Corporate account takeover: A growing threat to your business

What is CAT?

CAT scams occur when fraudsters gain unauthorized access to a company’s bank account. They often use phone calls, emails, or text messages to manipulate employees into downloading malware, initiating payments, or sharing sensitive account information. A fraudster may even create a deceptive phishing website that closely mimics a legitimate banking platform to mislead users into entering their online banking credentials, which can then be captured and misused for unauthorized access.

A business example of CAT

A business owner received a call from a scammer posing as a trusted electronics retailer they worked with. The scammer said there was a problem with the business owner’s account and asked them to download an application, claiming it would fix the issue. Instead, the application gave the scammer remote access to the business owner’s device. Once access was established, the scammer directed the owner to log in to their online banking platform and transferred a significant amount of money from the account.

How to help protect your business

While CAT schemes are sophisticated and widespread, there are steps you can take to help protect your business from them.

• Educate your employees. Make sure they understand the risks of CAT schemes and how to spot a scam. Consider providing regular training on cybersecurity best practices.
• Verify identities. Be cautious of unexpected calls or emails that ask for sensitive information, especially if they seem urgent. Before sharing any information, always independently verify the identity of the person or company contacting you — without using any links or phone numbers they provide.
• Use strong passwords. Use strong, unique passwords for all your online accounts, and consider using two-factor authentication (2FA) or biometric authentication whenever possible.
• Never trust a link; always access directly.  Access your online banking platform by typing the URL directly. Never access it through an unsolicited e-mail link or search engine search (i.e., Google, Bing, etc.), as these lead to phishing sites.
• Monitor your accounts. Regularly review your account statements and online activity to catch any suspicious activity early.
• Report suspicious activity. If you suspect your business has been targeted by a CAT scam, report it to your bank's fraud department immediately.
• Consider cyber insurance. Cyber insurance may help cover financial losses associated with fraud or cyber incidents, as well as recovery costs. Speak with an insurance advisor to determine what coverage is appropriate for your business.

What to do if you’ve been targeted

If you think your business has been targeted by a CAT scam, act fast.

•  Contact your bank. Call your bank’s fraud department immediately to report the incident and have them put a hold on your accounts. KeyBank clients should contact the Fraud Client Service Center at 1-800-433-0124 or dial 711 for TTY/TRS.
•  Change your passwords. Change all your online banking passwords and any other sensitive information that may have been compromised.
•  Monitor your credit. Check your credit reports to make sure there's no suspicious activity.

What to do if your business becomes a victim of fraud

If you suspect your business has been exposed to fraud, immediately contact any financial institution where you have an account. If you are a KeyBank client, contact KeyBank’s Fraud Client Service Center immediately at 1-800-433-0124 or dial 711 for TTY/TRS.