AegisAI Perspectives · 112
Banks stop wire fraud emails by checking the sender and the change asked for, then holding new instructions for an outbound callback and second approval.
See it on your own Google Workspace or Microsoft 365 tenant. No MX change.
Or get the Q3 2026 State of the AI Attack report (free, instant download)
Banks stop wire fraud emails by checking the sender and the requested change, then holding any new payment instruction until an outbound callback and a second approver confirm it. Reported BEC losses reached $3,046,598,558 in 20251. AegisAI agents check every payment request against the sender's history19. Put the controls below in that order.
Treat any email that asks to send money to a new place as an attempt until it is confirmed. FinCEN lists three red flags that fit most cases. The instruction comes from an address that resembles a known customer's, with one or more characters added, changed or deleted4. It pays a known beneficiary but gives account details that differ from before5. Or it arrives in a way that leaves the bank little time to confirm it6.
The FBI's IC3 counted 24,768 BEC complaints in 2025, against 21,442 in 20242. The guide to choosing email security for a bank or credit union covers the wider threat list. Add the three FinCEN red flags to the wire desk's intake checklist this week.
Short on time? Watch the explainer, or book a demo.
Microsoft states that impersonation can pass SPF and DKIM checks, and DMARC too, when the attacker registers a lookalike domain and publishes valid DNS records17. Nacha tells staff to examine the email address and URL closely, down to the spelling, because scammers rely on slight differences10.
Microsoft's first contact safety tip marks a sender the recipient has never or rarely heard from16. Inbox rules can forward mail to external addresses, either on purpose or because the account was compromised18. Turn on the first contact tip for every mailbox on the wire and treasury desks.
Run each step before the next one, and stop the wire at the first step that fails.
Compare the address with the customer's known address, character by character, and flag a first-time sender.
Flag any instruction that pays a known beneficiary to a new account.
Hold every changed instruction until steps 4 and 5 are done, whatever deadline the email sets.
Confirm the change outside the channel that asked for it7, with an outbound call to a number on file13.
Apply dual controls to transactions above set thresholds8, and keep separation of duties12.
Enforce monetary thresholds and time-of-day restrictions, with automated velocity monitoring on top11.
Review new inbox rules that forward mail outside the bank.
Log the callback number used and the name of the second approver.
FinCEN calls this kind of multi-faceted transaction verification a guard against BEC3. Write the eight steps into the wire procedure and train every desk on them in the same order.
They get around it by supplying the number, and fraudsters spoof phone numbers9. Nacha warns that fraudsters spoof phone numbers, so a call to the requester goes back to a known number only. J.P. Morgan's callback guidance says to always make the call outbound, never rely on an inbound one14. Its wire fraud guide says to confirm a change with a known contact, on a phone number on file.
An instruction sent so the bank has little time to confirm it is itself a FinCEN red flag. Write in the procedure that no deadline in an email shortens the callback step.
Each row is a control, the red flag it answers and where an email layer helps.
| Control | Red flag it answers | Built-in Microsoft 365 | AegisAI |
|---|---|---|---|
| Sender check | Lookalike address with altered characters | Impersonation can still pass authentication | Checks each payment request against the sender's history |
| New sender | First message from this sender | First contact safety tip | Flags a first email from this sender24 |
| Changed account | Known beneficiary, new account details | Not covered in the Microsoft pages used here | Flags a request to change bank details |
| Callback | Phone numbers can be spoofed | Not an email control | Flags a policy that payment changes need a callback |
| Dual approval | Transactions above set thresholds | Not an email control | No edge. Approval stays in your payment system |
The last row gives an email tool no edge, because approval happens in the payment system, not the inbox. Score your current stack on every row, then use the demo request page to test rows 1 to 3 on your own mail.
AegisAI agents check every payment request against the sender's history. They read the thread the way an analyst would: the sender's history, the change being asked for, and where the reply goes20. AegisAI connects by API and works after delivery22. The median verdict takes 1.9 seconds, then the email is removed from every mailbox that received it23.
Illustrative example, figures are fictional. A commercial customer of Lakeside Bank (fictional) emails the treasury desk at 15:40 on a Friday. The address swaps one letter of the customer's domain. The email asks to send a $480,000 supplier payment to a new account, same beneficiary name, before the 16:00 cutoff. Step 3 holds it. At step 4 the officer calls the number on file, and the customer says it sent no such email. The wire never leaves.
Run one fictional instruction like this through your desk each quarter and time each step.
Track three numbers from the first day.
Review all three on day 30, and find out why for any changed instruction without a callback.
They check the sender and the requested change, hold the instruction, call back on a number on file, and require a second approver above set thresholds. No step relies on the email alone.
FinCEN lists an address that resembles a known customer's with altered characters, new account details for a known beneficiary, and timing that leaves little room to confirm.
Only when the bank makes the call outbound, to a number already on file. Fraudsters spoof phone numbers, so a number from the email proves nothing.
No. A lookalike domain with valid DNS records passes those checks. The bank still has to read the request and confirm it outside email.
Move to recovery at once. The first hours plan after a BEC wire transfer sets out the steps, and the email security guide for financial services covers the controls around it.
