Wire fraud prevention that shows what changed, reads the email behind it and calls a number you trust, before two people release or stop the wire
Fraudulent wires stopped before they leave; good wires released on time, with two names.
See one case, screen by screen ↓Wire fraud prevention is how a bank's wire room checks outgoing wires for business email compromise and scams before release. Wire Fraud Prevention is wire fraud prevention software in which agents compare each held wire with the client's own payment history, read the email or document behind a new instruction and prepare a callback to a number of known origin. A wire room operator proposes release, stop or return with a reason code, and a second person adds their name.
AI use cases in banking: a buyer's guide to agentic AI for bank and credit union operations →
Updated
Wire fraud prevention breaks down on the wire that looks right. A client's accounts payable clerk gets an email inside a real invoice thread saying a vendor changed banks. The client creates the wire in the treasury management portal, and its token and dual approval pass. The bank's security procedure says the payment order is genuine; the instruction it rests on is not.
For each held wire, an operator opens the payments hub, the portal's audit log, the beneficiary templates and the core banking system, each in its own window, while the Fedwire and CHIPS cutoffs close in. The callback number too often comes from the instruction itself, the one place a fraudster controls. The result goes into a free-text note, and a supervisor approves the release without the evidence in front of them. A wire released to a fraudster is usually gone within hours.
Estimated split for one held wire that needs a callback, worked by hand and with the solution; the call itself still takes a person's time.
Agents show what changed, read the email behind it and prepare a callback to a number of known origin; an operator and a supervisor decide.
Thursday, October 22, 4:22 PM at Corvane National Bank, 38 minutes before the 5:00 PM Fedwire client cutoff. Here is wire fraud prevention on one business email compromise attempt, screen by screen, in the working solution.
Corvane has sent 4,912 outgoing wires worth $10.38 billion so far. The agents held 248; 211 were released after review, 3 attempts were stopped ($1,256,200) and 34 held wires are open. The cutoff runway shows 23 minutes to the 4:45 PM CHIPS client cutoff and 38 to the 5:00 PM Fedwire client cutoff, and Leah's held wires are grouped by cutoff, each with the agents' finding and proposal.
Cleared by the agents: 4 wires, $1,974,950, ready to release in one batch with a second name.
Brightwater Mechanical, Inc. is wiring $286,400.00 by Fedwire to its steel supplier, Kessler Steel Supply Co., for invoice KS-22817. Gina Marsh entered it at 4:11 PM and Carl Lindqvist, the CFO, approved it with his token at 4:16 PM. The agent sets the last 11 payments to Kessler, all to Quillfield Bank, account ending 4471, beside today's instruction: Harrowgate Savings Bank in Houston, account ending 9086. Every value opens its source passage.
3 of 6 fields changed. The name and address are unchanged, and the amount is inside the $41,200–$312,900 range.
The new bank came from an emailed PDF Gina uploaded at 3:47 PM. The email is a reply inside the real invoice thread, but it came from kesslersteeI.com: a capital I (U+0049) where Kessler's domain has a lower-case l (U+006C), registered October 13, 2026, nine days ago. Replies go to kessler.remit@inbox-relay.net, and SPF and DKIM pass only for the look-alike domain.
The attached letter was created October 21 at 11:52 PM on Kessler's 2023 letterhead, with a Houston phone number and the ongoing-audit wording.
The agent takes Kessler's number, (412) 555-0187, from Brightwater's beneficiary template, on file since March 9, 2021 and reconfirmed in April 2025. The PDF's number, (713) 555-0164, is struck out and never offered. The five-line script asks Kessler to state its own bank and account.
From the script: “Never read the new bank or account out. Never confirm the amount first.”
On the recorded line, Janet Pruitt, Kessler's controller, says Kessler still banks at Quillfield Bank, account ending 4471, and sent no change of bank details. The callback agent fills each answer from the recording, and Leah checks and confirms it. At 4:35 PM she calls Carl Lindqvist at Brightwater's number on file, and he asks Corvane to cancel.
Outcome: “Not confirmed: the beneficiary denies the change.”
Leah proposes Stop at 4:39 PM with reason SR-01, beneficiary denies the change (vendor impersonation). Victor Hale, the wire room supervisor, adds the second name at 4:41 PM. At $250,000 and above the second name must be a supervisor, and nobody checks their own decision. The $286,400.00 never left.
The order passed Brightwater's token and dual approval under UCC 4A-202. That proves who sent it, not that the bank details are Kessler's.
The recall agent drafts the message to Carl and Gina: what happened, what Corvane did and what to do now. Pay Kessler with the existing Quillfield template, reset Gina's email password and turn on two-step sign-in, and call Janet at (412) 555-0187. Nadia approves the message, Victor checks it, and only then does it go.
