Who Is Responsible for a Hacked Email Wire Transfer?

Responsibility for a hacked email wire transfer almost always falls on the person or business that authorized the payment. Under Article 4A of the Uniform Commercial Code, adopted in all fifty states, a wire you instructed your bank to send is treated as authorized even if a scammer manipulated you into sending it.¹ The bank acted as a messenger carrying out your order, and the law treats that order as binding. Shifting the loss onto the bank, the hacked counterparty, or an insurer is possible in narrow circumstances, but the default rule is unforgiving, which is why the FBI logged $2.8 billion in business email compromise losses in 2024 alone.²

Why the Sender Usually Absorbs the Loss

Most hacked-email wire fraud is a business email compromise (BEC). A fraudster either breaks into a real email account or spins up a lookalike address with a swapped letter or altered domain, watches a legitimate thread, and at the right moment sends updated wire instructions. The message typically mentions a “new account” or “bank transition,” carries urgency, and arrives when a payment is already expected. No malware is involved. The scheme runs on trust and timing.

Article 4A was built for speed and finality. Once a wire clears, reversing it needs the receiving bank’s cooperation, which you may not get. If your bank followed a commercially reasonable security procedure in good faith, the payment order is binding on you whether or not the underlying instructions were fraudulent.³ The fact that a criminal tricked you into giving the instruction does not make the transfer “unauthorized” under the statute. You told the bank to send the money.

Courts looking at these disputes focus on warning signs the sender missed. Common red flags that pin responsibility on the sender include:

Changed wire instructions arriving only by email, particularly mid-transaction.
Subtle email address changes, such as @compeny.com instead of @company.com, or a reply-to address that differs from the sender line.
Unusual urgency, secrecy, or a request not to call to confirm.
A first-time international wire when prior payments were domestic.

Organizations that lack a verification policy for outgoing wires are especially exposed. If no one requires a second approver for large transfers or a phone call to confirm new payment details, a court will likely treat that as a failure to use reasonable care. The emerging trend is to place BEC losses on whichever party could have most cheaply prevented the fraud, and in most cases, a short phone call from the sender to a known number would have stopped everything.

When the Hacked Counterparty May Share the Loss

Sometimes the breach happened on the other end. A vendor’s or business partner’s email gets hacked, and the attacker uses that access to send fake payment instructions to the vendor’s customers. The sender still issued the wire, but the question becomes whether the hacked party should bear some of the loss for failing to secure their own communications.

This area is still developing. Courts have started allowing claims against the hacked party to proceed where that party failed to use basic protections like two-factor authentication, and the breach of their email is what made the fraud possible. The analysis follows the same “who could have prevented this most easily” logic, and often turns on whether any contract between the parties addressed who bears the risk of payment fraud. If you were the one deceived, the identity of the compromised account matters: a hack of your vendor’s email is a different legal picture than a hack of yours.

When the Bank May Be Responsible

Banks are rarely held liable for BEC wire losses, but it happens. The pivotal question under Article 4A is whether the bank used a commercially reasonable security procedure and actually followed it. “Security procedure” can include callback verification, encryption, or identifying codes agreed to between the bank and the customer. Comparing a signature to a specimen on file does not count on its own.⁴ If the bank and customer agreed on a callback for wires and the bank skipped it, the bank cannot enforce the payment order against the customer.³ The bank carries the burden of proving it complied in good faith.

Proving bank negligence is still an uphill fight. Banks choose which procedures they offer, and the law only asks that they be “commercially reasonable,” not bulletproof. If your bank offered a callback and you opted into a weaker alternative, the bank is likely protected even if a callback would have caught the fraud.

Name and Account Number Mismatches

A separate rule can create bank exposure where the beneficiary name and account number on a wire identify different people. Under UCC 4A-207, the receiving bank can generally rely on the account number alone and does not have to confirm that the name matches.⁵ But that protection only applies if the sender received advance notice that payments could be processed by account number regardless of the name. A non-bank sender who was never told this may be able to recover from the receiving bank when the account holder was not the person they intended to pay. Most banks include this disclosure in their wire transfer agreements, so check yours.

