Cyberattack and the risk to wire transfers

A typical wire transfer scam works like this: A bad actor intercepts a conversation between individuals communicating by email about a scheduled transaction and modifies wire instructions so the payment, which may be substantial, ends up with the bad actor instead of the intended recipient. Before anyone notices the fraud, the money is long gone. 

How can businesses avoid a catastrophe involving BEC fraud? Below are some best practices for minimising risk and creating more secure wire transfers:

1. Confirm wire instructions orally by phone with a known and verified contact at a known and verified phone number. Do not provide any sensitive information or wire instructions in response to a received call — always dial the known number yourself.
2. Verify instructions thoroughly. Never confirm wire instructions via email.
3. Use a secure communication channel and two-step verification. Two-step verification means providing partial wire instructions via encrypted secure platforms and requiring a phone call to receive the complete wire instructions.
4. Carefully confirm all details. Double- and triple-check bank names, routing numbers, SWIFT codes, account numbers, and all other related wire transfer information for accuracy.
5. Watch for red flags. Be cautious if someone requests an urgent or last-minute change to previously provided instructions. Even a plausible-sounding email with unexpected changes should be vetted and verified. Scrutinise emails with poor grammar, unexplained urgency, or misspelled email addresses.
6. Conduct internal reviews. Within your organisation, separate the responsibilities for initiating, authorising, and reviewing wire transfers. Document and review each transaction before submitting the wire request.
7. Confirm receipt. Ask the recipient to confirm via phone that they have received the funds immediately after the transfer is completed.
8. Train your team. Educate employees on recognising and preventing wire fraud, phishing, and BEC schemes. Conduct periodic security awareness programs.
9. Implement cybersecurity measures. Keep software, firewalls, and anti-virus tools updated to prevent hacking attempts. Avoid conducting business, especially any access to banking portals, on unsecured public Wi-Fi networks, and always use multi-factor authentication. Strengthen information security policies and procedures, including incident response plans.

By implementing these safeguards, a business can reduce the risks associated with BEC fraud and wire transfers.

---

Jason Hirsh is a Partner with Levenfeld Pearlstein, and is the Practice Group Leader of the Litigation Group. Jason’s practice involves business litigation, including litigation of wire-transfer and ACH fraud-related disputes and consulting regarding such matters. 

Katie Nadro is a Partner with Levenfeld Pearlstein in the Corporate Group, where she advises clients on cybersecurity, data privacy, and artificial intelligence matters.