Wire Fraud Prevention for Financial Advisors: Playbook

Fraudulent wire instructions can put client funds at risk quickly, and recovery is not guaranteed. Wire fraud prevention for financial advisors starts with a documented verification process, secure accounts, and staff who know when to pause a request. This playbook explains what to check before approval and how to respond when something looks wrong.

Why advisory firms are a target

Advisors help clients coordinate transfers and handle sensitive financial information. Criminals exploit those relationships by impersonating trusted clients or contacts to redirect legitimate payments.

Risk increases when a firm relies on one person to handle requests without independent verification or review. Assign clear responsibility for checking instructions, approving them, and submitting them through the custodian’s authorized process.

What wire transfer fraud looks like in an advisory practice

Someone tricks the firm or the client into sending money to an account the criminal controls. One important threat is business email compromise (BEC), which can involve a compromised mailbox or an impersonated sender. Examples relevant to advisory firms include:

• Fake client request. A criminal gains access to a client’s email and uses past correspondence to make a fraudulent request sound familiar.
• Impersonated insider. A message appears to come from a partner or the operations lead, approving a wire nobody discussed out loud.
• Impersonated custodian or vendor. An email announces new banking details for a routine payment.

Other scenarios include altered invoices, redirected real estate closing wires, and pressure to fund an urgent investment through an unfamiliar account.

Warning signs that should stop a wire

• New or changed bank details, especially when the change arrives by email
• Urgency, secrecy or pressure to skip a step, including requests timed around travel, holidays or payment deadlines
• A client who will only communicate by email or text and cannot take a call
• A slightly different email address, an unexpected reply-to address, or an unusual change in an existing conversation
• A destination that does not fit the client: a third-party name, another country, a brand-new account, a crypto platform
• A first wire from a client who has never wired before, or an amount well outside their normal pattern

These signs call for verification and escalation. A third-party or overseas payment is not automatically fraudulent, and a familiar-looking request is not automatically safe.

How to verify a client wire request before approval

The advisor’s verification and approval responsibilities are separate from the custodian’s execution process. For example, Schwab’s advisor guidance requires advisors to verbally verify money-movement instructions with clients before submitting them. Follow your own custodian’s requirements and your firm’s approved procedures.

Call the client using independently verified contact details already held by the firm. Do not use a number supplied in the wire request. Build the following checks into your procedure:

1. Verify the request before approval, including requests from longstanding clients and any changes to banking instructions.
2. Use the firm’s approved identity checks. Do not rely only on personal facts that may be public or exposed in email.
3. Confirm the amount, beneficiary name, destination bank and account details, and payment purpose. Resolve discrepancies before proceeding.
4. Check recent changes to the client’s contact record. Independently validate a changed phone number before using it to verify the wire.
5. Require a separate authorized reviewer to check the verification and approve the instruction before submission through the custodian’s process.
6. Record the checks and outcome in the firm’s approved system.

When to hold and escalate a request

If you cannot complete verification, hold the request and contact the designated approver or compliance lead. An unanswered callback, a familiar client, or an approaching cutoff does not complete the check. Use the firm’s escalation process to resolve discrepancies and agree on the next step with the custodian when needed.

What to record in the verification log

Use a consistent record that includes:

• The client and request reference
• The date, time, and source of the request
• Who performed the callback and the trusted contact record used
• The payment details checked and any discrepancies
• The reviewer’s name, approval, and any escalation decision
• The outcome and custodian submission reference, where applicable

Store the record securely under the firm’s retention procedures. Refer to approved payment records where possible instead of copying sensitive account information into multiple places.

