Guide
Wire Fraud and Business Email Compromise Prevention for Financial Firms
Criminals impersonate clients, executives and vendors in email to redirect wires and distributions. Here is how financial firms stop it, and what to do in the first hours if money has been sent.
Key takeaways
- Business email compromise tricks staff into sending money or data by impersonating a client, executive or vendor in email.
- The strongest single control is a call-back to a known phone number before acting on any new or changed payment instructions.
- Multi-factor authentication, email security and staff training make hacked accounts and spoofed messages much harder to use.
- If money has been sent, call your bank at once and report it to the FBI at ic3.gov. Speed matters for recovering funds.
Why it matters
Why financial firms are targets
Financial firms move client money every day, and many requests still arrive by email. That makes advisers, broker-dealers, accounting firms, insurance agencies and private equity firms attractive targets. In its 2025 Internet Crime Report, the FBI Internet Crime Complaint Center recorded more than $3 billion in reported losses from business email compromise, second only to investment fraud.
A single fraudulent wire can mean a direct loss, an unhappy client and questions from regulators and insurers. Most of these attacks rely on a hurried employee trusting an email, so a few firm-wide habits stop most of them.
How it works
How business email compromise works
- Hacked client email: a criminal takes over a client’s mailbox and asks for a distribution or wire to a new account.
- Executive impersonation: a message that appears to come from a partner or the CEO asks for an urgent, confidential payment.
- Vendor invoice fraud: a familiar vendor sends an invoice with new bank details, from a hacked or look-alike email address.
- Payroll diversion: an employee seems to ask HR to change their direct deposit account.
- Hidden mailbox rules: after taking over a mailbox, attackers often create rules that hide replies, so the real owner does not notice.
Checklist
Wire fraud prevention checklist for financial firms
- Call-back verification: confirm every new or changed payment instruction and every distribution request by calling a phone number already on file, never a number in the email.
- Dual approval for wires above a set amount, by two different people.
- Multi-factor authentication on email, remote access, client portals, custodian and banking platforms and every system that can move money.
- Email security that filters phishing, flags external senders and catches look-alike domains and impersonation.
- Email authentication with SPF, DKIM and DMARC on your domain, so criminals cannot easily send email as your firm.
- Alerts on risky sign-ins and new mailbox forwarding or rules, reviewed by someone who can act on them.
- Security awareness training with realistic phishing simulations, especially for operations and finance staff.
- Written procedures for wires and distribution requests, including what to do when a request is urgent or unusual.
- Limits on who can change bank details in client and vendor records, with every change logged.
- An incident response plan that names who calls the bank, the insurer and your IT provider.
If it happens
What to do if money has already been sent
- Call your bank right away and ask it to recall the wire and contact the receiving bank.
- File a complaint with the FBI Internet Crime Complaint Center at ic3.gov as soon as possible.
- Call your cyber insurer’s breach hotline before you hire outside help, if your policy requires it.
- Secure the affected email accounts: reset passwords, end active sessions and remove forwarding and inbox rules the attacker created.
- Work out what client information the attacker could see, since that can trigger client notice duties under state law or SEC Regulation S-P. See our Regulation S-P compliance checklist.
Managed IT
How FinFortify helps prevent wire fraud
Email security, multi-factor authentication, sign-in alerts and phishing training are part of our managed cybersecurity services and our Microsoft 365 managed services. We also help your firm write call-back and approval procedures that staff can follow under pressure. For the Microsoft 365 settings that matter most, see our Microsoft 365 security checklist and our cyber insurance requirements checklist.
This guide is general information about IT and cybersecurity practices, not legal advice. Your compliance officer or counsel should confirm how each rule applies to your firm.
FAQ
Wire fraud questions
What is business email compromise?
A scam in which criminals use a hacked or look-alike email account to impersonate a client, executive or vendor and persuade staff to send money or sensitive information.
What is the best way to prevent wire fraud?
Call to confirm any new or changed payment instructions using a phone number already on file, require two people to approve larger wires, and protect email with multi-factor authentication, email security and staff training.
What should we do if we sent a wire to a fraudster?
Call your bank immediately to request a recall, file a complaint at ic3.gov, notify your cyber insurer and secure the compromised email accounts. The faster you act, the better the chance of recovering funds.
Protect client money from wire fraud
Talk with us about email security and wire procedures for your firm.
