Can Anyone Access Your Bank Account Without Permission?

How does Minnesota law decide who bears an unauthorized loss from a business bank account?

Minnesota starts with the bank: it may charge your account only for payments you actually authorized or are bound by. For checks, an item is chargeable only if “properly payable.” For wires and other payment orders sent to your bank in your company’s name, an order binds you if you authorized it under agency law. It also binds you if the bank accepted it in compliance with an agreed, commercially reasonable security procedure and with any restriction on accepting orders that you gave the bank in a record.

Under Minn. Stat. § 336.4-401(a), “[a]n item is properly payable if it is authorized by the customer and is in accordance with any agreement between the customer and bank.” A forged check fails that test, so the bank may not charge it to your account unless another rule shifts the loss back to you.

Electronic payments work differently. Under Minn. Stat. § 336.4A-202(a), a payment order is yours “if that person authorized the order or is otherwise bound by it under the law of agency.” Subsection (b) adds a second path: a verified order can bind you even when you never authorized it. That second path is why a hacked online banking login is a harder case for a business than a forged check.

Why do consumer fraud protections not cover a business account?

The federal Electronic Fund Transfer Act and its liability caps cover accounts “established primarily for personal, family, or household purposes,” under 15 U.S.C. § 1693a(2). A business checking account is outside that definition, so the wires and other payment orders sent in its name answer to Minnesota’s Article 4A.

Minnesota’s Article 4A steps aside only where the federal act applies. Under Minn. Stat. § 336.4A-108(a), “[e]xcept as provided in subsection (b), this article does not apply to a funds transfer any part of which is governed by the Electronic Fund Transfer Act of 1978.” Subsection (b) makes an exception for certain remittance transfers. The practical result is that the protections your bank advertises for personal accounts do not tell you what happens on your operating account. The deposit agreement and the UCC do.

One reader may be on the other side of that line. A sole proprietor who opened a personal account and runs business through it may still have consumer protections for electronic fund transfers. Under 15 U.S.C. § 1693a(7)(B), that term does not include “any transfer of funds, other than those processed by automated clearinghouse, made by a financial institution on behalf of a consumer by means of a service that transfers funds held at either Federal Reserve banks or other depository institutions and which is not designed primarily to transfer funds on behalf of a consumer.” Even there, a transfer is not “unauthorized” under 15 U.S.C. § 1693a(12)(A) if it was “initiated by a person other than the consumer who was furnished with the card, code, or other means of access to such consumer’s account by such consumer, unless the consumer has notified the financial institution involved that transfers by such other person are no longer authorized.” Card charges raise their own issues, covered in the discussion of misuse of a company credit card.

How are forged and altered checks handled under Minnesota’s UCC?

A forged signature does not bind your business, so a forged check is generally the bank’s loss. Under Minn. Stat. § 336.3-403(a), “an unauthorized signature is ineffective except as the signature of the unauthorized signer in favor of a person who in good faith pays the instrument or takes it for value.”

Dual-signature policies carry legal weight. Subsection (b) provides that “[i]f the signature of more than one person is required to constitute the authorized signature of an organization, the signature of the organization is unauthorized if one of the required signatures is lacking.” If your signature card requires two signers, a check with one signature is unauthorized even when that one signature is genuine.

Your own carelessness can shift the loss. Under Minn. Stat. § 336.3-406(a), “[a] person whose failure to exercise ordinary care substantially contributes to an alteration of an instrument or to the making of a forged signature on an instrument is precluded from asserting the alteration or the forgery” against a bank that paid in good faith. Under subsection (c), the bank bears the burden of proving that failure. Unlocked check stock and a signature stamp anyone can reach are the kind of facts a bank may point to. Under subsection (b), if the bank also failed to exercise ordinary care in paying the check and that failure substantially contributed to the loss, “the loss is allocated between the person precluded and the person asserting the preclusion according to the extent to which the failure of each to exercise ordinary care contributed to the loss.” Subsection (c) puts that second proof on your business: “Under subsection (b), the burden of proving failure to exercise ordinary care is on the person precluded.” The check schemes employees use show what careless check handling looks like.

What are the rules for reviewing bank statements and reporting a forgery?

Your business must review each statement with reasonable promptness and report an unauthorized check promptly. Under Minn. Stat. § 336.4-406(c), “the customer must exercise reasonable promptness in examining the statement or the items to determine whether any payment was not authorized because of an alteration of an item or because a purported signature by or on behalf of the customer was not authorized.” Missing that duty can move the loss to you.

