Wire Fraud Prevention for Executive and Finance Assistants

Business email compromise is one of the costliest forms of cybercrime. The FBI's Internet Crime Complaint Center reports business email compromise among the top categories of reported losses year after year; its annual reports document the scale. The schemes are often simple: an attacker impersonates an executive or a vendor and asks someone to send money. Assistants who manage executives' inboxes or prepare payments are frequent targets.

The good news is that a few well-designed controls stop most of these attacks. This guide explains them, with a focus on assistants who support executives and finance teams. It builds on our earlier payment fraud controls guide, going deeper into wire-specific scenarios and controls.

How wire fraud schemes work

Common patterns include:

• CEO or CFO impersonation: an urgent, confidential request to wire funds for an acquisition, a deal or a vendor, often sent when the executive is traveling.
• Vendor bank-change fraud: a supplier's email is spoofed or compromised, and the attacker sends new bank details just before a payment is due.
• Real estate and closing fraud: fake wiring instructions sent during a property transaction, targeting buyers, sellers or their representatives.
• Payroll diversion: an employee's direct deposit details are changed through a fake request to HR or payroll.
• Attorney or advisor impersonation: a message appearing to come from outside counsel requests urgent payment.

What they share is a request to send money, or change where money goes, delivered through a channel the attacker controls.

Control 1: verify every bank detail change by phone

The most effective single control: never change bank details, or send money to new details, based on an email, text or letter alone. Instead:

• Call the requester using a phone number from your own records, such as the vendor master file or company directory, never a number in the request.
• Confirm the change with someone you know at the vendor.
• Document who you spoke to, when and what was confirmed.
• Have a second person approve the change in the system.

This control alone defeats most vendor bank-change schemes.

Control 2: separate preparation from approval

Assistants can prepare payments, but approval and release should require a separate authorized person, ideally with step-up authentication in the banking platform. Dual control means one compromised account or one deceived person cannot move money alone. Banks offer approval workflows and user-level limits; use them.

Control 3: confirm unusual executive requests

When a request appears to come from an executive and involves money, gift cards, sensitive data or secrecy, the assistant verifies through a different channel: a call to the executive's known number, a message in the company chat tool or a word with the executive in person. Executives should explicitly tell assistants to do this and never penalize them for delaying an unverified request.

Control 4: keep the vendor master clean

The vendor master file, where bank details are stored, should be protected:

• Limited edit access, with changes logged.
• Changes only through a documented process with verification and approval.
• Periodic review of recent changes by someone independent.
• Alerts on bank detail changes in your accounting or AP system, if available.

Control 5: watch for warning signs

Train assistants to pause when they see:

• Urgency, secrecy or pressure to bypass normal procedure.
• New bank details, especially in a different country or name from the vendor.
• Slight changes in email addresses or domains.
• Requests that arrive when the executive is traveling or unavailable.
• Changes in tone, grammar or signature.
• Requests to communicate only by email or a new phone number.

Our phishing awareness training guide covers how to build these habits.

Control 6: positive pay and bank tools

Banks offer services that help, such as positive pay for checks and ACH, payee verification, and alerts for new payees or large payments. Your finance team can work with your bank to enable them. Assistants should know which protections exist and what alerts mean.

Testing your controls

Controls only help if they work under pressure. A few ways to test them without risk:

• Tabletop exercises: walk through a scenario, such as a vendor bank-change email, with the assistant, the approver and finance leadership, and check each step against the written procedure.
• Process audits: review a sample of recent bank detail changes and confirm each has a documented verification call and second approval.
• Simulated requests: include payment-request scenarios in your phishing simulation program, with your security team's approval and the provider informed.

Treat any gap found as a process improvement opportunity, not an individual failure.

What to do if money has been sent

Speed matters. If a fraudulent wire is suspected:

1. Call your bank immediately and ask them to attempt a recall of the wire.
2. Report to the FBI's Internet Crime Complaint Center at ic3.gov. Quick reporting can help with recovery efforts.
3. Notify your security team to investigate account compromise.
4. Preserve evidence: emails, headers, phone logs and documents.
5. Notify affected parties, such as the real vendor.

Assistants should know this sequence and their role in it: reporting immediately and preserving evidence.

Real estate and closing payments

Companies that buy or lease property, and executives handling personal real estate transactions, face a specific risk: fake wiring instructions sent during a closing. Attackers monitor compromised email accounts of agents, title companies or attorneys and send altered instructions at the last minute. Assistants coordinating these transactions should:

• Obtain wiring instructions in person or through a secure portal provided by the title company or attorney, and confirm them by phone using a number obtained independently, such as from the company's official website or a previous verified contact.
• Treat any change in instructions as a red flag requiring fresh verification.
• Confirm receipt with the recipient by phone immediately after sending.

The same principle applies: never rely on email alone for where money goes.

Payroll diversion

Payroll diversion is quieter but common. An attacker emails HR or payroll, posing as an employee, and asks to change direct deposit details. Assistants who support HR or handle payroll requests should require changes through the payroll system's authenticated self-service, or verify by phone using the employee's number on file, never by email. Notify the employee through a known channel after any change, so they can flag it if they didn't request it.

Building a written procedure

A one-page payment procedure, signed off by finance leadership, gives assistants clarity:

• Who can request payments and how.
• Who can approve and release, with limits.
• How bank detail changes are verified and approved.
• How executive requests involving money are verified.
• What to do when something seems wrong, including after-hours contacts.

Review it with each new assistant during onboarding and whenever roles change.

A worked example

An executive assistant supports a CFO who is traveling. An email arrives, apparently from the CFO, asking her to arrange an urgent wire to a law firm for a confidential acquisition and not to discuss it with anyone. The display name is right, but the address is from a lookalike domain. Following the procedure, she doesn't reply. She messages the CFO through the company chat tool and calls his mobile from the directory. He confirms he sent no such email. She reports the message to security, which blocks the domain and alerts finance. The procedure worked because it removed the need for judgment under pressure.

Common mistakes

Trusting a letter on letterhead. Letterhead is easy to forge.

Calling the number in the email. It may belong to the attacker.

Single-person payment release. Use dual control.

Executives who discourage verification. Leaders must support it explicitly.

Frequently asked questions

Should assistants have authority to release wires?

Generally, no. Assistants can prepare; authorized staff approve and release.

What if the executive insists there's no time to verify?

The procedure applies to everyone. A legitimate executive will understand. Agree this in advance.

Are remote assistants a higher risk?

The risk comes mainly from process gaps, not location. The same controls protect in-house and remote staff.

Does ExecWing train assistants on payment fraud?

Yes, and we align with your procedures. See security and procurement.