Capital call wire fraud: test your checks with planted fake notices

To find out whether your capital call wire checks work, copy a month of real notices into a test queue, plant fakes built the way fraudsters build them, and count what the process stops before payment, what genuine notices it wrongly holds, and how long each decision takes. Reading the procedure tells you what people are meant to do; a planted fake tells you what they do on a Tuesday with twenty notices due. Luxembourg's financial intelligence unit tells you what to plant: in the reports it reviewed for 2025, 60% of suspicions involved fraudulent capital call notices, 70% of cases used spoofed or lookalike email addresses to change payment instructions, and only 45% were caught before any money moved. Botminds' Capital Call Processing is built to be tested this way, and this guide is as much a test of it as of your current process.

The seed set and scoring method are ours, built from published fraud patterns. The screens come from fictional sample data: Quillfield Capital, an LP with 412 commitments to 168 GPs, as its notices run through the solution.

How do you verify capital call wire instructions?

Verify capital call wire instructions by comparing every bank and sender detail with the details verified when you subscribed to the fund, and by calling the GP back on a number from your own files before paying any change. Never verify against the last email, and never call a number printed in the notice being checked.

That is the control the test measures. FinCEN describes the same idea as hardening how an organisation authenticates the people it communicates with, authorises transactions and handles "changes about transactions", and recommends "A multi-faceted transaction verification process, as well as training and awareness-building to identify and avoid spear phishing schemes" (FIN-2019-A005). A capital call notice template, set against a fake, lists the fields a fraudster changes.

Why test with planted fakes instead of reading the procedure

Because a procedure passes an audit by existing, and a process stops fraud by working on the day. The fakes that succeed are the ones that look routine: right fund, right amount, right layout, a plausible reason for new bank details, and a due date close enough that a call-back feels like a delay.

The published numbers say the gap is real. Only 45% of the cases in the Luxembourg reports "were identified before any fraudulent transfers occurred" (CRF Trend alert #2), and FinCEN's advice is blunt about timing: the fraudulent instruction has to be caught before the payment goes out, because that is where unauthorised transfers are prevented (FIN-2019-A005). A test measures the one thing that matters, the share stopped before payment, on your own notices.

What to plant: a seed set built from what investigators saw

Plant fakes in the proportions fraudsters use them, and include the ones your process is least likely to catch. The CRF's figures set the shape: capital call notices are the main vehicle, lookalike addresses are the main sender trick, and compromised real mailboxes are the hard case.

The wrong-amount seed is there to test the opposite failure. A process that holds every odd notice is not safe; a call held past its due date can be a default under the fund's terms. The right answer for a genuine call with a wrong fee is to pay it in full and query, and the seed tests that people know the difference.

How do fraudsters change wire instructions?

Fraudsters change wire instructions in one of two ways, and the test should cover both. The CRF found payments redirected "either by changing both the beneficiary and bank (often located in a different jurisdiction) or by only replacing the bank account with a PSP or e-money account", after which "Funds are rapidly routed through shell companies across different jurisdictions" (CRF Trend alert #2).

The second way is the harder one for people, because the beneficiary's name is right. FinCEN's red flag describes it exactly: instructions that pay a beneficiary the firm already knows, but into an account that differs from the one used before (FIN-2016-A003). A reviewer who checks that the payee is the fund will pass it; one who checks the account against the verified details will not.

What are lookalike domains, and the seed that uses the real one

A lookalike domain is an internet domain registered to resemble a real one, by adding, changing or deleting a character, such as a hyphen inserted between two words of the GP's name. Email from it passes the eye of a busy reader, and the CRF's 70% figure says it is the most common sender trick against the sector.

The harder seed uses the GP's real mailbox. The CRF describes fraudsters who "aim to compromise email accounts of professionals of the investment sector" and use those trusted identities, and cases where the hijacked account first built trust before lookalike domains took over, as the notice-by-notice comparison describes (CRF Trend alert #2). No domain check catches a compromised mailbox; only the comparison of bank details and the call-back do, which is why the seed set gives it four of twenty slots.

Running the test without risking a real payment

Run the test on a copy that cannot pay anyone, with the people and rules exactly as they are on a normal day. Three things make it realistic: seeds arrive by the same channels as genuine notices, at random times; the team is told a test will happen this quarter but not when; and call-backs go to a test line answered by the organiser, who plays the GP and records what was asked.

The last point matters more than it looks. Much of a call-back's value is in how it is made: whether the number came from the files, whether the caller asked open questions, whether the new details were read aloud for the "GP" to confirm. A test line lets the organiser score the call itself, not just whether one was logged.

