Change of bank details on a fund redemption: the fraud and the check

A change of bank details on a fund redemption is any request to pay redemption proceeds to an account the fund has not paid before, whether it arrives as a separate instruction or inside the redemption request itself. It is the point where redemption fraud happens, because a fraudster does not need to forge a holding or a signature, only to persuade the transfer agent to send the investor's money somewhere new. The control that works is simple to state and hard to keep under deadline pressure: hold the payment, call the investor on a number that was on file before the request arrived, never a number in the request, and let a second person who did not prepare or check the request approve the new account. Botminds' Redemption Processing is an agentic solution built around that rule: its agents compare every sender and payee with the records on file, ring the number of record for any new account, and leave the decision to payments control and the fraud analyst.

The examples come from sample data on a fictional manager, Quillfield Capital, on its notice-deadline day of November 16, 2026; the losses and findings come from the FBI and the SEC.

How do fraudsters change bank details on a redemption?

They make the change look like routine correspondence from the investor, usually by email and usually on a busy day. The sample request is typical. At 10:51 on deadline day an email asks to redeem $4,600,000 from a multi-strategy fund for a college endowment and to pay a Miami bank account the endowment has never used. The sender's domain is ashgrove-endowmnet.org, two letters transposed from the endowment's real domain, registered six days earlier, with replies routed to an outside mail service. The signature is a pasted image. The text asks for the redemption to be processed today, kept confidential, and for the desk "not to contact our office".

Other routes reach the same place. In a settled case the SEC found that a threat actor "hijacked a pre-existing email chain" with an issuer client of Equiniti Trust Company and posed as one of its employees (SEC, 2024), so the request arrived in a thread the transfer agent already trusted. A fax can be altered: in the sample, a trustee's faxed request for $250,000 arrives reading $2,500,000. A portal session can be taken over from a new device, with a new payee added minutes before a redemption. Each one changes the instruction, not the signature.

What is business email compromise?

Business email compromise is fraud that uses a compromised or imitated email account to redirect a payment. In the FBI's definition it targets businesses and individuals that regularly make wire payments, and works by compromising email accounts and other channels, such as phone numbers and virtual meeting applications, through social engineering or intrusion, to move funds without authority (IC3, 2025 Internet Crime Report, Appendix B).

A fund redemption fits the definition exactly. The fund regularly makes large payments; the investor is often an institution whose staff email the transfer agent; and a request to change where the money goes is a normal event that happens for genuine reasons too. The fraudster's work is to make a false request indistinguishable from a true one in everything the email shows, which is why the check has to go outside the email.

What is call-back verification?

Call-back verification is a phone call, placed by the fund or transfer agent, to a number it already held for the investor before the request arrived, to confirm the request and the new account with a person entitled to give them. Its strength comes entirely from the number. A call to a number supplied in the request reaches whoever supplied it, and in a business email compromise that is the fraudster. Banks call the same control a wire callback, and the bank-side procedure is set out in Banking's guide to wire callback procedures.

On the sample desk the call-back agent rings the endowment's chief financial officer on the number in Schedule B of the subscription agreement at 11:38, records and transcribes the three-minute call, and asks a plain question: an email asked us to redeem 4.6 million dollars to a new account at a Miami bank; did your office send it? The answer is no, and the banking has not changed. The script says what was received and asks whether the investor sent it; it never asks the investor to confirm details taken from the email as if they were expected.

Every call to the number of record, with the transcript

Which number should you call to verify a change of bank details?

The number the fund held before the request, from a source the fraudster could not have touched: the subscription documents or a verified contact register, maintained under its own controls. Not the number in the email, not the one in the email's signature block, not one a caller gives when they ring in, and not one from a document attached to the request. If the investor's phone number on file was itself changed recently, that change is the thing to verify first.

The SEC's Regulation S-ID points the same way. Mutual funds that offer accounts permitting "wire transfers or other payments to third parties" must run an identity theft programme for those covered accounts (17 CFR 248.201), and the guidelines expect it to check that change-of-address requests on existing covered accounts are genuine, listing a suspicious address change among the red flags (Appendix A to Subpart C of Part 248). A changed bank account deserves at least the care the regulation asks for a changed address.

Who should approve a change of bank details?

Someone other than the person who prepared the request and the person who releases it. Separation is the control examiners look for: SEC exam staff reviewing 75 transfer agents found some without controls "such as requiring confirmation from multiple individuals in order to move issuer funds" (SEC OCIE Risk Alert, 2019). In the sample, a change of payment details goes to payments control, in a lane locked to the preparer and the checker, with the call-back attached.

Requiring all payment instruction changes be made in writing.

SEC OCIE Risk Alert, 'Transfer Agent Safeguarding of Funds and Securities', 13 February 2019, listing robust practices

That practice, observed by the SEC's staff at transfer agents with robust controls, now needs a second half. In 2019 a written instruction was a safeguard against telephone fraud; in a world of compromised mailboxes, writing is how the fraud arrives. The written instruction should start the process, and the call to the number on file and the second approval should finish it.

Red flags on a redemption with new bank details

No single signal proves fraud, and genuine investors change banks. The signals matter in combination, and the sample request shows how they stack.

What did the SEC find at Equiniti?

