A corporate account takeover policy is the bank's written approach to criminals who seize a business customer's online banking, usually by stealing an employee's credentials, and send wires or ACH payments to accounts they control. It matters more than its consumer equivalent because the law is different: Regulation E protects consumer accounts, so a business takeover is decided under Article 4A of the Uniform Commercial Code, where a bank that accepted a payment order in good faith under a "commercially reasonable" security procedure the customer agreed to can leave the loss with the customer. The policy, the security procedures it offers and the customer agreement it requires are therefore the evidence that decides who pays. Botminds' Account Takeover Fraud Prevention supplies the part of that evidence that is hardest to produce after the fact: what the bank's monitoring showed, who looked at it and when they acted.
Examples from the solution on this page are sample data on fictional people at a fictional bank, Corvane National Bank. The law is quoted from the official text of the Uniform Commercial Code; states enact it with variations, so this page is not legal advice.
What is corporate account takeover? A business's banking, run by someone else
Corporate account takeover is a takeover of a business, non-profit or public body's online banking, typically to send wires or ACH credits. Texas's bank supervisor defines account takeover as "a form of identity theft where cyber thieves gain control of a business' or individual's bank account by stealing Internet banking passwords and other valid credentials", after which "Thieves can then initiate fraudulent wire and ACH transactions to accounts they control" (Texas Department of Banking, Supervisory Memorandum 1029, 2019).
Business accounts differ from consumer ones in ways that change the risk. They send larger and more frequent payments, often through ACH batches and wire templates; several employees hold credentials; and an administrator at the customer can add users, payees and limits. Texas's memorandum adds that "Businesses and individuals with limited or no internal computer safeguards and disbursement controls are especially vulnerable." FinCEN, in its account takeover advisory, makes a point that applies especially here: in an account takeover "the customer, rather than the financial institution maintaining the account, is the primary target" (FinCEN Advisory FIN-2011-A016).
Does Reg E apply to business accounts? No, and that changes the whole question
No. Regulation E applies only to accounts a person holds mainly for personal, family or household use (12 CFR 1005.2(b)(1)), so a business that loses money in a takeover has none of the consumer liability caps. Article 4A, in turn, applies to funds transfers except those governed by the Electronic Fund Transfer Act (UCC §4A-108). For a business's wires and ACH credits, Article 4A is the law that decides.
The difference in outcome can be total. A consumer who reports a takeover promptly usually bears at most $50, as the guide to Reg E and account takeover explains. A business whose bank followed a commercially reasonable procedure in good faith can bear the whole loss. Which of those two worlds an account sits in should be settled at account opening, recorded, and reflected in the security procedures offered.
Who is liable for corporate account takeover? The security procedure decides
Under Article 4A, a business bears the loss from a fraudulent payment order if three things are true: it agreed with the bank on a security procedure; the procedure is a commercially reasonable defence against unauthorized payment orders; and the bank "proves that it accepted the payment order in good faith and in compliance with the security procedure and any written agreement or instruction of the customer restricting acceptance of payment orders" (UCC §4A-202(b)). If any of them fails, the bank must refund the payment, with interest from the date it received payment (UCC §4A-204).
The customer has one more route. Even where the procedure was reasonable and followed, the bank cannot keep the payment "if the customer proves that the order was not caused, directly or indirectly, by a person" entrusted with its payment duties, or by someone who got access to the customer's systems or obtained, "from a source controlled by the customer", the information needed to breach the procedure (UCC §4A-203(a)(2)). In practice that is a hard proof for a business whose employee's computer was infected, which is the usual takeover.
One limit applies to every policy: the rights and obligations in these sections "may not be varied by agreement", except that the bank may, by express written agreement, limit how much of a verified order it is entitled to enforce. A customer agreement cannot simply declare that the business bears every loss; it can only record the procedure and the customer's choices that the statute then weighs.
What is a commercially reasonable security procedure? The four things a court weighs
Commercial reasonableness is a question of law for the judge, not the jury. The court weighs what the customer told the bank it wanted, what the bank knew about the customer, including the size, type and frequency of its usual payment orders, the other procedures the bank offered, and what similar customers and banks generally use (UCC §4A-202(c); the wire fraud liability guide quotes the section in full).
