By Jackson Godwin | Cybersecurity Analyst & Penetration Tester, Jackson Technology

Most business owners picture a bank account hack as something dramatic — a brute-force attack against a bank's systems, or a sophisticated breach of encrypted financial data. The reality is far less cinematic and far more common: in the overwhelming majority of cases, criminals do not hack the bank at all. They get someone inside the business to hand over the keys, or they quietly obtain login credentials and routing details that were never particularly well protected in the first place.

The Automated Clearing House (ACH) network — the system behind payroll deposits, vendor payments, and most routine business transfers — has become a primary target precisely because it is so deeply embedded in normal business operations. ACH fraud has been increasing steadily, and the mechanics behind it are simpler than most business owners realize: a bank account number and a routing number are often all that stands between a criminal and a business's cash, and those numbers are printed on every check a company writes.

This article walks through exactly how these attacks unfold — from credential theft to account takeover to the moment funds disappear — and more importantly, the specific controls that close each of these gaps before they become a six-figure loss.

Why Business Bank Accounts Are a Prime Target

The math is straightforward from a criminal's perspective. Credit card fraud is relatively easy for victims to reverse — the card issuer typically absorbs the loss while investigating, and the cardholder is rarely left permanently out of pocket. ACH and wire transfers work completely differently. They are direct transfers between bank accounts, and once that money leaves, getting it back requires cooperation from multiple banks and often law enforcement, with resolution sometimes taking weeks or months — if the funds are recovered at all.

This asymmetry is the entire reason ACH and wire fraud are so attractive to criminals. The same speed and simplicity that make ACH the backbone of business payments — payroll, vendor payments, recurring transfers — also mean that once a fraudulent transaction is initiated, the window to stop it is measured in hours, not days.

⚙ The Uncomfortable Truth Most schemes targeting business bank accounts rely on deception rather than technical hacking. Criminals don't need to breach a bank's infrastructure — they need someone inside the organization to authorize what looks like a legitimate payment to a fraudulent account. The 'hack' often happens entirely inside the victim's own inbox or banking portal, using credentials the criminal already obtained.

How the Attack Actually Unfolds: Three Stages

While specific tactics vary, most schemes that drain business bank accounts move through the same three stages. Understanding this sequence is critical, because each stage represents a separate opportunity to stop the attack before money moves.

Stage 1: Credential Theft

Fraudsters obtain banking credentials, account numbers, and routing numbers through phishing emails, data breaches, malware, or — perhaps surprisingly — discarded paper documents. Banking usernames and passwords function as the keys to a business's entire financial vault, and unlike a stolen credit card number, a compromised bank account and routing number can potentially allow a fraudster to drain checking or savings accounts directly.

Stage 2: Account Access or Impersonation

With stolen credentials, attackers either log into online banking portals directly during off-hours to avoid detection, or use compromised business email accounts to impersonate executives, vendors, or colleagues and request fraudulent transfers — the BEC pathway into ACH and wire fraud. In one illustrative case, a finance team discovered $50,000 missing after hackers used credentials obtained in a prior breach to log in during off-hours and move funds to accounts they controlled.

Stage 3: Fund Movement and Extraction

Once access or authorization is achieved, funds are moved — often through ACH transfers to 'mule' accounts, where recruited individuals receive fraudulent transfers before quickly forwarding the funds onward, making the money trail much harder to follow. Wire transfers settle immediately, making recovery especially difficult, while ACH transactions process in batches over one to three days, creating a narrow but real window for detection before settlement.

The Specific Techniques Behind Account-Draining Attacks

Account Takeover via Stolen Credentials

This is the most direct method: hackers gain unauthorized access to a business's online banking credentials — often obtained through phishing, malware, or data breaches involving completely unrelated services where employees reused passwords — and initiate fraudulent ACH transactions directly from within the legitimate banking portal.

Vendor Impersonation and Invoice Manipulation

Fraudsters submit altered invoices or fake payment instructions, often timed to align with busy billing periods when altered details are more likely to slip through normal review processes. The payment looks completely legitimate from an accounting standpoint — it's simply routed to the wrong account.

ACH Kiting

This more sophisticated technique exploits the time delay between when ACH payments are initiated and when they actually settle. Fraudsters cycle money through multiple accounts at different banks, artificially inflating balances and withdrawing the same funds multiple times before transfers clear — effectively spending money that hasn't settled yet.

