It's been done when using two factor entered into computers (and directly at ATMs; see link at very bottom for the ATM 2-factor SMS problems).
KrebsOnSecurity.com blog lists many banking eheists, including this one:
"The year before the cyber theft, Comerica had switched from using digital certificates to requiring commercial customers to enter a one-time passcode from a security token. The site linked to in the e-mail asked for that code, and Maslowski complied. Within the span of a few hours, the attackers made 97 wire transfers from EMI’s account to bank accounts in China, Estonia, Finland, Russia and Scotland."
Krebs keeps up on this and has a special category for banking eheists:
The most important points I've gleaned from his blog:
banks do NOT reimburse for cyber fraud against business accounts! (unlike consumer accounts).
two factor or any number of computer-only verification is risky if the accounting departments' PCs have been taken over by hackers. (One Krebs story described another eheist from a company that required an employee and manager to separately confirm in their browsers transfers over X; but the hackers had "owned" both PCs and stole both sets of credentials.)
Some "out of band" verification is best, e.g., a phone call to one or two employees/managers for transfers would have thwarted nearly all or all of the eheists Kreb's reported.
Windows PCs are a gargantuan risk for commercial online banking.
For commercial online banking on a Windows PC, temporarily boot from a free LiveCD Ubuntu Linus DVD, which loads Firefox and allows clean online banking because viruses can't write to the DVD and any viruses on the Windows PC will be dormant until the PC reboots into Windows.
(Several of my business clients boot from LiveCD on their Windows PCs when they need to use commercial online banking.)
For the full horror, read through a few years worth of Krebs small business banking heist stories. They sent shivers through my IT small business clients.
Regarding thieves beating 2-factor at ATM machines, it's been done in Europe. Viruses infected PCs AND phones and victims suffered account withdrawals that the banks didn't believe were fraudulent until they mounted: