Wire fraud is one of the most expensive problems facing Registered Investment Advisors, and Adelia Risk sees it hit wealth management firms of every size.
In 2025 alone, the FBI’s Internet Crime Complaint Center (IC3) logged $3.05 billion in reported business email compromise losses across 24,768 complaints, the second-costliest category of online crime that year. A large share of that money moved by wire, and much of it started with a single convincing email.
Our RIA cybersecurity services exist because of one hard truth about wire fraud: your staff has to catch it before the wire goes out. Wire transfers move money so fast that once the funds land in a criminal’s account, they are usually gone. That makes wire fraud a prevention problem first and a recovery problem second.
This guide shows you what wire fraud looks like, walks through real wire fraud examples that have hit investment advisers, and lays out the best practices for preventing wire fraud. We’ll review the SEC’s cybersecurity guidance at the end.
What Is Wire Fraud? The Short Answer
Wire fraud is the use of electronic communications, usually email, to trick someone into sending money to a criminal.
In the advisory world, it almost always occurs when an attacker has hijacked a real email account (a client’s, a vendor’s, or an employee’s), or when an attacker sends from a lookalike address that resembles a trusted one. Either way, you receive what appears to be a legitimate request to wire funds, and you send the money to the wrong place.
The email will look real, the request will feel urgent, and the money moves in minutes.
Every RIA firm should implement a rule stating that an email alone should never authorize a wire. Treat every emailed payment instruction as unverified until you confirm it by voice on a number you already have on file.
Train people to be suspicious of any new or changed wire instruction, use technology to filter and flag suspicious email, and verify every wire request through a second channel you control. If a fraudulent wire does go out, call your bank and file at ic3.gov within hours (or even minutes!).
What Wire Fraud Looks Like & Examples of Wire Frauds
Criminals do not need to break into your systems to steal a wire. They just need to send one good email. Here are the two most common types of wire fraud that target wealth management firms.
Account takeover versus email spoofing
Account takeover means the attacker has stolen the actual email password of a client, vendor, or employee and is sending from the real account. These are the hardest to catch, because the email genuinely comes from a trusted inbox, with the real signature, history, and writing style.
FINRA has warned firms about exactly this pattern, in which perpetrators “email brokerage firms from customers’ personal email accounts with instructions to wire funds,” sometimes with forged letters of authorization. (See FINRA Regulatory Notice 12-05, on verifying emailed instructions to transfer customer assets.)
Email spoofing means the attacker sends from an address that only looks like a trusted one. This is easier to spot once you know what to look for, but only if someone actually looks.
How to spot a spoofed or lookalike email before wire fraud occurs
Setting up a convincing lookalike domain is cheap and takes only a few minutes. Against a six-figure wire, that is nothing.
The trick is usually a small change to a domain that the eye skips right over: a dropped letter, a doubled character, a swapped .com for .co, or a hyphen where none belongs. The FBI states that firms should flag abc-company.com when the real domain is abc_company.com.
Six of the lookalike-domain tricks attackers rely on, from dropped and doubled letters to a swapped domain ending. Each is designed to pass a quick glance at the sender’s address.
When a wire request arrives, examine the sender’s full email address, not just the display name, which is easy to fake. If you are not sure how to see the true sending address in your email system, ask your IT team to show you because it is one of the best practices for preventing wire fraud. It takes 30 seconds and is the fastest way to catch a spoof.
The external-sender warning banner
Most email platforms can add a visible banner to any message that originates outside your organization. It is one of the cheapest and highest-value controls you can turn on. When an email claiming to be from your CEO arrives with a bright “External” tag on top, that should alert your team.
What the reader is seeing: the yellow “External” banner Microsoft Outlook automatically adds to any message from outside the organization. Here it sits on top of a phishing email impersonating an internal executive, the visual cue that should make a staffer stop and verify before acting on the wire request.
Microsoft 365 comes with this feature. Administrators enable it org-wide with the external sender identification feature. It can take a day or two to appear across all mailboxes, and it supports an allow-list for trusted partners.
