The “Mark” Who calls: Why business account takeover is so hard to see
A small-business owner noticed his computer was running slowly, so he did the sensible thing and asked ChatGPT whether he could be dealing with a malware infection. However, the people who had already infected his machine saw him do it and sprang into action.
Within minutes, they flooded his inbox with spam and a $350 test transaction hit his account. Then someone called him, posing as an investigator to say they were tracking a rogue employee at his bank and they needed his help to set a trap. All he had to do was approve one wire transfer. Like anyone would be, he was suspicious and asked questions.
In the end, he approved it anyway, and $30,000 left his account and was gone.
From the bank’s side, nothing looked wrong. It was a valid session from the customer’s own device, with the correct password and one-time code, and the customer himself authorized the transfer. That is what makes account takeover so hard to detect.
Why business accounts are a different target
What makes business account takeover different from the consumer version that most fraud programs are built to detect is that it’s more methodical and the money at stake is much larger.
A consumer login is a commodity that’s bought and sold in bulk, but a business account with a six-figure (or more) balance isn’t. In one dark web listing we saw, a business checking account with a $212,000 balance was priced at $3,800 and bundled with the email login and a way around 2FA.
A fraudster can target anyone, but business accounts are where they get their best ROI. These accounts feature higher balances and wire access, and a business has a variety of employees who might pick up the phone or open an email.
Our analysts found a case where three large, uniform transfers left a compromised business account over the course of an afternoon. They were sized and timed to look ordinary, but were wired into mule accounts registered at the same bank.
None of these customers were careless and none of their institutions’ defenses were weak. The difference is that on a business account, a large transfer doesn’t necessarily signify unusual activity. It might just be an average Tuesday.
Two ways in
There are two common ways into a business account, and only one of them needs anything installed on the customer’s machine.
Software on the machine. Malware such as hidden Virtual Network Computing (hVNC) creates an invisible second desktop on the victim’s device. The customer works normally while the attacker operates a separate session in the background, sharing the customer’s IP address and device fingerprint. To your systems, it is the customer. It arrives through phishing emails, malicious downloads such as fake browser updates, or abuse of legitimate remote management tools.
A phone call. The call spoofs the institution’s phone number, and an automated OTP bot persuades the customer to read back a code, which the fraudster uses immediately to complete a login. Nothing is installed. The route is cheap and scales easily: one OTP bot service we tracked advertised unlimited calls for $150 a week.
making the movement look expected
Getting in is only half the work. On a business account, the money has to leave in a way that looks routine, and the inbox is usually where that starts.
Attackers read the mailbox first to learn how the business pays and who approves. Then they redirect payment details or introduce a new vendor that resembles an existing one. Inbox rules quietly move or delete the replies that would give the game away, so the customer’s own mail client shows a clean inbox. In one case our analysts reviewed, creating those rules was the last step before the transfer, so the confirmations never arrived. What this buys is dwell time: often weeks, not hours, spent learning the patterns to exploit.
Connected platforms make it easier. A loan draw, payroll run or payment from a platform like QuickBooks arrives pre-vouched by that platform’s relationship with the account, not by anything your login flow saw. That opens the door to:
- Payroll fraud. Direct deposit details changed quietly, one employee at a time, or new employees added.
- Invoice fraud. Fraudulent invoices, or real ones with the payment details changed, sent from an address the client trusts.
- Loan fraud. Applications that approve cleanly, because from the lender’s side the applicant already controls the business.
No control stopped these cases, because everything that happened looked normal to those controls. Every transfer was authorized by the person who was supposed to authorize it. Three actions can still narrow the window.
1. Tell business customers before they need it
Education addresses the weakest link in the chain: the human element. The message is short:
- We will never ask you for a code on a call we placed.
- Hang up and call the number on your card or statement, every time.
- Slow is safe.
2. Verify the action, not just the login
A trusted login shouldn’t mean every later action is trusted too. Three questions worth putting to your own team:
- Does out-of-band verification cover every high-risk action? A code that can be read out over the phone can be read out to a fraudster. An authenticator app, biometric check or passkey leaves a caller nothing to ask for. The same check should cover new payees and large wires, not just the login.
- Are embedded financial products treated as their own risk? A loan draw, payroll run or payment from a connected platform arrives pre-vouched. First-time or unusual activity through these integrations deserves less tolerance, not more trust.
- Are business accounts monitored separately at all? Large transfers are normal there, so anomaly models tuned on retail volume won’t see them.
3. Learn about the compromise before the attempt
Customer education can’t reach what was arranged before the call: the stolen credentials, the targeting, the service being bought. That is where intelligence collected inside the criminal underground helps. The OTP service described above was advertised, priced and refined in plain view before it reached anyone’s customers.
When a customer’s online banking credentials turn up for sale, that is a confirmed compromise, and it usually surfaces before the login is attempted. An institution that knows which accounts are affected can reset credentials, step up authentication, or watch those accounts more closely while there is still time to act.
Keep in mind that that intelligence doesn’t detect the call, and it can’t stop a customer who decides to read out a code. What it does is narrow the window in which the call can work.
The common thread
The customers in these cases weren’t tricked into doing something careless. They were recruited into doing something that seemed sensible, by people who had done their homework first. That homework happens in the open, on channels that sell the tools by the week.
Following the threat actor, not only the attack, is what gives an institution lead time. That holds whether the foothold is malware today or legitimate remote-access software tomorrow.
See for yourself
Reading about a call like this is not the same as hearing one. Our webinar, presented with a member of the U.S. Secret Service Cyber Fraud Task Force, goes further than this post can, ocvering:
- Three real business account cases, including one where the victim was suspicious, was checking, and still approved a $30,000 wire
- What an OTP bot call actually sounds like, and the process behind it from the operator’s side
- The criminal marketplace behind these tools: what is advertised, and what it costs
- Where the money leaves once an attacker is inside, including the parts most institutions have not seen laid out
Watch the webinar recording here.