. If the bank's systems are compromised, attackers may gain access to account numbers, routing numbers, and sometimes encrypted passwords. This is less common than credential theft but harder for you to prevent directly.

The fourth is social engineering: an attacker calls your business pretending to be from your bank or software vendor, or emails an employee posing as management, and convinces them to reset a password, wire money, or provide account details. This often works because the attacker has already researched your business and knows employee names and titles.

Key Takeaways

  • Most business account hacks begin with stolen login credentials, either from password reuse across websites or from phishing emails designed to look like your bank.
  • Malware on a computer or phone you use for banking can capture passwords and account information without you knowing it is running.
  • Contact your bank immediately if you notice unauthorized transactions; most banks have a window of 30 to 60 days to investigate and reverse fraudulent transfers.
  • Changing your password, enabling multi-factor authentication, and reviewing connected devices and payment methods are the first steps to regain control.
  • Unauthorized ACH transfers and wire transfers are harder to recover than debit card fraud, so act within hours of discovering the breach, not days.

What to do in the first hour after discovering the breach

Stop the bleeding first. Log into your account from a device you trust (ideally one that has not accessed the account before) and change your password immediately. Use a password that is at least 16 characters long, includes uppercase and lowercase letters, numbers, and symbols, and is unique to this account—do not reuse it anywhere else.

Next, call your bank's fraud line directly. Do not use a phone number from an email or text message; look up the number on your bank's website or the back of your debit card. Tell them you have discovered unauthorized activity and ask them to freeze the account temporarily. Most banks can place a hold on outgoing transfers within minutes. Provide the bank with a list of any transactions you did not authorize, including the amounts, dates, and recipient accounts if visible.

Review your account's connected devices and payment methods. In your online banking portal, look for a section called "Devices," "Authorized Devices," "Connected Apps," or "Payment Methods." Remove any device, app, or payment method you do not recognize. If you cannot find this section, call the bank and ask them to walk you through it.

Do not move money out of the account yet, even to a different account you own. The bank needs to see the account in its current state to investigate. Moving funds can complicate the investigation and may delay your refund.

How banks investigate unauthorized transactions and what timeline to expect

Your bank is legally required to investigate claims of unauthorized activity within a specific window. For debit card fraud (fraudulent charges made with your card number), the bank must investigate within 10 business days and resolve the claim within 45 days. For ACH transfers and wire transfers (money moved directly from your account to another bank), the timeline is longer and less certain.

ACH fraud is investigated under the National Automated Clearing House Association (NACHA) rules. Your bank must notify you of the results within 10 business days, but the investigation itself can take 30 to 60 days. Wire transfers are the hardest to recover because once the money leaves your bank, it is in another bank's system, and that bank is not required to reverse the transfer unless they find evidence of fraud on their end. If the receiving bank is outside the United States, recovery becomes even slower and less certain.

During the investigation, the bank will ask you to provide documentation: a statement showing the unauthorized transactions, a written description of what happened, and sometimes a police report or affidavit. Provide this as quickly as possible; delays from your side can extend the investigation timeline.

The bank will also contact the receiving bank (if the money went to another institution) and ask them to hold the funds pending investigation. If the receiving bank cooperates and the funds are still there, recovery is faster. If the money has already been withdrawn or transferred again, recovery becomes much harder and may not happen at all.

Recovering money from unauthorized ACH transfers and wire transfers

ACH transfers are reversible if caught quickly. If you discover the unauthorized transfer within one business day, call your bank and ask them to initiate a reversal immediately. The receiving bank has until the end of the next business day to return the funds. If the receiving bank does not return the money, your bank can file a dispute under NACHA rules, which can take 30 to 60 days to resolve.

Wire transfers are much harder to recover. Unlike ACH, wire transfers are generally considered final once they leave your bank. However, if you report the fraud within hours (not days), your bank can attempt to recall the wire by contacting the receiving bank and asking them to hold or reverse the transfer. This works only if the receiving bank agrees and the funds have not been withdrawn. If the wire went to a bank outside the United States, the receiving bank may not cooperate or may not be able to reverse the transfer under their country's laws.