Checked before it goes: no SAR, referral, case number or investigation wording, and no account number in full.
The stopped attempt becomes fraud case FC-2026-1187, with the timeline from the 4:16 PM hold to the stop and the evidence already attached: the payment history, the email header, the domain lookup, the PDF and both recordings. The case and referral agent drafts the referral to the BSA team: attempted transactions are reportable, $286,400 is over $25,000 with no suspect identified, and the SAR is due by November 21, 2026. The fraud analyst approves the referral and a supervisor adds the second name.
The referral is visible to fraud, supervisor and audit roles only, never on a client view.
Brightwater's portal request at 4:12 PM to move Kessler's template to Harrowgate Savings Bank, change BC-2210, is blocked: Janet Pruitt denied it at the number on file, and it is linked to the stopped wire. Every beneficiary change needs a callback at a number of known origin and two names.
Numbers of known origin cannot be changed by email or by the client alone.
The trail shows who held, called, proposed, checked, stopped and told the client, when, why and on which evidence, for people and agents alike, and nothing in it can be edited. For a client dispute, Ruth exports the payment order, the security procedure followed, the email and PDF, both recordings, the stop with both names and the client message. The export itself is logged.
Exports for OCC examiners, internal audit, a client dispute and the BSA officer.
The same wire, seen by the people who call, check, tell the client, open the case and audit it: what their day looked like, and what it looks like now.
Agents show what changed, read the email behind it and prepare a callback to a number of known origin; an operator and a supervisor decide.
Holds wires that meet the callback rules, keeps each rail's cutoff clock, runs the readers, writes the one-sentence proposal and escalates to the supervisor at 30 minutes and the Wire Operations Manager at 15.
Compares the beneficiary name, bank, routing number, account, address, amount and timing with every earlier payment from the client to that beneficiary and with the beneficiary master, and builds What changed.
Reads the email or document behind a new instruction: headers, Reply-To, first hop, authentication results, domain age, the quoted thread and the document's metadata. Compares sender domains with the client's known counterparties letter by letter and flags urgency and secrecy language.
Takes the callback number only from the beneficiary master, the onboarding file or the signed treasury agreement, with its provenance, writes the script and fills the result from the recorded line for the operator to confirm.
For a consumer wire with scam signals, prepares plain, respectful questions for investment, romance, impersonation and elder exploitation scams, and the trusted-contact step.
After a person confirms fraud on a released wire, drafts the Fedwire request for return or the SWIFT recall, the message to the beneficiary bank's fraud desk, the law-enforcement steps and a plain-words client message.
Opens the fraud case with the wire's evidence, tests the SAR thresholds, attempted transactions included, sets the 30-day date and drafts the referral facts for the BSA team.
Each month, counts holds, callbacks and confirmed attempts by callback rule, and backtests rule changes that would avoid callbacks on unchanged wires without missing a confirmed attempt.
Proposes with a reason; a supervisor adds the second name. The agents propose; a named person decides.
Ask about any wire, client, callback or rule. Every answer points to its source.
Why was the Brightwater wire held?
Two things changed at once. Brightwater has paid Kessler Steel 11 times since 2021, always to Quillfield Bank, account ending 4471; today's wire goes to Harrowgate Savings Bank, account ending 9086. The new details came from an email sent from kesslersteeI.com, with a capital I, registered nine days ago. The callback to Kessler at (412) 555-0187, its number of known origin, is ready.
Which held wires could miss the 4:45 PM CHIPS cutoff?
Three of yours go through CHIPS, with 23 minutes left at 4:22 PM: Copperline Logistics, $148,000, waiting for the CEO's callback; Pell & Hargrove, $225,000, and Rivermark Senior Living, $1,240,000, both cleared by the agents and ready to release with a second name. The supervisor was alerted at 4:15 PM.
Has Harrowgate Savings Bank shown up anywhere else today?
Yes. Routing 000062944 is in two held wires today: Brightwater's $286,400 to “Kessler Steel” and Fairhaven Title & Escrow's $612,750 in seller proceeds for 1187 Larkspur Lane, changed by email this morning. Neither client has paid this bank before. The Fairhaven callback goes to the seller's number in the purchase contract.
Draft the message to Brightwater about the stopped wire
The draft says what happened, what Corvane did and what Brightwater should do now, in plain words, with no blame and no SAR or case wording. It names Kessler's number of known origin, (412) 555-0187, and the times from the recordings. Nadia approves it and Victor checks it before it goes.
13 screens from the working solution, on its sample data. Pick one to see it large.
