The clearest wire transfer fraud red flags are pressure to send money within hours, instructions to keep the transfer quiet, a last-minute change to banking details you already had on file, a beneficiary name that doesn’t match the business you think you’re paying, and emails from addresses that look right at a glance but contain a swapped character. Spotting these before you hit send is the entire game, because wire transfers are nearly impossible to reverse once processed and the main federal consumer protection rule, Regulation E, explicitly excludes them.1Consumer Financial Protection Bureau. Regulation E Section 1005.3 Coverage The burden of catching the fraud falls on you.
Urgency, Secrecy, and Pressure From Authority
Most wire fraud starts with psychological manipulation rather than any technical trick. The scammer’s first goal is to keep you from running your normal verification steps, and the fastest way to do that is to invent a deadline. You’ll hear that a deal collapses within the hour, that a penalty hits at close of business, or that an executive needs the funds moved before boarding a flight. The artificial clock exists to stop you from pausing long enough to call anyone.
Demands for secrecy almost always travel with the urgency. The request will tell you not to mention the transfer to coworkers, your bank, or family. The cover story is usually a confidential merger, a sensitive legal matter, or a surprise acquisition. The real purpose is to isolate you, because a second set of eyes on the request would likely spot the problem.
Impersonation of someone with authority holds the approach together. Fraudsters pose as CEOs, attorneys, judges, or government officials because those roles carry implied power to punish refusal. Threats of termination, arrest, or legal action often follow. Real executives and real officials do not work this way. When urgency, secrecy, and threats arrive in the same message, stop the transaction.
Email Addresses and Communication Channels
Fraudulent wire requests usually arrive through email that contains small technical flaws built to pass a quick glance. Spoofing is the most common method: the sender’s address looks correct but a lowercase “l” has become a “1,” an “o” has become a zero, or an extra character has been added to a familiar domain. During a busy workday these changes are easy to miss.
The Reply-To header is another manipulation point. The display name on the incoming email looks right, but hitting reply routes your response to a different address controlled by the attacker. Hovering over the sender’s name before responding, or checking the full header, catches this.
Generic greetings like “Dear Valued Customer” from someone who supposedly knows you personally deserve immediate suspicion. Awkward phrasing, grammatical errors, or a shift in tone compared to past messages point to someone impersonating a known contact. Sophisticated attackers increasingly use polished language, though, so a well-written email isn’t automatically safe.
A request to move the conversation off your company’s email system and onto personal email or an encrypted messaging app is a serious warning sign. Corporate email systems keep security logs and archives that help detect fraud. Scammers want you in a channel where no one else can see what’s happening.
Last-Minute Changes to Banking Details
A sudden change to established wire instructions is one of the strongest indicators of fraud. If a vendor, attorney, or business partner you’ve been paying for months suddenly provides new account details, treat it as suspicious regardless of how reasonable the explanation sounds. Common pretexts include an account being “under audit,” a bank merger requiring a new routing number, or a temporary account while the regular one is “updated.”
Watch the beneficiary name closely too. Under UCC Article 4A-207, if a payment order identifies the beneficiary by both name and account number and those don’t match, the receiving bank can process the transfer based on the account number alone without checking whether the name matches.2Cornell Law Institute. Uniform Commercial Code 4A-207 Misdescription of Beneficiary Your money can land in a fraudster’s account even when the name on the wire looks wrong on its face. The bank has no obligation to catch the mismatch for you.
Geographic inconsistencies add another layer of concern. A domestic business asking you to wire funds to a bank in a foreign country, or to a bank in an unrelated part of the country, without a clear prior explanation, raises the risk sharply. Criminals use accounts in distant jurisdictions as temporary holding spots before moving funds somewhere recovery becomes nearly impossible.
Red Flags Specific to Real Estate Closings
Home purchases are uniquely exposed to wire fraud because they involve large sums, tight deadlines, and multiple parties exchanging instructions by email. Criminals compromise the email account of a real estate agent, title company representative, or mortgage officer, then wait until closing day and send the buyer fraudulent wiring instructions that look nearly identical to the real ones.
The signals to watch for include last-minute changes to previously confirmed wiring instructions, a claim that the title company can no longer accept a cashier’s check, or a message saying prior funds were sent to the “wrong account” and need to be redirected. The language in these emails often mirrors earlier legitimate messages because the scammer has been reading the whole thread for weeks.
