Capital call notice template: the fields a fraudster changes

A capital call notice template should give each investor, on its own page, the fund and investing entity, the notice number and date, the amount and due date, what the money is for, the investor's commitment before and after the call, and the bank details with a payment reference. Those are also the fields a fraudster copies. Luxembourg's financial intelligence unit found that fraudsters "appear to have detailed knowledge of the layout, structure, and formatting of genuine documents", so a fake notice looks right and only the bank account and the sender are wrong. Botminds' Capital Call Processing checks the fields that decide it, twelve details of the wire and its sender, against the details verified for each GP fund, and blocks any change until a call-back confirms it.

The fake on this page is fictional sample data: a Monday-night email to Quillfield Capital, an LP with 412 commitments to 168 GPs, as it runs through the solution. The fraud figures come from Luxembourg's financial intelligence unit, FinCEN and the FBI, each linked where it appears.

What should a capital call notice include?

A capital call notice should include everything an investor needs to check the call and pay it without a second document beyond the fund terms. Ten fields do that, and each one exists for a check, not for form.

Is there a standard capital call notice template?

There is no regulatory standard; the format is each GP's choice, bound only by what its partnership agreement says a notice must contain. Investor associations have published model templates, and ILPA's capital call and distribution template is the one investors search for by name, but adoption is voluntary and many GPs and administrators use their own layouts.

The variety is why a template check alone is weak. An LP with hundreds of GPs sees hundreds of layouts, in several languages, and a fraudster who copies one GP's layout exactly passes any test that asks whether the document looks familiar. A template is valuable for the opposite reason: when the fields are in predictable places, a machine or a person can compare each one with what is already known.

What does a fake capital call notice look like? The same, except twelve fields

A fake capital call notice looks like the genuine one in every line an investor checks for arithmetic: the fund, the call number, the amount, the due date and the purpose breakdown. In the sample, the genuine Tollan Ridge Partners Fund VI Call 12 asked for $4,210,000, due Saturday, October 24; the fake, sent on Monday night as "updated wire instructions", asked for exactly the same.

Notice what the fraudster did not change. The intermediary bank, the currency, the payment reference and the signer's name stayed the same, because the reference is copied from the genuine call and a currency change would invite a question. The CRF saw the same choice in its own cases: the fraudster either swaps both the beneficiary and the bank, often for one in another country, or keeps the name and replaces only the account with one at a payment or e-money institution (CRF Trend alert #2; the wire test in the guide to planted fake notices uses both). Either way, a check that compares amounts finds nothing.

The wire against the details on file, field by field

What is capital call fraud?

Capital call fraud is a payment diversion: a fraudster sends an investor a capital call, or a change to a call's bank details, that appears to come from the GP, so that the investor wires committed money to an account the fraudster controls. It is a kind of business email compromise, the FBI's term for scams aimed at businesses and people who routinely pay suppliers and other firms by wire (IC3 2025 report).

Investors are not the only target. The CRF lists four vectors, among them "Fake capital call notices requesting transfer of committed funds sent to investors" and "Fake drawdown notices sent to investment fund administrators", alongside fake invoices to managers and fake loan repayment instructions to investees (CRF Trend alert #2). The common factor is a recurring, high-value wire whose instructions travel by email.

The scale is large. Business email compromise complaints to the FBI reported $3,046,598,558 of losses in 2025, up from $2,770,151,146 in 2024, and the FBI warns that chat tools now write convincing emails in an executive's voice in seconds, with businesses reporting more than $30 million of losses to BEC scams involving AI in 2025 (IC3 2025 report). A well-written fake is no longer evidence of a sophisticated fraudster.

The sender is a field too: lookalike domains and compromised mailboxes

The sending address is the second field a fraudster has to control, and there are two ways to do it. A lookalike domain is registered "by adding, changing, or deleting one or more characters in the legitimate domain name"; a compromised mailbox is the GP's real account, taken over through phishing, so the email passes every technical check (CRF Trend alert #2).

The CRF saw both combined. In some cases "The compromised account was used initially to establish trust and legitimacy", and then "Once confidence was built, fraudulent emails from lookalike domains took over to execute the scam." The sample LP's cases show both on their own. The Tollan Ridge email came from a domain registered nine days earlier; a Brackenfield Capital VII call earlier in the year came from the GP's own compromised mailbox and was stopped by the call-back to the CFO.

Why the domain is suspicious, answered with its sources

The lesson for the template is that the sender must be compared with what is on file, like the bank account. The channel matters as much as the address: all eleven earlier Tollan Ridge calls had come through the GP's portal, and the fake was the first to arrive by email. A compromised mailbox defeats domain checks, which is why the decisive control is still the call-back.

