The bank codes for the operating account went to a handset the small business owner no longer held.
A service company used the owner's mobile number as the recovery path for the business bank login and for the email that received statements. An actor who already had the name, the number, and enough account trivia from public directories called the carrier, requested a port, and moved the number onto a new SIM. The real phone went silent. Within the same window, password resets and one-time codes for the operating account arrived on the new handset. Transfers left the business checking account before the owner could reach a branch.
The carrier treated the port as a customer request. The bank treated the codes as proof the real person was at the phone. Neither party saw the other. The small business owner learned about it when the handset lost service and the online banking session was already gone.
Getting a number back from a carrier and getting funds back from a bank are two different fights. The carrier wants a fraud ticket and identity papers. The bank wants a dispute packet that may be denied because the codes looked legitimate. Payroll, vendor drafts, and incoming deposits keep hitting the same account number while both desks work.
A small business owner who parks every recovery path on one mobile number has given a single carrier change the keys to the accounts that pay staff and suppliers. Restoring the number does not reverse the wires, and it does not show how many other logins still send codes to that same line.
What are you waiting for? A delinquent vendor? A midnight swatting call? Most Small Business Owners don't act until something forces them to. The RuleDraft Small Business Isolation Manual walks you through the proven steps to fix the exposure before it becomes the emergency.