That a large transfer agent lost client money to two cyber intrusions its controls should have stopped. The SEC's August 2024 settled order against Equiniti Trust Company, formerly American Stock Transfer, found that its failures "led to the loss of more than $6.6 million of client funds" (SEC press release 2024-101). In the first incident, in 2022, a threat actor hijacked an existing email chain and posed as an issuer's employee; in the second, accounts opened with stolen Social Security numbers were linked automatically to real accounts because the numbers matched. Equiniti agreed to a civil penalty of $850,000. The SEC's 2026 transfer agent proposal cites the order as finding a "net loss of approximately $4.08 million total in client funds" (91 FR 56946, note 325).

The lesson for redemption desks is that both incidents exploited trust in an existing relationship, an email thread in one case and a matching identifier in the other. Matching is not verification. A payee check that asks whether the new account looks plausible for the investor will pass a well-built fraud; one that asks whether the investor, reached independently, confirms it will not.

How much is lost to business email compromise, and how much comes back?

Reported business email compromise losses in the United States were $3,046,598,558 in 2025, the second-largest category of cyber-enabled fraud by loss after investment fraud, according to the FBI (IC3, 2025). Recovery depends on speed. Through its Financial Fraud Kill Chain, IC3's Recovery Asset Team worked 3,900 incidents in 2025 involving $1,163,919,846 of attempted theft and froze $679,013,183, a 58% success rate, which works only when victims report fast enough for the receiving bank to stop the money. A wider look at the statistics is in Banking's guide to business email compromise statistics.

No regulator or independent study publishes how much of that loss falls on funds and transfer agents, or how often redemption requests carry fraudulent bank details. A fund can measure its own exposure: count, for the last four quarters, the redemptions paid to an account first used on that payment, how many were called back on the number on file, and how many changes were approved by someone other than the preparer. The share that were not is the exposure. Replaying last quarter's requests shows how to get those numbers from a closed quarter.

What a written payee-change procedure should say

A procedure that works on deadline day answers six questions in advance, so nobody has to decide them at 13:45. Each is a setting a fund can write down and a reviewer can test.

What triggers a call-back. Any new payee, any payee changed within a stated window, and any large payment to an account used for the first time. The sample uses 90 days and $1,000,000; the right numbers depend on the fund's investors and volumes, and they should be versioned so that a change to them is itself approved.

Where the number comes from. The subscription documents or a contact register maintained under its own change controls, named in the procedure, with the rule that a number in the request is never used.

What the caller asks. A short script that describes the request received and asks whether the investor sent it, recorded and transcribed, so the fraud analyst and payments control can hear what was said.

Who may approve. A named role outside the preparer and the checker, with a higher level above a stated amount; in the sample, payments control for any change and the head of investor services for anything over $25 million.

What happens without an answer. The payment waits, the call is retried on a schedule, and the investor is told through the contact details on file that the request is pending.

What is kept. The request as received, the call, the approver and the reason, for as long as the fund's records rules require; the SEC's 2026 proposal would set six years for registered transfer agents, which is a proposal, covered in the SEC transfer agent proposal.

How Redemption Processing holds a new payee

The fraud agent looks at every request for the signals in the table above and holds any request with a new or changed payee; it never clears its own alert. The call-back agent rings the number of record and never one from the request, and it never releases a payment. The processor rejects a confirmed fraud with reason F-01 and an e-signature, which opens a case for the fraud analyst, blocks the lookalike domain and tells the investor on the number of record, not by email. Payments control approves genuine changes; the dealing supervisor releases.

On the sample day the case's look-across finds two more messages from the same lookalike domain, to a relationship manager and to client service, both quarantined, and confirms the Miami account appears on no other request in seven years. November to date, four attempts have been stopped, worth $9.35 million, none paid. Whether to file a suspicious activity report is the financial crime officer's decision; the case carries what they need. The full desk is on the Redemption Processing page.

A fraud case with its timeline and look-across

Questions people ask

Is a written request enough to change bank details on a fund account?

Not on its own. A written instruction gives a record, but business email compromise arrives in writing. Pair the written request with a call-back to a number held before the request and approval by a second person who did not prepare it, and apply the same checks when the change arrives inside a redemption request.

How should an investor change bank details legitimately?

Through the channel the fund documents name, signed by authorised signatories, and expecting a call to the number already on file before any payment goes to the new account. A genuine investor should welcome the call; a request that asks the fund not to call is a reason to call.

What if the investor cannot be reached on the number on file?

Hold the payment to the new account and keep trying; do not switch to a number in the request. In the sample, an unanswered call-back is retried every 30 minutes and the request waits. If the redemption must settle, the documents may allow payment to the account already on file, which the investor can redirect once verified.

Should we email the investor to confirm the new bank details?

No. If the investor's mailbox or the email thread is compromised, the fraudster receives the confirmation request and answers it. Confirmation has to go through a channel the fraud cannot reach, which is why the call goes to a number held before the request arrived.

Can redemption proceeds be paid to a third party?

Only if the fund documents allow it, and many restrict payment to the registered holder. In the sample, third-party payments are never permitted and one fund's payment clause states that no payment is made to a third party. Where a fund does allow it, the third-party account deserves at least the checks of a changed account.

How quickly should a redemption fraud be reported?

As soon as it is found. The FBI's Recovery Asset Team froze 58% of the money in the incidents it worked in 2025, and its Financial Fraud Kill Chain depends on complaints filed quickly enough for the receiving bank to act. Internally, the case should reach the financial crime officer, who decides whether a suspicious activity report is required.