The statute builds in four consequences:

• The forged check itself. Under subsection (d)(1), you lose your claim for “the customer’s unauthorized signature or any alteration on the item, if the bank also proves that it suffered a loss by reason of the failure.”
• The same forger’s later checks. Under subsection (d)(2), you lose your claim for “the customer’s unauthorized signature or alteration by the same wrongdoer on any other item paid in good faith by the bank if the payment was made before the bank received notice from the customer of the unauthorized signature or alteration and after the customer had been afforded a reasonable period of time, not exceeding 30 days, in which to examine the item or statement of account and notify the bank.” A forger who runs for months while nobody reads the statements creates that loss.
• Shared fault. Under subsection (e), if you prove “that the bank failed to exercise ordinary care in paying the item and that the failure substantially contributed to loss,” the loss is split by each side’s contribution, and “[i]f the customer proves that the bank did not pay the item in good faith, the preclusion under subsection (d) does not apply.”
• An outside bar. Subsection (f) provides: “Without regard to care or lack of care of either the customer or the bank, a customer who does not within one year after the statement or items are made available to the customer (subsection (a)) discover and report the customer’s unauthorized signature on or any alteration on the item is precluded from asserting against the bank the unauthorized signature or alteration.” Check the current text before relying on any period, and check your deposit agreement, which may set a shorter one.

The Minnesota Supreme Court applied these duties in a case worth knowing. In Stowell v. Cloquet Co-op Credit Union, 557 N.W.2d 567 (Minn. 1997), a neighbor stole an account holder’s checks and his statements from the mailbox, then forged 50 checks over about ten months on an account used for personal and business purposes. The court held that the duty to examine statements begins when the bank mails them, enforced the account agreement’s 20-day reporting clause, and reversed the jury’s allocation of 75 percent of the August 1993 forgeries to the credit union. Of the $22,329.34 forged, the court directed judgment for Stowell only for $4,388.27 plus interest, the amount the credit union had recovered from the banks that cashed the checks, which it could not keep under the principle of unjust enrichment. The opinion also records a fact worth knowing: the credit union processed checks by machine and did not compare signatures against signature cards, and the court found no evidence that this practice fell short of ordinary care.

How does Article 4A allocate an unauthorized wire or ACH payment?

A wire or ACH payment sent in your business’s name that it never authorized can still be your loss if your bank verified it under an agreed security procedure. Under Minn. Stat. § 336.4A-202(b), the order is effective “whether or not authorized” if the procedure is commercially reasonable and the bank proves it accepted the order “in good faith and in compliance with the bank’s obligations under the security procedure and any agreement or instruction of the customer, evidenced by a record, restricting acceptance of payment orders issued in the name of the customer.” The same subsection adds: “The bank is not required to follow an instruction that violates an agreement with the customer, evidenced by a record, or notice of which is not received at a time and in a manner affording the bank a reasonable opportunity to act on it before the payment order is accepted.”

Three parts of the statute matter for a business that lost money this way:

1. The security option you declined. Under subsection (c), a procedure is deemed commercially reasonable if “the security procedure was chosen by the customer after the bank offered, and the customer refused, a security procedure that was commercially reasonable for that customer,” and the customer expressly agreed in a record to be bound. If your bank offered dual approval or callback verification and you turned it down, that refusal can decide the case.
2. What does not count as security. As amended in 2024, Minn. Stat. § 336.4A-201 provides that “requiring a payment order to be sent from a known email address, IP address, or telephone number is not by itself a security procedure.” A bank that relied only on the order arriving from your usual email address has not verified it under that definition.
3. Proof that the breach did not come from you. Under Minn. Stat. § 336.4A-203(a)(2), the bank cannot keep a verified but unauthorized payment if you prove who did not cause it. You must prove that the order “was not caused, directly or indirectly, by a person (i) entrusted at any time with duties to act for the customer with respect to payment orders or the security procedure.” It also must not have been caused by one “who obtained access to transmitting facilities of the customer or who obtained, from a source controlled by the customer and without authority of the receiving bank, information facilitating breach of the security procedure, regardless of how the information was obtained or whether the customer was at fault.” Passwords phished from an employee and malware on an office computer can come from a source the business controls, which makes this proof hard.

When the payment went out because a spoofed email changed a vendor’s account number, the questions shift to the recall request and the dispute with the vendor. Those are covered in the discussion of fraudulent wire instructions and wire recalls.

What makes reporting speed matter for a wire or ACH refund?

Reporting speed changes what you recover. When the bank must refund an unauthorized wire or ACH payment, Minn. Stat. § 336.4A-204(a) requires it to “pay interest on the refundable amount calculated from the date the bank received payment to the date of the refund,” but you lose that interest if you do not exercise ordinary care to find and report the order within a reasonable time, not exceeding 90 days after the bank notified you that it accepted the order or debited your account.

Late notice costs interest, not the principal, under that subsection: “The bank is not entitled to any recovery from the customer on account of a failure by the customer to give notification as stated in this section.” Subsection (b) allows the account agreement to fix what counts as a reasonable time for that interest rule. One other rule can cost more: Minn. Stat. § 336.4A-505 provides that “the customer is precluded from asserting that the bank is not entitled to retain the payment unless the customer notifies the bank of the customer’s objection to the payment within one year after the notification was received by the customer.” Check the current statute and your agreement before relying on any period.

I suggest giving the bank written notice of every disputed payment the day you find it, because the same notice serves the interest rule, the preclusion rule, and any recall attempt. If the intrusion came through your own systems, a data breach response plan covers the notices you may owe to others.

How does an insider with account access change who bears the loss?

