A business banking administrator is the person a business appoints to control its online banking: to add and remove users, set what each user may do and up to what amount, reset access and, under many agreements, ask the bank for changes such as new services or higher limits. That power is the point of the role and its danger. Whoever can act as an administrator can create a user with the right to release payments, and a new user keeps paying out long after a single fraudulent wire would have been noticed. Botminds' Treasury Management Client Services treats every request that arrives in an administrator's name as a claim to be checked: who asked, through which channel, under which clause, confirmed on which number, within which limits, before a specialist makes the change and a second approves it.
The examples come from a fictional credit union and its sample business member, a millwork manufacturer with two administrators. The FBI figures and the FFIEC guidance are real.
What an administrator can do, and the control that should sit on each power
| Administrator power | What a fraudster gets from it | The control that should sit on it |
|---|---|---|
| Add a user | A login of their own that survives a password reset of anyone else | Callback to the client before any user with payment rights exists |
| Grant entitlements and limits | Release rights, or a higher approval limit, for that login | A second administrator to countersign; a bank-side second approver |
| Remove a second approver | Single-person release on a client that had dual control | Treated as a change to the security procedure, verified like wire release |
| Change contact details or callback numbers | Every later verification call reaches the fraudster | Verified on the number already held, never the new one |
| Ask the bank for new services or limits | More channels and more room to move money | The agreement's channels only; limits checked against the approved exposure |
What is a business banking administrator?
A business banking administrator is a user of a business's online banking who holds the administration entitlement: the right to manage other users. The business names its administrators under its cash management or online banking agreement, often on a separate form signed by people its resolution empowers. Many agreements require two, and some changes need both.
The title also appears on bank job boards, for staff who administer business banking platforms on the bank's side. That role overlaps with the bank's client services desk; this guide is about the client's administrator, because that is the identity a maintenance desk has to verify. In the sample client the two administrators are the controller, appointed March 4, 2021, and the owner, appointed June 2, 2019, and the bank's file records both dates.
What can a business online banking administrator do?
Within the services and limits the bank has set up, an administrator can usually create and delete users, assign each user's services, accounts, functions and limits, reset passwords and tokens, and set up the business's own approval rules. Under most agreements the administrator is also the person the bank takes maintenance instructions from: add a service, raise a limit, change a callback contact.
What an administrator usually cannot do is exceed what the bank has granted the business as a whole. An administrator can give a user a $150,000 approval limit only if the business's own limits allow it; a request for a $400,000 approval limit against a $350,000 approved daily exposure, as in the sample forged request, cannot be granted by anyone at the business, administrator or not. How administrators differ from signers and ordinary users sets out who holds which power.
Why do fraudsters target administrator accounts?
Because an administrator's identity converts into money more reliably than any single payment instruction. A fraudulent wire request faces the client's own dual control, the bank's wire callback and, often, a recall. A fraudulent administrator request, if it succeeds, produces a user who passes all of those, because the user is real in the system and the security procedure verifies users, not intentions.
The FBI's definition of business email compromise is broad enough to cover it: "These sophisticated scams are carried out by fraudsters by compromising email accounts and other forms of communication such as phone numbers and virtual meeting applications, through social engineering or computer intrusion techniques to conduct unauthorized transfer of funds" (FBI IC3, 2025 Annual Report). A compromised administrator mailbox is the shortest path from that technique to a lasting entitlement.
Business email compromise losses reported to the FBI, three years
Who bears a loss once a fraudulent user exists is a question Article 4A answers case by case. An order that passed the agreed security procedure binds the business even if nobody there authorized it, provided the procedure was commercially reasonable and the bank shows it accepted the order in good faith and by the procedure (UCC § 4A-202(b); the section's text, and what follows when a bank cannot show it, is in can a fraud wire transfer be reversed). When the user who sent the order was created by the bank on a forged request, how that user came to exist will be the first thing both sides examine.
The quiet request: a new user instead of a wire
Asking for a new user with wire release is quieter than asking for a wire. It does not move money on the day, so nothing in payment monitoring fires; it arrives in the maintenance queue, which is staffed for service rather than suspicion; and once granted, it can be used repeatedly, within limits that look normal for the client.
Two forged emails in the controller's name: one asks for a wire, the other for a user
Forged wire request: The wire room, with payment monitoring and a wire callback
Forged user request: The maintenance queue, run as a service desk
Forged wire request: Money moves, or is stopped
Forged user request: Nothing moves; a login is created
Forged wire request: One payment, if it clears
Forged user request: A user who can send payments for weeks, within normal-looking limits
Forged wire request: When the client sees the debit
Forged user request: When the client reconciles, or the new user is spotted in a review
Forged wire request: Dual control, the wire callback, a recall
Forged user request: Verification of the request itself, before the user exists
The sample request combined both: a new user with wire release up to $250,000 and a higher ACH approval limit, sent from a lookalike domain registered three days earlier, in the controller's name, with urgent wording and a reply-to address that differed from the sender. It is a common shape because it asks for the two things that turn a login into money.
Should a business have two administrators?