The same subsection gives banks a safe harbour that every corporate policy should use deliberately. A procedure "is deemed to be commercially reasonable" if the customer chose it after the bank offered, and the customer refused, a procedure that was commercially reasonable for that customer, and the customer "expressly agreed in writing to be bound by any payment order, whether or not authorized, issued in its name and accepted by the bank in compliance with the security procedure chosen by the customer." The policy has to make the offer real, and the refusal written.
Two cases that drew the line: Patco and Choice Escrow
Two federal appeals decisions show how the factors play out, one for the customer and one for the bank. Both involved stolen credentials and commercial online banking; they differ in what the bank did with what it knew, and what the customer was offered and refused.
Patco Construction (1st Cir. 2012) and Choice Escrow (8th Cir. 2014): what decided each corporate takeover
Patco v. People's United Bank: Six withdrawals over seven days in May 2009, $588,851.26; $243,406.83 blocked or recovered
Choice Escrow v. BancorpSouth: One $440,000 wire on 17 March 2010 to a bank in Cyprus
Patco v. People's United Bank: Criminals supplied an employee's ID, password and answers to her challenge questions
Choice Escrow v. BancorpSouth: A virus on an employee's computer gave a third party the username and password and let it mimic the computer's IP address and settings
Patco v. People's United Bank: Flagged each withdrawal as unusually high-risk; nobody at the bank reviewed it or told the customer
Choice Escrow v. BancorpSouth: Password prompts and device authentication, both defeated by the mimicked computer; daily limits and dual control on offer
Patco v. People's United Bank: A system that asked challenge questions on every transaction over $1
Choice Escrow v. BancorpSouth: Dual control, offered twice and declined in writing; daily transfer limits, declined
Patco v. People's United Bank: Bank's procedure commercially unreasonable; summary judgment for the bank reversed and remanded
Choice Escrow v. BancorpSouth: Bank's procedures commercially reasonable; loss stays with the customer
Patco v. People's United Bank: Monitoring that nobody reads, and a control turned so high it leaks answers, can fail together
Choice Escrow v. BancorpSouth: An offered, refused and documented stronger procedure protects the bank
Patco turned on a combination. By lowering the trigger for challenge questions to $1, the court said, the bank "did substantially increase the risk of fraud by asking for security answers for every $1 transaction", because answers typed so often were exposed to keyloggers; then, "when it had warning that such fraud was likely occurring in a given transaction, Ocean Bank neither monitored that transaction nor provided notice to customers". The court was explicit that "it was these collective failures taken as a whole, rather than any single failure, which rendered Ocean Bank's security system commercially unreasonable" (Patco, 1st Cir. 2012). It left open what obligations Article 4A places on the customer.
Choice Escrow turned on a refusal. When the bank offered dual control a second time, the customer replied that it would be "really tough unless we all shared pass words", and signed a waiver. The court set out the rule: if the customer "declines to use that procedure and agrees in writing to be bound by payment orders issued in its name and accepted by the bank in accordance with another security procedure, then the customer will bear the risk of loss from a fraudulent payment order if the declined procedure was commercially reasonable" (Choice Escrow, 8th Cir. 2014).
What should a corporate account takeover policy include? Eight sections, each deciding something
A corporate account takeover policy should cover the risk assessment, the security procedures offered by customer type, the customer agreement, monitoring and who reads it, response, customer education and board oversight. Each section produces evidence for one of the questions Article 4A asks. The Frame sets them out with what each one decides.
A corporate account takeover policy, section by section, and what each section decides when a loss is disputed
1
Scope and definitions
Which customers and channels are covered: online banking, file transmission, wires, ACH origination, and phone or email instructions; what counts as a takeover.
What it decidesWhether a loss from a phone instruction or an email is inside the policy at all
2
Risk assessment and customer rating
Every business customer that sends payments rated by volume, value, payment types and controls in use; the rating drives limits and the procedures offered.