A call-back that can be scored: the number used, the questions asked, the answer

How to score it: catches, false holds and time to decide

Score three numbers and one behaviour. The catch rate is the share of seeds stopped before release; the false-hold rate is the share of genuine notices held without cause; the time to decision is how long a held notice waits for a person; and the behaviour is whether every call-back used a number on file.

Read the numbers together. A perfect catch rate with a high false-hold rate means the process is stopping everything and people are learning to wave holds through; a low false-hold rate with misses means the comparisons are too loose. The target is every seed caught, early, with genuine calls paid on time.

What should you do if a capital call wire was sent to a fraudster?

Call your bank immediately and ask it to recall the wire, then report it to law enforcement; in the United States, at ic3.gov. The FBI's advice is to move at once: ask your bank to recall the funds, and be ready to sign whatever indemnity the bank asks for (IC3 2025 report).

Speed changes the odds. The FBI's Recovery Asset Team started its Financial Fraud Kill Chain freeze process in 3,574 domestic incidents in 2025, with $507,042,623 frozen, and FinCEN reports that recoveries go better when a fraudulent wire reaches law enforcement within a day (FIN-2019-A005). The bank's side of a recall is its own process; the first hour of a wire recall covers it from the bank's desk.

What to ask of capital call software before you buy

Ask any capital call tool to run your seed set on your own notices before you sign, and ask the questions that decide whether it would have stopped the fakes. A vendor that declines this test is asking for trust it has not earned.

Five questions separate a control from a dashboard. Where do the verified bank details come from, and who verified them? Does a changed detail block payment, or only raise a flag someone can dismiss? Who can unblock a payment, and does that need two people who did not request the change? Does the call-back use only numbers on file, and is it recorded? And can the tool show, for any past payment, what it compared and who decided? Text analysis alone is weak: businesses reported more than $30 million of 2025 losses to business email compromise involving AI (IC3 2025 report), and a well-written fake reads like a real one.

How Capital Call Processing would face the same test, and its limits

Capital Call Processing is designed to pass this test and to be put through it. The Fraud agent holds twelve fields of every wire and its sender against the details verified for that GP fund, including the sending domain, the channel, the signer and the phone number, and any changed payment detail blocks payment; it never unblocks a payment and never uses contact details from a notice. The Callback agent calls only numbers from the subscription documents or the GP contact record and records the call; a person reviews it and decides. A genuine bank change needs two call-backs and two approvers, neither of them the requester, and those rules are locked.

Every check and decision on the chained audit trail, for whoever scores the run

The solution's own changes go through a version of the same test: a new prompt or model runs against a set of 640 notices and 214 fraud tests before the operations manager approves it. That is a design target of the product, and the right response is to ask for your own run on your own notices rather than take it on trust.

It has limits a buyer should hear. It is only as good as the verified details it starts from, which are built at go-live from signed subscription documents and confirmed by call-back. It works on the LP's side; the bank's own controls on outgoing wires are a different job, covered by wire call-back procedures at banks. And it drafts the fraud case, the IC3 complaint and the letters, but recovering money is for the bank and law enforcement. To run the test on your notices, start from Capital Call Processing.

Questions people ask

How often should we test our capital call wire controls?

At least once a year, and again after any change of people, systems or thresholds. Re-use last run's seeds alongside new ones, so you can see whether a fix held as well as whether a new pattern gets through.

Who should run the test?

Someone outside the team being tested, such as internal audit or the financial crime officer, who can plant seeds without warning, answer the test call-back line and score the results independently.

Can we test on the live queue?

Not safely. A planted fake in the live queue can be paid by mistake, and a held genuine notice can become a default. Use a frozen copy that cannot reach the payment system, with the same rules and people.

What catch rate is good enough?

No regulator or independent study publishes a benchmark for capital call fraud controls, so set the bar yourself: every seed stopped before release, genuine calls paid on time, and every call-back made to a number on file. Then measure each run against the last.

Does staff training stop capital call fraud?

It helps, and FinCEN pairs training and awareness with "A multi-faceted transaction verification process". Training alone fails on the fake that looks routine, which is why the test checks the comparison with verified details and the call-back, not whether people can spot a suspicious email.

What should capital call wire instructions include?

The beneficiary name exactly as on the fund's account, the bank, routing number or SWIFT code, account number or IBAN, any intermediary bank and a payment reference. Every field should match the details you verified at subscription; a notice is never the place a change should first appear.