Yes, for any business that sends payments of size, and the agreement should require both for the changes that matter most. Two administrators means a single compromised mailbox or a single disgruntled employee cannot grant release rights alone. The FFIEC lists the control among those banks offer business customers.
"Supplementary controls are available for a business customer's system administrators who are granted privileges to change digital banking configurations, such as the establishment of a new employee with transactional access on the account."
FFIEC, Authentication and Access to Financial Institution Services and Systems, 2021
The sample agreement applies it where it counts: a wire release entitlement is designated by one authorized administrator and countersigned by the second. Dual administration also needs maintenance of its own. When one administrator leaves, the business has one until it appoints another, and a request to appoint the replacement is exactly the request a fraudster would send.
How to change the administrator on a business account
To change an administrator, the business should ask through a channel its agreement allows, signed or sent by someone with authority to appoint administrators, and expect the bank to confirm it with an existing administrator on a number the bank already holds. If the departing administrator is the only one, the confirmation goes to a signer under the resolution instead.
The bank's side should be stricter for this change than for almost any other. The sample credit union verifies an administrator change by callback and requires a countersignature; it never calls the new administrator's number to confirm the new administrator's appointment, because that number arrived with the request. Once the change is made, the new administrator's contacts go on file, and from then on they are the numbers the bank calls.
Can an administrator add a user with wire release?
Under self-administration, often yes, within the business's own setup, though a well-drafted agreement requires a second administrator to countersign. Through the bank, the request should be verified by callback and, on the bank's side, approved by a supervisor rather than any second specialist; that is the sample credit union's rule for every payment-release entitlement. Either way, a request for wire release that arrives with one administrator's name, where the agreement needs two, cannot be completed as sent.
What the channel check found on a request in the controller's name
Red flags on a request in an administrator's name
A forged administrator request usually gives itself away in how it arrived rather than in what it says, because the content is copied from the real administrator's past messages. The signs below are the ones the sample channel check looks for. None is proof on its own; together they decide whether a request is held for a callback before anyone replies to it.
Seven signs that a request in an administrator's name did not come from the administrator
- A lookalike sending domain
A hyphen added, a letter swapped, .com changed to .co: the sample request came from ashgrove-millwork.co, not ashgrovemillwork.com.
- A sending domain registered days ago
Three days old on the sample request, against a rule that holds anything under 90 days.
- A reply-to address that differs from the sender
Replies, and any questions the desk asks, go to the fraudster.
- A first message from that address
The sample client had sent nothing from it in 24 months; every past request came by secure message or signed form.
- A callback number supplied in the request
An invitation to verify with the requester; the sample request offered one, marked never to call.
- Urgency the client has never shown
"Urgent", "this week", "please do this today" on the sample request, from a client whose past requests carried none.
- A request that removes a control
Removing a second approver or changing a callback contact is worth more to a fraudster than any single user.
What the bank checks before an administrator's request takes effect
Every request in an administrator's name should pass five checks before anything changes: that the person is an administrator on file; that the request came through a channel the agreement allows; that the agreement lets this administrator ask for this change alone; that the administrator confirmed it on a number held before the request; and that the change fits the client's approved limits. A broken check means no change, and a refusal goes to a supervisor and then to fraud with its evidence.
On the sample request three checks broke and one needed a person. The controller, reached at 09:02 on the number on file, said she had not sent it. The refusal was approved at 09:41 and a fraud referral opened with six pieces of evidence, and the lookalike domain joined a watch list on which two further requests that week had been held for callback before anyone replied. Why only the number on file can verify a request explains the callback that settled it.
The referral, already packed, and proof that nothing changed for the client
A business can help from its side by keeping its administrator list current, requiring two administrators for release rights, and removing departed users promptly; how to find the user who left covers the review that catches the last one. For the policy question of who carries a takeover loss, a corporate account takeover policy is the companion read. To see an administrator request checked end to end, start from Treasury Management Client Services.
Questions people ask
What does a business banking administrator job involve at a bank?
At a bank, the title usually means staff who set up and maintain business clients' online banking: users, entitlements, limits and services, on the client's verified request. The work overlaps with treasury client services, and it carries the same risk, because each change decides who can move a client's money.
Can a bank refuse a request from a business's own administrator?
Yes, and it should when the request cannot be verified: if it arrived through a channel the agreement does not allow, if the administrator cannot be reached on the number on file, or if the change needs a second administrator who has not countersigned. A refusal is not an accusation; it is the agreement working.
What should a business do if it suspects its administrator's email is compromised?
Call the bank on a number the business already has, not one from any recent email, and ask it to hold all maintenance requests and review recent user and entitlement changes. Then change the administrator's credentials and email access, and consider adding a second administrator if there is only one.
How many administrators should a business have?
At least two for any business that releases payments of size, with the agreement requiring both for release rights and administrator changes. One administrator is a single point of failure for both fraud and absence.
Does the administrator need to be an owner or officer?
No. The business decides, in documents signed by people its resolution empowers. Controllers and finance managers are common administrators; what matters is that the appointment is documented and dated, and that the bank holds a callback number for each.