Why Wire Fraud Isn’t Covered Like a Stolen Debit Card

Many people assume a hacked-email wire carries the same federal protection as unauthorized debit card activity. It does not. The Electronic Fund Transfer Act, which caps consumer liability for unauthorized electronic transactions at $50 if reported within two business days, specifically excludes wire transfers.⁶ Regulation E repeats that exclusion for bank-to-bank transfers moved through systems like Fedwire.⁷ A hacked debit card number is “unauthorized use of your account.” A hacked email that leads you to wire $80,000 to the wrong account is “you authorized a transfer to the wrong person.” The distinction decides the case.

What to Do in the First Hours

Speed is the single biggest factor in whether any money comes back. Once funds land in the fraudulent account, they often move overseas within hours.

Call your bank’s fraud department immediately and ask them to contact the receiving bank to freeze the funds. If the money has not yet been withdrawn, a freeze can hold it while the dispute plays out.
File a complaint at ic3.gov with the transaction date, amount, account numbers, and all communications with the fraudster. The IC3 Recovery Asset Team coordinates with banks and FBI field offices to freeze fraudulent transfers.²
Ask about the Financial Fraud Kill Chain. For domestic transfers above a threshold, the FBI can push freeze requests across institutions. In 2024 that process froze $469 million in domestic funds and $92.5 million internationally, with a 66% success rate.²
Preserve the fraudulent emails with full headers, wire confirmations, phone records, and every message exchanged with the scammer. This matters for both law enforcement and any civil claim.

The One-Year Outer Deadline

Even if you discover the fraud months later, Article 4A sets a hard ceiling. If your bank sent you a statement or notification identifying the wire and you fail to object within one year, you lose the right to challenge it entirely.⁸ That applies whether the bank erred or the payment was unauthorized. Missing the window eliminates whatever arguments you might otherwise have had.

Whether Insurance Will Cover the Loss

Standard business policies generally do not cover BEC losses. Because you voluntarily sent the wire, many policies treat the transfer as outside the scope of coverage even though you were deceived.

Two coverages can close the gap. A commercial crime policy covers direct financial losses from fraud, but social engineering losses, where an employee is tricked into sending money, are typically excluded without a specific endorsement, and the sub-limit on that endorsement is usually lower than the policy’s overall limit. Cyber liability policies focus on breach response costs like forensic investigation, notification, and legal fees; coverage for the stolen funds themselves is usually limited or requires a separate social engineering endorsement.

If your business sends wires with any regularity, ask your broker in plain terms whether the policy covers losses from fraudulent payment instructions that an employee voluntarily followed. Many businesses first learn the answer is no after they file a claim.

Tax Treatment When the Money Is Gone

If recovery fails, the tax treatment splits by whether the loss was business or personal. Businesses can generally deduct wire fraud losses as theft losses in the year of discovery, reduced by any insurance or other reimbursement, reported on Form 4684 using Section B.⁹ If a pending insurance claim could reduce the loss, you may need to wait for that claim to resolve before taking the deduction.

For individuals the rules are tighter. Since 2018, personal theft losses have been deductible only when tied to a federally declared disaster. A wire fraud loss arising from a transaction entered into for profit, such as a real estate purchase or an investment, may still qualify as a deductible theft loss, provided the loss qualifies as theft under your state’s law and you have no reasonable prospect of recovery.¹⁰ A tax professional can confirm whether your facts fit.

1
Legal Information Institute (LII) / Cornell Law School. Uniform Commercial Code Locator
2
Internet Crime Complaint Center (IC3). 2024 IC3 Annual Report
3
Legal Information Institute (LII) / Cornell Law School. UCC 4A-202 – Authorized and Verified Payment Orders
4
Legal Information Institute (LII) / Cornell Law School. UCC 4A-201 – Security Procedure
5
Legal Information Institute (LII) / Cornell Law School. UCC 4A-207 – Misdescription of Beneficiary
6
Office of the Law Revision Counsel. 15 USC 1693a – Definitions
7
eCFR. 12 CFR 1005.3 – Coverage
8
Legal Information Institute (LII) / Cornell Law School. UCC 4A-505 – Preclusion of Objection to Debit of Customer’s Account
9
Internal Revenue Service. Topic No. 515, Casualty, Disaster, and Theft Losses
10
Internal Revenue Service. 2025 Instructions for Form 4684 – Casualties and Thefts