If the receiving bank is a known fraud recipient (a bank account opened specifically to receive stolen funds), your bank may have a faster recovery process. Some banks participate in fraud recovery networks that flag suspicious accounts and can freeze funds more quickly. Ask your bank whether the receiving account has been flagged for fraud.

If your bank does not recover the money within 60 days, you have the right to file a complaint with the Consumer Financial Protection Bureau (CFPB) or your state's banking regulator. This does not may provide recovery, but it creates a record and may pressure the bank to investigate further.

Securing your account and preventing a second breach

Enable multi-factor authentication (MFA) on your business checking account immediately. This means that even if someone has your password, they cannot log in without a second form of verification—usually a code sent to your phone or generated by an authenticator app. Most banks offer MFA for business accounts; if yours does not, ask why and consider switching banks.

Use an authenticator app (such as Google Authenticator, Microsoft Authenticator, or Authy) rather than SMS text messages for MFA if your bank offers it. Authenticator apps are harder for attackers to intercept than text messages, which can be redirected through SIM swapping or intercepted by malware.

Change the passwords for any other accounts that share the same password as your business checking account. If you reused the password, assume those accounts are compromised too. Use a password manager (such as 1Password, Dashlane, or Bitwarden) to generate and store unique passwords for every account you use.

Scan every computer and phone that has accessed your business account for malware. Use your operating system's built-in security tool (Windows Defender on Windows, Malwarebytes on Mac or Windows) and consider running a full scan with a second tool like Malwarebytes Premium. If you find malware, remove it and change your passwords again from a clean device.

Review your bank's transaction history for the past 90 days. Look for small unauthorized charges (sometimes attackers test stolen credentials with small amounts before making large transfers) and any transfers you do not recognize. Report all of them to your bank.

Protecting employees from social engineering attacks

If an employee's email or phone was used to access the account, or if an employee was tricked into revealing information, train your team on how to recognize social engineering. Attackers often impersonate your bank, the IRS, or software vendors you use. They may call claiming there is a security issue and ask an employee to confirm a password or click a link.

Establish a policy: no one should ever ask for a password over the phone, email, or text message. If someone claims to be from your bank and asks for a password, hang up, look up the bank's number independently, and call them back to verify. If someone claims to be from your company's management and asks an employee to wire money or change account settings, the employee should verify the request through a separate communication channel (call the manager directly, do not reply to the email).

Require employees who have access to banking to use unique, strong passwords and multi-factor authentication on their personal devices. If an employee's personal email or phone is compromised, an attacker can use it to reset your business banking password.

Frequently Asked Questions

How long does it take to get my money back?

Debit card fraud is usually resolved within 45 days. ACH transfers can take 30 to 60 days. Wire transfers are the slowest and hardest to recover; if the receiving bank cooperates, you may see funds within a few days, but if they do not, recovery can take months or may not happen at all. Report the fraud to your bank within 24 hours to maximize your chances.

Am I liable for the unauthorized transactions?

For business checking accounts, liability depends on your bank's policies and the type of fraud. Consumer accounts have stronger protections under federal law, but business accounts vary. Some banks cover all unauthorized transfers if you report them quickly; others limit your liability to a certain amount or require you to prove you were not negligent. Check your account agreement or call your bank to ask about their fraud liability policy.

Should I file a police report?

Yes, if the amount is significant (usually over $1,000). File a report with your local police department or the FBI's Internet Crime Complaint Center (IC3) at ic3.gov. Provide the bank with a copy of the report number; some banks require this to proceed with a full investigation. A police report also creates a record if you need to dispute the charge later.

What if my bank says the transactions were authorized?

Dispute this claim in writing. Send a letter to your bank's fraud department stating that you did not authorize the transactions, provide the dates and amounts, and explain how the account was compromised. Keep a copy for your records. If the bank still refuses to investigate, file a complaint with the CFPB or your state's banking regulator.

Can I sue my bank for not preventing the hack?

Possibly, but it is difficult. You would need to prove the bank was negligent—for example, that they failed to implement standard security measures or ignored obvious signs of fraud. Consult a lawyer who specializes in banking law. Many banks require disputes to go through arbitration rather than court, which is faster but limits your options.