Google Workspace has no single “External” toggle like this, so it takes a bit more setup. Gmail’s Safety settings automatically add warning banners to messages from unauthenticated or suspicious senders, and admins can turn on an external-reply warning that nudges staff before they respond to anyone outside the firm.
To put a banner on every inbound external message, an admin creates a Gmail content-compliance rule (Admin console, Apps, Google Workspace, Gmail, Compliance) that prepends the banner to inbound mail from outside your domains. Our Google Workspace Gmail security guide walks through each of these settings.
Real Wire Fraud Examples Hitting Investment Advisors
Wire fraud attempts are something that all advisory firms will face. We want you to be prepared with the best practices for preventing wire fraud, and looking at real examples of cyberattacks is the best way to learn.
Below is how a typical attack unfolds, followed by documented cases the SEC and FINRA have acted on.
How wire fraud actually unfolds
Here is an excellent example of wire fraud. We used info from a Department of Justice business-email-compromise prosecution that caused more than $50 million in losses:
- The setup. The attacker identifies a transaction already in motion, such as a real-estate closing, a capital call, or a large client distribution. In advisory settings, they often get there by first compromising a client’s or employee’s email and reading the inbox for weeks.
- The trigger. At the moment a wire is expected, the victim receives an email that appears to come from the trusted party, whether the client, the attorney, the title company, or the counterparty. The address is either the real (hijacked) account or a lookalike that a glance won’t catch.
- The request. The email provides “updated” wire instructions or asks for a new transfer. It carries just enough urgency and confidentiality to discourage a second look.
- The wire. The victim sends the money to an account the attacker controls. It is quickly moved onward and laundered.
- The gap. No one made an out-of-band call to a known number to confirm the instructions. That single missing step is behind nearly every one of these losses.
Here are some documented cases.
Wire Fraud Example 1: Voya Financial Advisors and a $1 Million SEC Penalty (2018)
Over six days in April 2016, intruders called the technical support line of Voya Financial Advisors (a dual-registered broker-dealer and investment adviser), impersonating the firm’s own independent contractor representatives and requesting password resets. Support staff reset the passwords. The attackers then logged into Voya’s web portal and accessed the personal information of at least 5,600 customers, in some cases creating new online profiles to reach account details.
Two of the fraudulent calls even came from phone numbers Voya had already flagged as fraudulent.
The SEC charged the firm under the Identity Theft Red Flags Rule and the Safeguards Rule. Voya paid a $1 million penalty. It was the SEC’s first enforcement action under the Identity Theft Red Flags Rule.
Why it worked: a written identity-theft program existed but was never updated, staff was not trained to hold the line on phone-based resets, and clear red flags were ignored.
Wire Fraud Example 2: Cetera, Cambridge, and KMS Email Takeovers (2021)
In 2021, the SEC charged eight firms, including five Cetera entities, Cambridge Investment Research, and KMS Financial Services, after attackers took over cloud-based email accounts belonging to advisers and staff.
More than 60 Cetera personnel accounts were compromised, and thousands of clients’ personal information was exposed across the firms. Once inside a real inbox, an attacker can email clients and back-office staff with fraudulent instructions that slide past every “does this look like them?” check.
The firms settled Safeguards Rule violations with penalties of $200,000 to $300,000.
Why it worked: multi-factor authentication on email was missing or inconsistent, and firms that discovered early break-ins waited years to actually do anything.
Wire Fraud Example 3: A $108,680 Client Wire Lost to Email (FINRA)
The dollar amounts do not have to be enormous to end a career. FINRA fined and suspended a former Morgan Stanley client-service administrator who processed fraudulent wire transfers totaling $108,680 out of a client’s account to third-party accounts, based on emailed instructions, and then falsified records.
For the regulator’s own summary of these scam patterns, see FINRA Regulatory Notice 20-13.
Best Practices for Preventing Wire Fraud
The best practices for preventing wire fraud come down to four layers of defense. No single layer is enough. Technology misses things, and people have bad days, so you stack them.