Unauthorized ACH Debits

Because account and routing numbers aren't secret — they're shared with every vendor, employee, and service provider a business deals with — a criminal who obtains these numbers can initiate ACH 'pull' transactions directly from a business account without any employee involvement at all. The only thing standing in the way is the detection software at the bank and the speed of the business's own monitoring.

Payroll Fraud

Criminals set up fake employee accounts or manipulate existing payroll records to divert ACH payments intended for legitimate employees into accounts they control — a slower-burning fraud that can continue undetected across multiple pay cycles.

Attack Method, Entry Point, and Detection Window

Attack Method	Primary Entry Point	Typical Detection Window
Account takeover (stolen credentials)	Phishing, malware, password reuse from breaches	Hours - often discovered after off-hours login
Vendor impersonation / invoice fraud	Compromised or spoofed vendor email	Days - often during reconciliation
ACH kiting	Existing legitimate account access	Can persist across settlement cycles if unmonitored
Unauthorized ACH debits	Exposed account/routing numbers	1-2 days - tied to bank's return/dispute window
Payroll fraud	Internal access or compromised HR/payroll system	Often a full pay cycle or longer

Why Speed of Detection Determines Whether You Get Your Money Back

One of the most important — and least understood — aspects of ACH fraud is how heavily the entire liability and recovery structure is weighted toward speed. For unauthorized debits initiated without employee involvement, a business's bank may only be liable if the fraud is reported within a narrow window defined in the account agreement — often just one or two business days. Miss that deadline, and liability can shift entirely to the business.

On the receiving side, the bank that received the fraudulent funds faces potential liability under NACHA's return rules and must return funds if notified promptly — even if the fraudster's account is now empty. But this protection disappears if the business waits too long to report. In short: the entire system punishes delay and rewards rapid detection, which makes monitoring and response speed one of the highest-leverage investments a business can make.

Practical Controls That Close These Gaps

The good news is that the techniques described above are well understood, and the controls that prevent them are neither exotic nor expensive relative to the potential losses they prevent.

1. Enable ACH debit blocks — instruct your bank to reject all incoming ACH debits unless they come from pre-approved sources, directly neutralizing unauthorized pull transactions even if account and routing numbers are exposed
2. Enforce multi-factor authentication on all online banking access, treating banking credentials with at least the same level of protection as the funds they protect
3. Verify any change to vendor banking details through a separate, previously known communication channel — never through contact information provided in the email or invoice requesting the change
4. Implement dual authorization for ACH and wire transfers above a defined threshold, so no single compromised credential or convincing email can move significant funds alone
5. Reconcile accounts daily, not monthly — given the one-to-two day liability window for unauthorized debits, daily reconciliation is often the difference between recovery and permanent loss
6. Train employees specifically on the warning signs of vendor impersonation and invoice fraud, particularly during high-volume billing periods when scrutiny tends to drop
7. Keep systems and software updated and secured with strong antivirus and firewall protections, since malware remains a primary pathway for credential theft in the first place

📋 If Funds Have Already Moved Report the incident to your bank immediately — both the sending and receiving institutions, if known. NACHA's return rules require receiving banks to return fraudulently obtained funds if notified promptly, but this protection erodes quickly with time. For wire transfers, settlement is immediate and recovery is far less likely, making prevention controls even more critical for wire-based payments than for ACH.

Final Thoughts

Hackers drain business bank accounts not by breaking through sophisticated banking infrastructure, but by exploiting the gap between how quickly money can move and how slowly most businesses notice it's gone. Credential theft, vendor impersonation, and unauthorized ACH debits all share the same underlying vulnerability: a business's financial controls trusted a piece of information — a password, an email, an account number — that a criminal had already obtained.

The controls that close these gaps are not complicated, but they require consistency: verifying changes out-of-band, blocking unauthorized debits by default, reconciling accounts daily, and treating banking credentials as the literal keys to the business they are. In a system where liability and recovery are determined by how quickly fraud is detected, the businesses that build these habits into their daily financial operations are the ones that turn an attempted attack into a non-event — rather than a headline.

About the Author

Jackson Godwin is a Cybersecurity Analyst and Penetration Tester, and the founder of Jackson Technology, a cybersecurity and data protection consulting firm based in Abuja, Nigeria. Jackson Technology provides VAPT, cloud security, compliance advisory (ISO 27001, NDPA, GDPR), and AI governance consulting to enterprise clients across banking, fintech, oil and gas, and the public sector. Jackson is also affiliated with TechTrain Academy, where he contributes to cybersecurity capacity-building initiatives.

For consulting inquiries, fraud risk assessments, or security awareness training, contact: info@jacksontechnology.com.ng