Immediate effects of a compromised business account

When someone gains unauthorized access to your business bank account, money can leave within hours. Fraudsters typically move funds to accounts they control, wire money to other banks, or use your debit card for purchases. The speed depends on what access they have: if they have login credentials, they can initiate transfers immediately; if they have card numbers only, they are limited to point-of-sale transactions and online purchases up to your daily limit.

Your bank will not automatically stop these transactions just because they are fraudulent. Most banks process transfers based on the credentials used, not on whether the person using them is authorized. This means unauthorized transfers can clear before you notice them, leaving your account overdrawn and your business unable to pay payroll, suppliers, or rent.

The damage extends beyond the stolen amount. If your account goes negative, your bank will charge overdraft fees for each transaction that posts after the balance drops below zero. Some banks charge $25 to $35 per overdraft, and a compromised account can rack up dozens in a single day.

Key Takeaways

  • Fraudsters can move money out of a compromised business account within hours, and your bank will not automatically reverse transfers made with valid login credentials.
  • You must report the fraud to your bank within 60 days to have any legal protection under the Electronic Funds Transfer Act, and most banks have shorter internal deadlines.
  • Your bank's fraud liability depends on whether you were negligent — sharing passwords, using unsecured networks, or ignoring suspicious activity can reduce or eliminate your protection.
  • Recovery takes weeks to months because banks investigate before refunding, and some stolen funds may never be recovered if the receiving bank is outside the U.S. or uncooperative.
  • Preventing future compromise requires changing all passwords, enabling multi-factor authentication, reviewing account access logs, and checking for unauthorized users or payment methods added to the account.

What your bank will and will not cover

Federal law under the Electronic Funds Transfer Act limits your liability for unauthorized transfers, but only if you report the fraud promptly and did not contribute to the breach through negligence. If you report within two business days of discovering the fraud, your liability is capped at $50. If you wait longer than two days but report within 60 days, your liability can be up to $500. If you do not report within 60 days, you may lose all protection and be liable for the full amount stolen.

The catch is that banks interpret "negligence" broadly. If you shared your password with an employee who left the company, used the same password across multiple sites, logged in from public Wi-Fi without a VPN, or ignored alerts about suspicious activity, your bank can argue you were negligent and reduce or deny your claim. Some banks require you to prove you took reasonable steps to protect your credentials before they will refund anything.

Business accounts have weaker protections than personal accounts in many cases. Some banks treat business accounts as commercial accounts, which fall under different rules with higher liability thresholds or shorter reporting windows. Read your business account agreement to find the exact fraud liability terms your bank uses — they vary significantly.

The investigation and recovery timeline

After you report fraud, your bank will open an investigation. This does not mean they immediately reverse the transactions. Instead, they gather evidence: they review the IP addresses and devices used to access the account, check whether the transfers match your normal activity patterns, and contact the receiving banks to ask whether the funds are still there.

The investigation typically takes 10 to 30 business days, though complex cases can stretch to 90 days. During this time, your account remains compromised and your funds remain unavailable. Your bank may freeze the account to prevent further unauthorized activity, which also prevents you from making legitimate transactions.

If the receiving bank is another U.S. bank, recovery is more likely. The receiving bank can place a hold on the funds and return them to your bank, which then credits your account. If the funds were sent to an international bank or a bank that does not cooperate, recovery becomes much harder. Many fraudsters deliberately send money to banks in countries with weak fraud enforcement specifically because U.S. banks cannot easily retrieve it.

Even if your bank confirms the fraud and agrees to refund you, the refund does not happen instantly. Transfers between banks take one to three business days. If your business needs cash immediately, you may have to borrow or use a line of credit to cover the gap.

How fraudsters typically gain access

Business accounts are compromised through several common routes. Phishing emails that look like they come from your bank or a trusted vendor trick you into entering your login credentials on a fake website. Malware on an employee's computer captures keystrokes or screenshots, recording passwords as they are typed. Weak passwords or reused passwords from other breached sites allow attackers to guess or crack your credentials. Employees with access who leave on bad terms or have their personal devices compromised can leak credentials intentionally or accidentally.

Compromised email accounts are particularly dangerous because most banks allow password resets through email. If a fraudster gains access to your business email, they can reset your bank password, lock you out, and transfer all your funds before you realize what happened.

