What Is Corporate Account Takeover (CATO)?

Corporate Account Takeover

By VerifyTheCall Research · Published July 31, 2026 · 4 min read

Corporate account takeover (CATO) is account takeover aimed at a business — most damagingly its online banking, treasury, or identity-provider accounts — enabling attackers to initiate payments, change payroll, or grant themselves access while appearing to be the company.

How it works

Entry comes via credential theft or helpdesk-style social engineering against employees with banking access; attackers persist while studying payment patterns; then transfers are styled to look routine — often ACH batches and wires sized under review thresholds (see dual authorization).

Warning signs

Unfamiliar payees appearing in templates.
Changed contact details or alert settings on bank accounts.
MFA resets nobody remembers requesting.
Small "test" transactions preceding larger ones.

Controls

Dedicated devices or hardened access for banking.
Dual authorization on payment release.
ACH positive pay filters (see ACH positive pay).
Verified out-of-band confirmation for new payees and limit changes.
Verification on the reset flows that guard all of it — see account takeover prevention.

Frequently asked questions

How is CATO different from consumer ATO?

The target is company funds and identity infrastructure, losses are larger, and business accounts carry weaker statutory protections than consumer accounts in many jurisdictions.

Are banks liable for CATO losses?

Frequently contested — outcomes have turned on whether the bank's security procedures were commercially reasonable and whether the company held up its side; not legal advice.

What single control matters most?

Out-of-band verification on both payment changes and access resets — the two doors CATO walks through.

The Callback

The Callback — a short briefing on new scam patterns and payment controls. No more than twice a month.

Unsubscribe anytime.