Train Your Staff to Spot Wire Fraud (Layer 1)
An alert human is what stops most of these wire fraud attacks against RIAs. Build these into your policies and training:
- Any email asking you to wire money to a new or changed destination should raise suspicion, no matter who it appears to come from.
- Be especially wary of foreign destinations, though domestic accounts are not automatically safe.
- Watch for pressure tactics: urgency (“I need this wire today or I lose the deal”), confidentiality (“don’t mention this to my partner”), or hardship (“I’m traveling and lost my wallet”).
- Don’t excuse bad grammar because the email says “Sent from my iPhone.” That sign-off is often a deliberate cover for mistakes.
- Remember that an email appearing to come from someone you trust does not mean it is from them.
Use Technology to Filter and Flag Fraudulent Email (Layer 2)
- Secure email gateway. Route every message through a filtering service that scans for scam and phishing patterns before it reaches an inbox. The good ones filter out a large share before it reaches a person.
- External-sender warnings. Turn on the “External” banner described above so spoofed internal messages give themselves away.
- Anti-spoofing records. At a minimum, configure SPF correctly; ideally add DKIM and DMARC so criminals cannot easily send email as your domain. Our overview of how SPF, DKIM, and DMARC prevent domain spoofing explains what each one does.
No technical control is 100% accurate. Treat these as filters that shrink the problem, not eliminate it.
Verify the Sender (Layer 3)
If a wire request has cleared your filters, slow down and confirm the sender is real. Examine the true email address, not the display name. If a client’s or vendor’s email has been hijacked, the message will pass every content check you throw at it, which is exactly why the human verification of the transaction is non-negotiable.
Wire Transfer Verification Procedures (Layer 4)
This is the layer that stops the losses. Verify the person, verify the request, and log the whole thing.
Remember, an email, by itself, never authorizes a wire. Set this expectation with clients at onboarding that you will always confirm a transfer request by voice and will never act on emailed instructions alone.
Where you can, move transfer requests off email entirely and onto a secure client portal, so the instruction never arrives in a channel an attacker can compromise.
Call to confirm the wire.
- Never call a number provided in the email. Call the client at a number already on file.
- Never confirm a wire by text. Numbers can be redirected and you can’t tell who is replying.
- Reach the actual person who initiated the wire, not a co-owner or assistant who may lack first-hand knowledge.
Verify identity with something hard to fake.
- Ask for at least two pieces of information, ideally something an attacker could not easily buy or find (especially if their email inbox is compromised by an attacker). This can be a shared detail only you and the client would know. Answers like the last four of a Social Security number are weaker because breached personal data is cheap and plentiful on the dark web.
- Some firms require a signed form for any new destination. It helps, but decide how you would stop an attacker from simply filling it out and emailing it back, and make sure someone actually checks the signature against what you have on file.
Follow a clear approval process.
- Keep a log of the verification steps you took, for compliance and for reconstructing what happened if something goes wrong.
- Require a second approver, often the Chief Compliance Officer, for large wires (many firms set a threshold such as $50,000) or any wire to a new destination.
For the full picture of how these threats fit together, see our guide to the six most common cyber threats targeting RIA firms and our complete guide to RIA cybersecurity.
What To Do If Wire Fraud Happens
If you realize a wire request was fraudulent, whether or not the money went out, your incident response plan should already tell you what to do. The section that follows is a refresher and the latest best practices for preventing wire fraud in case you need to update your incident response plan.
1. Move immediately
You are in a race to freeze the funds before the criminal moves them onward. As soon as something looks wrong, escalate and pull your incident team together.
2. Call the bank and file with the FBI within hours
Contact the originating bank right away to request a recall and ask about a Hold Harmless Letter. Then file a complaint at ic3.gov. The FBI’s Recovery Asset Team uses a “Financial Fraud Kill Chain” to freeze fraudulent wires. In 2024 it froze roughly $561 million at a 66% success rate, but it works best when the fraud is reported within about 72 hours. Every hour you wait lowers your odds.