Third-party payment processors and accounting software can also be the entry point. If you use QuickBooks, Stripe, PayPal, or another platform to manage payments, and that platform is breached, attackers may gain access to your bank account credentials stored there.

Steps to take immediately after discovering the breach

Call your bank's fraud line right away — do not use the number on your card or website, because fraudsters sometimes intercept calls by redirecting phone numbers. Look up the fraud number from your account statement or the back of an old statement you have on file. Tell them your account is compromised and ask them to freeze it immediately to prevent further unauthorized transfers.

Ask the bank to review all transactions from the past 30 to 90 days and identify which ones were unauthorized. Do not assume you know all the fraudulent activity — sometimes attackers make small test transactions before moving large amounts, or they set up recurring charges you have not noticed yet.

Request a new debit card and new online banking credentials. Do not reuse your old password. Create a new password that is at least 16 characters long, includes uppercase and lowercase letters, numbers, and symbols, and is unique to this account.

File a report with the Federal Trade Commission at IdentityTheft.gov. This creates an official record of the fraud and may help if you need to dispute charges or deal with tax complications later. The FTC report also gives you the right to place a fraud alert on your credit file, which makes it harder for fraudsters to open new accounts in your name.

Protecting your account after a compromise

Enable multi-factor authentication on your business bank account if your bank offers it. This requires a second form of verification — usually a code sent to your phone or generated by an authenticator app — every time someone logs in from a new device. Even if a fraudster has your password, they cannot access your account without this second factor.

Review the list of authorized users and payment methods on your account. Fraudsters sometimes add themselves as a user or add a new debit card or external bank account for transfers. Delete anything you do not recognize immediately.

Check your account access logs if your bank provides them. Most business banking platforms show a list of every login, including the date, time, IP address, and device type. Look for logins from locations or times when you were not accessing the account. If you see suspicious activity, report it to your bank and change your password again.

Set up transaction alerts. Ask your bank to notify you by phone or text whenever a transfer over a certain amount is initiated, or whenever any transfer is made to a new external account. This gives you a chance to stop fraudulent transfers before they clear.

Use a password manager to generate and store unique passwords for every account. Do not write passwords down or share them via email or text. If an employee needs access to the business bank account, use your bank's user permission system to grant limited access rather than sharing your password.

Dealing with tax and accounting complications

If fraudsters stole money from your business account, you may need to file an amended tax return or explain the missing funds to the IRS. Keep detailed records of the fraud: the dates of unauthorized transactions, the amounts, the bank's investigation report, and any refunds received. If your bank refunds part or all of the stolen funds, that refund is not taxable income — it is a correction of a prior loss.

If the theft occurred in a prior tax year and you already filed your return, you may be able to claim a theft loss deduction. Consult a tax professional or accountant before filing anything, because the rules vary depending on whether your business is a sole proprietorship, partnership, S-corp, or C-corp.

Your accountant should also review your books to make sure the fraudulent transactions are recorded correctly. Some accounting software will flag unusual transactions, but manual review is important to catch transfers that were disguised as legitimate payments.

Frequently Asked Questions

Can my bank refuse to refund me if I was negligent?

Yes. If your bank can show you were negligent — for example, you shared your password, used a weak password, or ignored suspicious login alerts — they can reduce or deny your refund claim. The burden is on the bank to prove negligence, but they have broad latitude to define what counts as reasonable security practices.

What if the fraudster transferred money to another bank and it is already gone?

Your bank will contact the receiving bank and ask them to hold the funds pending investigation. If the receiving bank cooperates and the funds are still there, they will be returned. If the funds were already withdrawn or transferred again, recovery becomes much harder. International transfers are especially difficult because foreign banks have no obligation to cooperate with U.S. banks.

Do I have to report the fraud to the police?

You are not legally required to, but filing a police report creates an official record that can help your bank's investigation and may be necessary if you want to claim a theft loss on your taxes. Some police departments will not take a report for financial crimes, so call ahead to ask whether they accept fraud reports.

How long does it take to get my money back?

The investigation takes 10 to 30 business days, and the refund takes another one to three business days after the bank approves it. In total, expect four to six weeks. Complex cases or international transfers can take much longer, and some stolen funds may never be recovered.

Should I close the compromised account and open a new one?

Not immediately. Keep the account open during the investigation so your bank can process the refund to the original account. Once the refund is complete and you have confirmed all fraudulent transactions are resolved, you can close the old account and move to a new one if you want a fresh start.