Signs of a fake capital call notice, and what to check each against

The signs of a fake are differences: from earlier notices, from the verified details, from the contract and from how this GP normally communicates. Two regulators' lists cover them, and each points to a specific comparison.

The table also says which checks are weak. Layout is the CRF's own indicator, and the CRF's own finding is that fraudsters know the layout; a fake that looks wrong is easy, and a fake that looks right is the one that costs money. The strong checks are comparisons with information the fraudster cannot see or edit.

How do you verify a capital call notice?

Verify a capital call notice in two steps: rebuild the amount from your own records and the fund terms, then compare every bank and sender detail with the record you verified at subscription, and call the GP back on a number from your files before paying any change. The CRF's advice for the sector comes to the same thing: know which contact person the client has named, and who is authorised to validate and sign a payment (CRF Trend alert #2).

FinCEN frames the same idea as three processes worth hardening: proving who is on the other end of a message, authorising a payment, and passing on changes to a payment's details (FIN-2019-A005). For an LP, the first is the call-back, the second is maker, checker and treasury approval, and the third is a rule that bank changes never travel by email alone.

The call-back has its own discipline: a number from the subscription documents or the GP contact record, never one in the notice; open questions, without reading out the new details; a recording that a person reviews before deciding. Testing capital call wire checks with planted fake notices shows how to find out whether yours would hold.

What GP investor relations teams can put in the template

GPs can make their own notices harder to fake by making differences visible. Four habits help: write the beneficiary name the same way on every notice; publish notices through one channel and say so on each; state on every notice that bank details are never changed by email; and announce a genuine bank change separately, in advance, through the portal, inviting investors to call back on numbers they already hold.

The sample shows why the first habit matters: the fake's beneficiary, "Tollan Ridge Partners Fund VI LP", was close to the real "Tollan Ridge Partners VI, L.P.", and differed from every one of the eleven notices paid. In the United States, GPs that are registered or exempt reporting advisers face a further reason to care: FinCEN's 2024 rule requiring certain investment advisers "to report suspicious activity to FinCEN" (89 FR 72156) now takes effect on January 1, 2028, after FinCEN's effective date was "delayed until January 1, 2028" (91 FR 36).

What Capital Call Processing checks on a notice, and what it leaves to people

Capital Call Processing reads notices in any layout and language, so it does not need GPs to adopt a template; it needs the verified details each notice is compared with. At go-live, each fund's bank and contact details are built from the signed subscription documents and verified by call-back, and from then on the Fraud agent holds twelve fields of every wire and its sender against it: beneficiary, bank, routing, SWIFT, account, intermediary, reference, currency, sending domain, channel, signer and phone.

It does not decide that a notice is fake. Any changed payment detail blocks payment; the Callback agent calls a contact on file and records the answer; a person listens and decides with a reason code; and a genuine bank change needs two call-backs and two approvers who are not the requester. It does not recover money already sent, which is the bank's and law enforcement's work. To see the wire check, the call-back and the case together, start from Capital Call Processing.

Questions people ask

What wire details belong on a capital call notice?

The beneficiary name exactly as on the fund's account, the bank's name and address, the routing number or SWIFT code, the account number or IBAN, any intermediary bank, and a payment reference naming the fund, investor and call. Every one of them should match the details verified at subscription; the notice is not the place a change should first appear.

Who sends capital call notices?

The GP issues them, often through its fund administrator, which calculates each investor's share and posts or emails the notices. Because administrators also send notices, the CRF lists fake drawdown notices sent to fund administrators as a separate fraud vector.

Can a fake capital call come from the GP's real email address?

Yes, if the GP's mailbox has been compromised. The CRF describes fraudsters using compromised accounts of investment professionals to send payment requests, which is why a check on the sending domain alone is not enough and the call-back to a number on file is the deciding control.

What should I do if I paid a fake capital call?

Call your bank at once and ask it to recall the wire, then report to law enforcement; in the US, file at ic3.gov. The FBI stresses speed above everything, and FinCEN reports greater success recovering funds when fraudulent wires are reported within 24 hours.

Do lookalike domains always look obvious?

No. A single added hyphen or swapped letter is easy to miss in a mail client that shows only the display name, which is why comparison should be automatic and against the GP's known domains. In the sample, one hyphen produced a similarity of 0.94 to the real domain.

Does a capital call template stop fraud?

Not by itself: fraudsters copy templates. It helps when its fields are predictable enough to compare with verified details, and when it states that bank details never change by email, which gives investors a reason to treat any such email as suspect.