What it decidesThe "circumstances of the customer known to the bank" that commercial reasonableness turns on
3
The security procedure offered, and the customer's choice
The procedures offered by rating (dual control, out-of-band confirmation, limits, device and payee controls), and a signed refusal when a customer declines one.
What it decidesUnder UCC 4A-202, whether the business or the bank carries a loss on a verified order
4
The customer agreement
Roles, minimum customer security, exposure limits, the bank's right not to honor a suspicious order, authorised users, and how disputes are settled.
What it decidesWhat the customer agreed to, in writing, before the theft
5
Monitoring, and who reads it
Which login and transaction anomalies are monitored, who reviews alerts, how fast, and when a payment is held for confirmation.
What it decidesWhether the bank acted on what its own system showed
6
Response
Verify with the customer on a known contact, attempt reversal, notify receiving banks, preserve evidence, file where required, and keep records of every call.
What it decidesHow much is recovered, and the evidence of good faith
7
Customer education
Security practices for business users, warning signs of a compromised computer, and how the bank will and will not contact them.
What it decidesWhat the customer was told to do, and when
8
Board reporting and annual review
Account takeover risks reported to the board; vendors asked yearly for new controls; the policy reviewed after every material incident.
What it decidesWhether the procedure stayed reasonable as attacks changed
Texas is the only state supervisor that has written account-takeover minimums this specifically, and its standards are a useful skeleton even outside Texas. Its memorandum says "Bank management and the board of directors must address each of these nineteen components in a risk management program to mitigate the risk of an account takeover", while leaving banks free to "adopt any practices to implement the components".
Texas's nineteen account-takeover components, grouped as Protect, Detect and Respond
| Group | Components | What examiners in Texas look for |
|---|---|---|
| Protect (8) | Expand the risk assessment; rate each customer that transacts online; outline takeover issues to the board; communicate security practices to business customers; customer awareness education; bank controls against takeover; review customer agreements; ask vendors about controls | A rated customer list, controls matched to ratings, and reviewed agreements |
| Detect (3) | Automated or manual monitoring; train employees on warning signs; educate account holders on signs of compromise | Monitoring that flags login and transaction anomalies, and staff who know the red flags |
| Respond (8) | Update incident response plans; verify suspicious transactions immediately; attempt reversal immediately; notify Nacha where required; notify receiving banks and ask them to hold funds; contingency plans for compromised systems; contact law enforcement and regulators; customer relations and documentation of recovery | A tested plan with named contacts, and records of every recovery call |
The customer agreement: seven clauses counsel should review
The agreement is where a business accepts, or declines, the procedure the bank offered, and where its own duties are written down. Texas's task force recommends that "banks should have legal counsel that is familiar with corporate account takeover risks review their written agreements" and lists what to consider.
Clauses for a business online banking agreement, from the Texas task force's best practices
- Roles and responsibilities
For processing transaction requests and for resolving disputes.
- Minimum customer security standards
What the business must do on its own computers and with its users; the agreement can also list the security procedures offered.
- No list is foolproof
An acknowledgement that no set of security practices can prevent every theft.
- Exposure limits
Transaction limits, frequencies and payment types for the customer's normal business, how limits change, and the bank's right not to honor a request it believes is fraudulent.
- Where the risk of loss sits
That the account holder bears a loss from a fraudulent order the bank accepted in compliance with its security procedures, absent a warranty or indemnity.
- Authorized users
The employees allowed to initiate files, or the customer's acknowledgement of responsibility where it administers its own users.
- Settling disputes
Arbitration, or warranties or indemnification for customers who follow specified practices.
Choice Escrow shows why the refusal belongs in the file. The bank's records showed dual control offered, explained and declined in writing, and a waiver signed. A policy that requires the offer to be repeated when a customer's activity grows, and the refusal to be re-signed, keeps that record current.
What is dual control for business payments? A second, independent person
Dual control requires a second authorized user, on separate credentials, to approve a payment before it is released. The FFIEC lists it among customer controls: "Controls are available to business customers to require more than one employee to authorize and approve certain transactions" (FFIEC 2021, Appendix). It is effective against takeover because a criminal who has one employee's credentials does not automatically have a second's.