A payment sent by someone you trusted with banking authority can be your business’s loss rather than the bank’s. Under Minn. Stat. § 336.4A-202(a), an order binds you if the sender had authority under agency law, and the recovery route in § 336.4A-203(a)(2) closes for orders caused by a person “entrusted at any time” with payment duties or the security procedure.

Checks follow a similar rule for endorsements. Under Minn. Stat. § 336.3-405(b), an employee’s forged endorsement can bind the employer. The statute provides that “if an employer entrusted an employee with responsibility with respect to the instrument and the employee or a person acting in concert with the employee makes a fraudulent endorsement of the instrument, the endorsement is effective as the endorsement of the person to whom the instrument is payable.” A bookkeeper entrusted with incoming checks who forges the payee’s endorsement can make that endorsement effective against the employer in favor of a bank that pays in good faith. Under the same subsection, a bank that failed to exercise ordinary care shares the loss to the extent its failure contributed.

When an employee of my own firm reported to me that he had misappropriated client money, I told him to put the full amount back that day, and then I called a CPA and said, “I need you to review all my financials,” because I needed to see if there was other theft. I suggest removing the person’s banking authority in writing, preserving the records, and measuring the full loss before confronting anyone, because a person who confesses may confess only part of what happened. The steps for responding to employee embezzlement cover the evidence and the insurance claim.

What are the rules for account agreements that shift fraud losses to the business?

Your deposit and treasury-services agreements can change many of these rules, but not all of them. For checks, Minn. Stat. § 336.4-103(a) provides that “the parties to the agreement cannot disclaim a bank’s responsibility for its lack of good faith or failure to exercise ordinary care,” though they may set standards “if those standards are not manifestly unreasonable.”

Short reporting periods are one such standard. In Stowell, the Minnesota Supreme Court enforced an agreement providing: “If items on the statements are not objected to within twenty (20) days from the mailing date of the statement, the accuracy of the items on the statement shall be considered final.” The court held the clause “was not manifestly unreasonable and should be enforced in the absence of proof of a lack of ordinary care by the Credit Union.” Your deposit agreement may have a similar clause.

Article 4A is less flexible. Minn. Stat. § 336.4A-202(f) provides that “rights and obligations arising under this section or section 336.4A-203 may not be varied by agreement.” The only exceptions are the ones those two sections state. Under Minn. Stat. § 336.4A-204(b), the agreement may fix the reasonable time for reporting, but “the obligation of a receiving bank to refund payment as stated in subsection (a) may not otherwise be varied by agreement.” I suggest reading the security-procedure section of your online banking agreement before a loss, because the procedure you accepted there is the one a court will measure.

How can a business recover money from the person who took it?

When the bank is not responsible, or covers only part of the loss, your claim runs against the person who took the money. Minnesota’s civil theft statute, Minn. Stat. § 604.14, subd. 1, makes a person who steals personal property liable “for its value when stolen plus punitive damages of either $50 or up to 100 percent of its value when stolen, whichever is greater.” Under subdivision 5, “[t]he recovery of stolen property by a person does not affect liability under this section, other than liability for the value of the property.”

The statute has two procedural features that help a business. Subdivision 4 provides that “[t]he filing of a criminal complaint, conviction, or guilty plea is not a prerequisite to liability under this section.” Subdivision 6 allows a written demand before suit that includes “a copy of this section and a description of the liability contained in this section.”

The claim has limits. In TCI Business Capital, Inc. v. Five Star American Die Casting, LLC, 890 N.W.2d 423 (Minn. Ct. App. 2017), the Court of Appeals read “steals” to mean that a person “wrongfully and surreptitiously takes another person’s property for the purpose of keeping it or using it,” and held that a corporate officer who misdirected funds without keeping or using them did not steal them. The court also stated its understanding that a conversion claim for money is viable only if the money is in a tangible form and kept separate, though it decided the conversion claim on the officer’s lack of intent. The officer’s falsified records still supported fraud and breach of fiduciary duty claims. The remedies for conversion and constructive trust can matter when the money went into an asset you can trace.

For an outside hacker, the federal Computer Fraud and Abuse Act allows a civil action. Under 18 U.S.C. § 1030(g) that action “may be brought only if the conduct involves 1 of the factors set forth” in a listed subsection. Damages for some of that conduct are limited to economic damages, and the subsection sets its own filing deadline, so check its current text. Collecting a judgment from an unknown or overseas intruder is a separate problem, which is why the bank claim and any insurance deserve attention first.

Protecting a Compromised Business Account

Minnesota law makes an unauthorized payment the bank’s problem first, and then asks what your business did: whether it read its statements, reported quickly, accepted the security the bank offered, and limited who could move money. Each of those facts can move the loss back to you. I suggest putting every disputed payment in writing to the bank, pulling the deposit and online banking agreements, and keeping the bank claim separate from the claim against the person who took the money, because the bank claim runs on its own notice periods. For the broader set of fraud and theft claims, see Minnesota business torts. If you would like me to review the deposit and online banking agreements behind a loss like this, email [email protected] with a brief description.