What a written wire policy should contain

• Dollar thresholds tied to approval levels
• A standing rule that any banking change requires a callback plus a supervisor sign-off
• A clear position on wires to accounts not in the client’s name
• Named approvers, named backups, and instructions for when the approver is unreachable
• Secure retention of verification records under applicable requirements and the firm’s approved procedures
• A scheduled review and practice exercises to check whether staff follow the process

The client letter and ongoing client education

A one-page letter at onboarding, reinforced yearly, makes clients part of the control:

• Explain the firm’s callback and authorization requirements before it submits wire instructions
• The firm will never change payment instructions based on an email alone
• If a client receives odd instructions that appear to come from the firm, they should call the main number they already have
• Explain normal processing times, custodian cutoffs, and why incomplete verification can delay a request

Email and identity controls that reduce wire-fraud risk

Fraudulent instructions may come from a compromised account or an impersonated sender. Protecting email and access reduces exposure, while independent verification helps staff check requests that still reach them.

• Require multi-factor authentication for email and client portals, including leadership accounts. Use phishing-resistant methods where supported.
• Monitor for unexpected forwarding, deletion rules, and other mailbox changes that may indicate compromise.
• Use external-sender labels as one warning cue alongside impersonation protection. A label does not establish whether a message is genuine.
• A secure portal for account and banking documents instead of email attachments
• Limit wire-related system access to authorized staff and review permissions when roles change or employees leave.

Sixwatch helps financial firms strengthen email security and phishing protection and Microsoft 365 identity and access security, supported by ongoing IT and security management.

Training the people who actually touch wires

Train the operations and client-service staff who process wires, not only the advisors. Make it clear that staff should pause and escalate suspicious requests, even when a client or senior colleague is pressing for speed.

Use approved phishing simulations and controlled wire-request exercises to test the process without moving real funds. Train new hires before granting wire-related responsibilities, record completion, and address gaps found during practice.

Check applicable rules, custodian procedures, and insurance terms

SEC-registered investment advisers are among the institutions covered by the amended Regulation S-P. The amendments require written incident-response procedures. Subject to exceptions, affected individuals must be notified as soon as practicable and no later than 30 days after the institution becomes aware that unauthorized access to or use of customer information has occurred or is reasonably likely to have occurred.

Notification concerns sensitive customer information and includes a reasonable-investigation exception where harmful use has not occurred and is not reasonably likely. A fraudulent wire does not automatically trigger the same notification duty in every case. Have your compliance lead or counsel assess the incident and applicable requirements.

For institutions under FTC jurisdiction, the FTC Safeguards Rule generally requires MFA for access to customer information, unless the Qualified Individual approves equivalent secure access controls in writing. Confirm which framework applies rather than assuming SEC and FTC requirements automatically apply together.

Review your custodian’s authorization requirements and your firm’s verification records. Ask your insurance broker whether the relevant policy covers fraudulent client instructions and social engineering, and check any sublimits, verification conditions, and reporting deadlines. Do not assume cyber or crime insurance will reimburse a wire loss.

What to do immediately after suspected wire fraud

Act immediately. A transfer may be stoppable, or funds may be recoverable, but neither outcome is guaranteed. Your response plan should include the following actions:

1. Contact the originating bank or custodian’s fraud team. Ask whether the transfer can be stopped or recalled and provide the transaction details it requests.
2. Promptly report the incident to the FBI’s Internet Crime Complaint Center (IC3). Do not wait for a report to be completed before contacting the bank or custodian.
3. Alert the designated compliance and security responders. Preserve the original emails, headers, instructions, verification records, and transaction references.
4. Contain suspected account compromise in parallel. Have authorized IT responders follow an appropriate process, such as Microsoft’s compromised-account guidance, to block unauthorized access, revoke sessions, and inspect authentication changes and mailbox rules while preserving evidence.
5. Coordinate client and insurer communications. Have the responsible team assess notification duties and policy deadlines using trusted communication channels.
6. Review the failure before resuming the affected workflow. Address gaps in verification, access, or escalation, and test the revised process.

Review your firm’s wire-fraud controls

Start by checking whether your current procedure names the verifier and reviewer, explains when to hold a request, and produces a usable record. Then review the email and access controls supporting that process.

Sixwatch provides IT and cybersecurity support for financial firms, including registered investment advisers and wealth management firms. We serve Tampa, Sarasota, and Orlando with local engineers on our payroll.

Schedule a discovery call to discuss your firm’s email and access controls and identify an appropriate next step.