3. Report internally and to your partners
Notify your Chief Compliance Officer, your IT team or provider, your secure email gateway vendor, and the fraud team at your custodian or broker-dealer.
4. Don’t engage the scammer
Replying or “stringing them along” only invites more attention on your firm.
5. Check your insurance before you need it
Some cybersecurity insurance policies cover funds-transfer fraud, but coverage varies. Confirm what you have with your broker now, not during an incident.
6. Consider your notification duties
Under the SEC’s amended Regulation S-P, covered institutions, including registered investment advisers, must notify affected individuals as soon as practicable, and no later than 30 days, after learning that sensitive customer information was likely accessed without authorization. If a client’s email was compromised to reach you, that client, and possibly others, now needs strong guidance on locking down their accounts with multi-factor authentication and unique passwords. Consult a qualified compliance attorney on your specific obligations.
Frequently Asked Questions About Wire Fraud
What is wire fraud?
Wire fraud is the use of electronic communications, most often email, to deceive someone into transferring money to a criminal.
In financial services, it typically involves a fraudulent or hijacked email carrying wire instructions that send client or firm funds to an attacker-controlled account.
What are some examples of wire fraud?
Common examples include an attacker who has taken over a client’s email account and emails your firm new wire instructions; a lookalike-domain email impersonating a vendor or executive at the moment a payment is due; and a real-estate or closing scam that redirects funds mid-transaction.
Documented cases include the SEC’s 2018 action against Voya Financial Advisors and its 2021 actions against Cetera, Cambridge, and KMS.
What does wire fraud look like for an investment advisor?
For an RIA, it usually arrives as a routine-looking wire request from a client, vendor, or colleague, often when a transfer is already expected. The email may come from a genuinely compromised inbox or a near-identical lookalike address, and it presses for speed. The loss happens when the request is acted on without an independent, out-of-band verification.
What are the best practices for preventing wire fraud?
Make sure your plan includes four layers, including:
- Train staff to treat any new or changed wire instruction as suspicious
- Filter and flag email with a secure email gateway
- External-sender banners
- Verify the true sender address
Also, check with your IT team to make sure that anti-spoofing measures (SPF/DKIM/DMARC) are in place and properly configured.
Most importantly, confirm every wire by calling the client at a number already on file, with a second approver for large or new-destination wires.
What role does cybersecurity play in wire fraud prevention?
Cybersecurity provides the technical layers that shrink the attack surface, including email filtering, anti-spoofing records, multi-factor authentication on email accounts, and monitoring, so fewer fraudulent messages reach a human in the first place. But because no control is perfect, cybersecurity works alongside disciplined verification procedures rather than replacing them.
Not sure your firm’s wire-fraud defenses would hold up against a well-timed email? Adelia Risk’s RIA cybersecurity services build, test, and maintain them for you.
SEC Cybersecurity Guidance on Wire Fraud
The formal SEC cybersecurity examination guidance does not lay out step-by-step rules for avoiding or responding to wire fraud. But the SEC has addressed the problem across several other publications worth reading. These best practices for preventing wire fraud can help improve your response plan.
- The Report of Investigation under Section 21(a) of the Securities Exchange Act examined business email compromise schemes that cost nine public companies roughly $100 million. It focuses on public companies, but the lessons apply directly to advisory firms.
- The Identity Theft Red Flags Rules explain how to build a program to spot identity theft, the same rule the SEC used in the Voya action above.
- The amended Regulation S-P now requires a written incident-response program and 30-day customer breach notification for registered investment advisers.
If you have questions about which of these apply to your firm, consult a qualified compliance attorney.
Some firms have the time and in-house expertise to build all of this. If yours does, we hope this guide gives you a strong start.
If you would rather have experts bolster your wire-fraud defenses and keep them tested, that is exactly what Adelia Risk does for investment advisers.
Prevent costly wire fraud at your firm. Adelia Risk builds, configures, and tests the wire-fraud defenses RIAs need, including email hardening, verification procedures, and SEC-aligned incident response, so a single convincing email can’t cost you a client’s money. Explore Adelia Risk’s RIA cybersecurity services.
