How to Spot Deceptive Wire-Transfer Emails From Impostor Clients

What fake wire-transfer scams look like?

For accounting and financial firms, this is one of the most expensive scams out there. And AI just made it better—the Wire-Transfer Email That Isn’t From Your Client.

It’s called business email compromise. It doesn’t need malware or a hacked server. It just needs one convincing email and one person who acts on it.

How the scam works

You receive The Wire-Transfer Email That Isn’t From Your Client, which looks like it comes from a known contact. It asks you to send a payment, or to update the bank account where future payments go.

Everything looks right:

• The wording sounds like them. Attackers often read real email threads first, then copy the tone.
• The signature looks right. Logo, title, phone number, all copied.
• The timing makes sense. It shows up right when a closing, invoice, or payment is expected.
• The urgency feels normal. “We need this out today” is something real clients say too.

But it’s not them. Sometimes the email comes from a look-alike address. Sometimes the attacker has broken into the client’s real email account, so it truly comes from their address.

Once the money is wired, it’s usually gone. Wire transfers move fast and are hard to pull back.

Why AI makes it harder to spot

The old warning signs were spelling mistakes, odd grammar, and awkward phrasing. AI tools now write clean, natural emails in any style. They can match a client’s tone after reading just a few of their messages.

“It looked legit” isn’t protection anymore. The email will look legit. You need a check that doesn’t depend on how the email looks.

The one habit that stops it

Any time money is moving or bank details are changing, confirm by phone. Every time.

The details matter:

1. Use a number you already have — from your client file, a past invoice, or your contacts. Never the number in the email; the attacker may have put their own number there.
2. Call, don’t reply. Replying to the email may go straight back to the attacker.
3. Do it even when it’s inconvenient. Even for clients you’ve known for 20 years. Even when they say they’re in a meeting.

A thirty-second call is the cheapest protection your firm will ever have.

Make it a firm-wide rule

One careful person isn’t enough. Make phone verification a written policy that applies to everyone, with no exceptions for urgency or seniority. Tell your clients about it, too. Most will appreciate that you’re protecting their money, and it makes a fake “skip the call” request easier to spot.

It also helps to lock down email accounts with two-step login and alerts for suspicious forwarding rules. Attackers often set up forwarding to hide their tracks. By enforcing strict access controls, firms reduce the risk of unauthorized transfers and data exposure. Monitoring alerts and clear separation of duties further deter insider threats.

We help financial firms lock down where money leaks, including email, payments, and the people in between. That coordination reduces fraud risk and strengthens your security posture across the organization. Together with policy updates, it supports faster detection and response to suspicious activity.

See how we protect financial firms.