Wire fraud red flags: what a wire room can see before release

The red flags of wire fraud are the details that differ from what a genuine payment would look like: an emailed instruction whose wording, timing or amount departs from the customer's earlier ones, a sender address altered by a character, a known payee suddenly paid at a new account, a request marked urgent or confidential, and a person who cannot say how they verified the change. FinCEN, the Treasury's financial-intelligence unit, published the core list in 2016, developed in consultation with the FBI and the Secret Service, and confirmed in 2019 that it still applies. The difficulty is not knowing the flags but seeing them: most of them live in an email or a payment history that the wire room's screen does not show. Botminds' Wire Fraud Prevention reads both and puts the flags on the held wire, from the field that changed to a look-alike character with its code point, so the operator and the checker decide on them before release.

The examples come from a fictional sample bank running the solution: Corvane National Bank, which on Thursday 22 October held a $286,400.00 wire from its client Brightwater Mechanical to a steel supplier after the supplier's bank details changed by email.

What are the red flags of wire fraud?

Wire fraud red flags fall into three groups: signs in the instruction, signs in the beneficiary, and signs in the person or conversation behind the request. FinCEN's 2016 advisory on email compromise lists eleven, and its 2019 update says the "red flags from the 2016 BEC Advisory remain relevant and can be useful to financial institutions". Almost all of them describe business email compromise, because that is where a genuine-looking wire hides a false instruction.

FinCEN attaches a caution to the list, warning that no single red flag necessarily indicates suspicious activity, and a wire room should take it literally.

Financial institutions should consider additional indicators and the surrounding facts and circumstances, such as a customer's historical financial activity and whether the customer exhibits multiple red flags, before determining that a transaction is suspicious.

FinCEN Advisory FIN-2016-A003

Read that way, a red flag is a reason to look, and the customer's own history is what the look is measured against. A company that genuinely changed banks will show one flag; a forged change usually shows several, because the fraudster controls the email but not the history.

Red flags in the instruction: the email behind the change

The instruction carries the most red flags and is the part a wire room usually cannot see. FinCEN's list starts with instructions that "contain different language, timing, and amounts than previously verified and authentic transaction instructions", and continues with altered sender addresses, urgency and secrecy, and delivery timed to leave no room to check.

The sample email shows how these look in practice. It arrived as a reply inside the supplier's real invoice thread, so the conversation looked continuous. Its sending domain was kesslersteeI.com, with a capital I (Unicode U+0049) where the supplier's domain has a lower-case l (U+006C), registered nine days before. Replies were directed to a different domain. The attached letter, on the supplier's 2023 letterhead, had been created at 11:52 p.m. the night before and gave an ongoing audit as the reason for the new account. The clerk uploaded it at 3:47 p.m., about an hour before the bank's 5:00 p.m. Fedwire client cutoff.

The instruction's red flags, read letter by letter

None of these alone proves fraud. A young domain may belong to a rebranded supplier; a late-night letter may be genuine. Together, and set against the payment history, they are why the wire was held and the supplier called.

Red flags in the beneficiary: new account, new bank, first payment

The beneficiary carries the red flag that is hardest to fake: a change from the customer's own history. FinCEN's list includes instructions that pay a known beneficiary at a different account, a first payment to a beneficiary with no history, and further payments soon after a successful one to a new account. Each is a comparison with the past, which is why a payment history matters more than any single rule.

In the sample wire, Brightwater had paid the supplier 11 times since 2021, always to Quillfield Bank, account ending 4471. Today's instruction named Harrowgate Savings Bank in Houston, account ending 9086: three of six fields changed, while the name, the address and the amount, inside the usual $41,200 to $312,900, stayed the same. That pattern, everything familiar except where the money goes, is the signature of vendor impersonation.

What changed: the beneficiary red flag on the held-wire screen

A domestic destination is not reassurance. FinCEN found in 2019 that business email compromise incidents were "increasingly involving initial domestic funds transfers, rather than international, likely taking advantage of money mule networks across the United States". Nor is one bank in isolation: at the sample bank, the same new receiving bank appeared that afternoon in a second client's held wire, $612,750 of a title company's seller proceeds, also changed by email that morning.

Red flags in the person and the conversation

Some red flags only appear when someone talks to the customer. FinCEN lists a client employee who emails instructions based solely on messages from executives or attorneys but "indicates he/she has been unable to verify the transactions", and an instruction from an employee newly authorised on the account or who has never sent wires before.

In a callback, the flags are in how the other side answers. A genuine supplier states its own bank details without prompting; a fraudster asks you to read them out. A genuine controller answers on the number in your records; a fraudster gives you a new one. The sample call reached the supplier's controller at the number in the client's beneficiary template, and she said the supplier still banked at Quillfield and had sent no change. For consumers, the signs are different again, a customer taking directions on the phone or in a hurry to pay a stranger, and whether a bank can hold that customer's wire is a question of its own.