The Eighth Circuit described the effect precisely: with dual control, "a customer's account remains secure even if a third party manages to obtain an employee's password and IP address; to issue a payment order, that third party would have to obtain a second, wholly independent set of identifying information." The FFIEC's appendix pairs it with supplementary controls for a business's own system administrators, who can add users and change limits, and with positive pay and debit blocks. A policy should say which of these are offered to which customer ratings, and require a written choice.
How do banks protect business online banking? Monitoring that someone reads, in time
Banks protect business online banking with layered procedures and with monitoring that a person reviews before the payment settles. Patco is the warning: the bank's system flagged every fraudulent withdrawal as high-risk, and no one acted. Texas's best practices list the red flags to watch on business accounts, including new users, new payees in ACH batches or wire templates, changed notification settings and changes to the account and routing numbers of existing payees.
For a business account, the protective action is usually to hold the payment and confirm it with an authorized person at the customer on a number the bank already holds. In Account Takeover Fraud Prevention, the hold-window agent orders the queue by the wire cutoff or ACH batch, asks for a decision 20 minutes before the window closes and escalates at 15; a hold past the window needs a supervisor, and nobody checks their own request. Every one of those steps is time-stamped with who did it and why, which is the evidence of good faith that Article 4A asks a bank to prove.
A protective hold in Account Takeover Fraud Prevention, with the time, the person and the checker
Limits work only if someone notices when a criminal designs around them. In the sample case the transfer was $9,750.00, just under the $10,000 daily limit for new payees, which the strip records as a signal rather than a pass. A policy that sets limits should also say that a payment near a limit, to a payee added the same day, is a reason to look rather than a reason to relax.
Where Account Takeover Fraud Prevention fits in a corporate policy
The solution does not write the policy, choose the security procedure or sign the agreement; those belong to treasury management, fraud strategy and counsel. It supplies sections 5 and 6 of the outline above: monitoring that joins a business user's logins, administrator changes, new payees and payments into one sequence, outreach to contacts that predate the activity, holds approved by a person and confirmed by a second, and a file that shows each of those steps with its source. In a dispute, that file is how the bank shows what its system saw and what it did about it.
It also returns evidence to the policy's annual review. Every confirmed case records where it began and which controls failed, and the strategy agent turns repeated failures into rule proposals with a back-test, for approval by the strategy manager and model risk. How the 2021 FFIEC guidance frames those controls is covered in the guide to the FFIEC authentication guidance, and the detection design in the guide to account takeover fraud detection. To see the evidence on your own business cases, start from Account Takeover Fraud Prevention.
Questions people ask
Who is liable for corporate account takeover?
Under UCC Article 4A, the business bears the loss if it agreed to a security procedure that was commercially reasonable and the bank accepted the payment order in good faith and in compliance with it. Otherwise the bank must refund the payment with interest. Regulation E's consumer limits do not apply to business accounts.
Is dual control required for business accounts?
No law requires it in every case, but the FFIEC lists it among customer controls, and refusing it can shift the loss. In Choice Escrow, a customer that declined dual control in writing bore a $440,000 loss because the court found the declined procedure commercially reasonable.
What did the court decide in Patco v. People's United Bank?
The First Circuit held in 2012 that the bank's security procedures were commercially unreasonable, because it raised the risk by asking challenge questions on every transaction over $1 and then neither monitored nor warned the customer about transactions its own system flagged as high-risk. It reversed summary judgment for the bank and left open what duties Article 4A places on the customer.
How often should a corporate account takeover policy be reviewed?
At least yearly, and after any material incident. Texas's standards ask banks to contact vendors annually about controls that reduce takeover risk and to document that in the annual risk assessment. Because commercial reasonableness considers procedures "in general use", a procedure that was reasonable several years ago may not be today.
Does corporate account takeover include business email compromise?
Texas's 2019 memorandum treats business email compromise as "a type of account takeover", because it shares many of the same controls. Legally they can differ: in a classic email compromise an authorized employee is deceived into sending the payment, which points toward an authorized order under Article 4A, while in a takeover someone else sends it. The difference matters for who bears the loss.