Callback rules, cutoffs, checkers and look-alike detection are settings. Only the Wire Operations Manager changes them, and each change is a new version on the audit trail.
| Setting | Default | Choose from |
|---|---|---|
| The second name must be a supervisor at | $250,000 | $100,000 · $250,000 · $500,000 · $1,000,000 |
| Callback on a first wire to a beneficiary over | $10,000 | $10,000 · $25,000 · $50,000 |
| Hold when the amount is over the client's 12-month median to that beneficiary by | 3× | 2× · 3× · 5× |
| Fedwire client cutoff | 5:00 PM ET | 4:30 PM · 5:00 PM · 5:30 PM |
| Alert the supervisor before a cutoff | 30 minutes | 20 · 30 · 45 minutes |
| Flag sender domains younger than | 30 days | 30 · 60 · 90 days |
| Account numbers | Masked to the last four | Last four · Hidden |
| Keep wires, callbacks and decisions for | 7 years | 5 · 7 · 10 years, never less than five |
Every figure is labelled: a target the solution is built to, an estimate, a typical published result, or a proven one.
“demo” = seen in the working solution, on its sample data · “target” = the design goal, to be measured in the live solution · “estimated” = our estimate · “typical” = published figures (FBI IC3 2024 Internet Crime Report, as summarized by Nacha on April 24, 2025: $2.77 billion in business email compromise losses from 21,442 complaints; AFP 2025 Payments Fraud and Control Survey, April 15, 2025: 79% of organizations targeted by payments fraud, 63% naming wires as the method BEC scammers targeted most). Rules named: UCC Article 4A (4A-202, 4A-211); Regulation J, 12 CFR 210 Subpart B; 31 CFR 1020.320 on SARs and their confidentiality; 31 CFR 1010.430 and 1020.410 on records. Corvane National Bank and the clients, vendors, people, phone numbers, domains and account and routing numbers named on this page are fictional: characters and sample data in the working solution.
Wire fraud prevention is how a bank's wire room checks outgoing wires for business email compromise and scams before release. Wire Fraud Prevention is wire fraud prevention software in which agents compare each held wire with the client's own payment history, read the email or document behind a new instruction and prepare a callback to a number of known origin. A wire room operator proposes release, stop or return with a reason code, and a second person adds their name.
The payment history agent shows what changed against the client's earlier payments to that beneficiary, such as a new bank after 11 payments to the old one. The instruction origin agent reads the email the client acted on: headers, Reply-To, first hop, domain age, the thread it sits in and the PDF's metadata. It shows a look-alike character with its code point, such as a capital I in place of a lower-case l.
The callback agent takes the number only from the beneficiary master, the onboarding file or the signed treasury agreement, shows where it came from, and strikes any number that came with the instruction. Its script asks the other side to state their bank and account and never reads the new one out. The call runs on the recorded line, the agent fills in the result from the recording, and the operator confirms it.
Because in business email compromise the client's own staff create and approve the wire. The security procedure under UCC 4A-202 shows who sent the payment order, not that the bank details belong to the vendor. The held wire screen states which procedure the client agreed to and that it was followed, and the client can still cancel before the wire is sent (UCC 4A-211).
Every held wire sits on a runway to its rail's cutoff: the CHIPS client cutoff at 4:45 PM, the Fedwire client cutoff at 5:00 PM and the Fedwire third-party deadline at 6:45 PM, Eastern time and set by the bank. The coordinator alerts the supervisor 30 minutes before a cutoff and the Wire Operations Manager at 15, and wires the agents cleared go out in one batch with a second name. In the sample month, no held wire missed a cutoff.
A fraud analyst confirms the fraud, and the recall agent drafts the Fedwire request for return or the SWIFT recall, the message to the beneficiary bank's fraud desk and a plain-words client message, each sent only with a second name. On the sample data, a $94,300 wire was recalled 11 minutes after the report and the beneficiary bank froze $61,800. The recall also shows the law-enforcement path: an IC3 complaint, and the Financial Fraud Kill Chain for an international wire.
Yes. Agents compare, read, cite and draft; they never release, stop or return a wire, and never send a message. A named operator proposes every decision with a reason code and a second person adds their name, a supervisor at $250,000 and above. Nobody checks their own decision, and an operator who disagrees with the agents records an override with a reason code and a note.
The Agentic Solution Engine builds and deploys it from your requirements and documents, such as your funds transfer agreement, callback procedure, cutoffs and a sample of past held wires, and it goes live once every quality gate has passed. We will walk you through it on your own wires first.
Every flagged entry decided before the money moves, with the rule it answers beside it.
1-min demoFraud Case ManagementAlerts from every engine in one case, each memo sentence tied to its source.
1-min demoCheck Fraud DetectionBad checks stopped before the money leaves; good deposits released the same day.
1-min demoWe'll run Wire Fraud Prevention on a sample of your own past held wires and callbacks.