Which businesses do BEC criminals target?

Businesses that pay or receive large sums by email arrangement are targeted most. FinCEN's 2019 analysis found the top three sectors in business email compromise cases were "(1) manufacturing and construction (25% of reported BEC cases); (2) commercial services (18%); and (3) real estate (16%)". Real estate schemes target down payments and sale proceeds; manufacturers and builders pay suppliers in large, recurring amounts.

For a wire room the practical use is weighting. A changed account for a construction client's supplier, or a title company's seller-proceeds instructions changed by email, deserves the callback first. The sample bank's two flagged wires that afternoon were exactly those: a mechanical contractor paying a steel supplier, and a title company paying a home seller.

Which kinds of wire fraud are rising?

Scams that deceive the account holder are rising fastest on wires, ahead of business email compromise. In the Federal Reserve Financial Services risk officer survey, fielded in late 2025, 38% of institutions said account holder scams on wires were increasing, 20% said business email compromise was increasing, and 14% said account takeover was. The survey notes that it is "not independent academic research" and carries a ±6% margin of error.

The difference matters for red flags. Business email compromise leaves its marks in email and payment history. An account holder who has been scammed, into an investment or by someone posing as their bank, sends the wire themselves, from their own device, to a destination the scammer chose. The red flags are in the destination and the conversation, not the email.

Deepfake and AI red flags

Generative AI changes how convincing the instruction is, not which red flags a payment shows. FinCEN's 2024 alert on deepfake media lists red flags mostly aimed at identity checks, but several apply to a wire room's verification: a customer who "attempts to change communication methods during a live verification check due to excessive or suspicious technological glitches", a customer who declines multifactor authentication, and geographic or device data that do not fit the customer. The same alert warns that criminals have reportedly used AI tools to impersonate executives and instruct staff to send large payments.

The FBI's 2025 report counted more than 22,000 complaints reporting AI-related information and over $30 million in business losses to business email compromise involving AI, and notes that voice cloning can be used to request wire payments. For red flags, the lesson is to rely on facts a fraudster does not control. A cloned voice cannot change a payment history, and it cannot answer at a number the bank held before the request arrived.

What to do when a red flag shows before release

Hold the wire, test the flag through a channel the fraudster does not control, and decide with two names. In practice that is a callback at a number of known origin, with a script that makes the payee state its own details; the wire callback procedure is set out step by step elsewhere. If the callback confirms the change, release; if it denies it, stop, tell the client in plain words, and block any matching template change.

A red flag that turns out to be fraud also has a reporting consequence, even when no money moved. FinCEN's 2019 advisory says that for email compromise fraud involving fraudulent payment instructions, a bank must file a SAR whether or not the scheme, or the payments in it, succeeded, subject to the usual thresholds; for national banks, those include $25,000 regardless of whether a suspect is identified (12 CFR 21.11). FinCEN asks banks to use the key term "BEC FRAUD" in such reports.

In the solution, a stopped attempt becomes a fraud case with its evidence already attached, and a case and referral agent tests the thresholds and drafts the referral facts for the BSA team, which decides on any filing; nothing it writes reaches a client view. If a red flag is spotted only after a wire has left, the next steps are recall and tracing, the work of Wire Recall Management. To see the flags on a held wire, start from Wire Fraud Prevention.

Questions people ask

Is a changed bank account always a red flag?

It is always a reason to verify, not proof of fraud. Companies do change banks; FinCEN lists a known beneficiary with different account information as a red flag because forged changes look exactly like genuine ones in the payment fields. A callback to the payee at a number already on file settles which it is.

What does a fake wire instruction look like?

Usually like a real one. The sample forgery was a reply inside the genuine invoice thread, on the supplier's own letterhead, for an amount inside the client's usual range. The differences were a single character in the sender's domain, a reply address at another domain, a letter created late the night before, and a new bank.

Are red flags different for incoming wires?

Some are. FinCEN lists an incoming wire that names a beneficiary who is not the account holder of record, which may mean a victim was tricked into sending to a fraudster's account. Receiving banks also watch for new accounts that receive large wires and move the money on quickly.

How many red flags should trigger a hold?

FinCEN does not set a number; it tells banks to weigh flags together with the customer's history. Many banks hold on a single high-value flag, such as changed bank details for a known payee or a first wire to a new payee above an amount, and use the others to decide what to ask on the callback.

Who should see the red flags: the operator or the supervisor?

Both, on the same screen. The operator needs them to decide what to ask and what to propose; the supervisor needs them to make the second name mean something. A checker who signs without seeing the flags is approving the maker's note, not the wire.