FBI data shows business email compromise schemes, which include real estate wire fraud, generated over $3 billion in reported losses in a single recent year from nearly 25,000 complaints.3Federal Bureau of Investigation. IC3 Annual Report If any change to closing wire instructions arrives by email, call your title company or mortgage officer directly using a number you already have on file. Never call a number included in the email itself.
Suspicious Transaction Patterns
Unusual payment structures should trigger immediate scrutiny. A “test” wire for a small amount before a larger transfer is a classic setup. The scammer uses the small transfer to confirm the account works and to establish your willingness to follow instructions. Legitimate business transactions almost never require test wires outside of highly specialized technical integrations.
Breaking a single large transfer into several smaller payments is another clear warning sign. Criminals use this tactic to avoid triggering bank fraud monitoring or the recordkeeping requirements under the Bank Secrecy Act, which apply to fund transfers of $3,000 or more.4eCFR. 31 CFR 1010.410 Recordkeeping Intentionally splitting transfers to dodge federal reporting is itself a federal crime called structuring.5Office of the Law Revision Counsel. 31 USC 5324 Structuring Transactions to Evade Reporting Requirement Prohibited If someone asks you to break up a payment, that alone is a reason to stop.
The overpayment scheme works differently but is equally dangerous. You receive what looks like a legitimate deposit, then the sender asks you to wire back a portion of the funds. The original deposit was made with a fraudulent check or stolen funds that will eventually bounce. By the time the bank reverses the fake deposit, your outgoing wire is long gone.
Business Email Compromise Within a Company
Business email compromise is the most financially destructive form of wire fraud, with the FBI reporting over $3 billion in losses in a recent year.3Federal Bureau of Investigation. IC3 Annual Report Unlike the clumsy phishing emails most people recognize, BEC attacks are targeted and patient. The attacker spends weeks or months inside a compromised email account, studying payment patterns and names and waiting for the right moment.
The most common scenarios: a fraudster poses as a company executive and directs the accounting team to wire funds urgently; a supplier sends updated banking details for an upcoming payment; or an employee receives what looks like a message from a colleague asking to update direct deposit information to a new account. These requests succeed because they look routine and come from what appears to be a trusted internal source.
The defenses are procedural. Any request to change payment instructions, update vendor banking information, or redirect payroll deposits should require verbal confirmation through a known phone number. Dual authorization for wire transfers above a set threshold prevents a single compromised employee from releasing funds alone.
Verify Before You Send
The single most effective defense against fraudulent wire instructions is verifying every change through a separate communication channel. If the request came by email, pick up the phone and call the person who supposedly sent it. Use a number you already have on file or can independently look up. Never call a number provided in the suspicious email, because the scammer controls that number too.
For businesses handling regular wire transfers, this verification should be mandatory policy. Under UCC Article 4A-202, if a bank and its customer agree on a security procedure for verifying payment orders and the bank follows that procedure in good faith, the customer bears the loss on unauthorized transfers the procedure would have caught.6Cornell Law Institute. Uniform Commercial Code 4A-202 Authorized and Verified Payment Orders In practice, if your bank offered you a callback verification procedure and you declined it or didn’t use it, you may have no legal recourse when a fraudulent wire goes through.
If You’ve Already Sent the Wire
Speed decides whether you have a chance. Call your bank first and ask them to initiate a wire recall. There is no guaranteed timeframe for success, and the process depends on whether the receiving bank voluntarily agrees to return the funds, which becomes far less likely once the money has been moved onward.
File a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov.7Federal Bureau of Investigation. Internet Crime Complaint Center IC3 For international wire transfers of $50,000 or more, the FBI can initiate the Financial Fraud Kill Chain, a process that works through international banking channels to freeze funds before the recipient can withdraw them. This requires that a SWIFT recall notice has already been initiated by your bank and that the FBI is informed within 72 hours. Missing the 72-hour window effectively closes this recovery path. The FTC also takes reports at reportfraud.ftc.gov, and if the wire moved through a money transfer service rather than a bank, contact MoneyGram or Western Union directly.8Federal Trade Commission. ReportFraud.ftc.gov FAQs Most wire fraud victims do not recover their funds, which is exactly why the red flags above deserve a hard stop before the money ever leaves.