Wire Fraud Red Flags Cheat Sheet — what is phishing with a bank account at the end of it

Reviewed October 25, 2026 — Ingenious AI security checks.

Key facts

• The fraud is a detail change: the invoice, the supplier and the amount are real — only the destination account is the fraudster's.
• 3 ceremony steps defeat it: a mandatory hold, an out-of-band callback to the number on file, and dual approval on separate devices.
• Urgency is the tell: real suppliers survive a callback; fraud instructs you, specifically, not to call.

What is phishing when it ends in a wire transfer?

It is business email compromise aimed at the payment itself: attackers phish or spoof their way into a real invoicing thread, then substitute new bank details at the moment of payment. The request looks routine because almost everything in it is genuine — the fraud lives in one changed field, which is why reading the email harder never works and verifying out-of-band always does.

• Changed bank details on an otherwise normal invoice or payment instruction — the single highest-risk signal in this entire cheat sheet.
• Urgency and secrecy: 'pay today, do not call the office, the director is travelling'.
• Lookalike sender domains: one letter off your real supplier or executive domain (see the Domain Impersonation cheat sheet).
• Thread hijack: the request continues a genuine thread but quietly moves replies to a controlled address.
• New beneficiary plus round pressure: first-time payee, unusual amount or split payments designed to dodge approval thresholds.
• Verification resistance: any instruction that discourages the callback is the fraud introducing itself.

What is the payment-verification ceremony?

1. Mandatory hold: new or changed wire instructions wait a defined period before they can be paid — speed is the fraud's weapon, so the ceremony removes it.
2. Out-of-band callback: call the number already on file for the supplier — never a number from the requesting email — and confirm the details voice-to-voice.
3. Dual approval on separate devices: a second approver, on their own device, confirms amount, beneficiary and the callback result.
4. Hash-chained audit ledger: every hold, callback and approval is recorded in a tamper-evident ledger, so the ceremony itself can be proven later.

The ceremony feels slow exactly once — the first time. After that it is simply how wires are sent, the way a seatbelt is simply how cars are driven.

Run the free check

The fastest way to apply this cheat sheet is the free check on WireWatch: it runs the hold, callback and dual-approval ceremony on new wire instructions. Start on the WireWatch homepage, compare tiers on WireWatch pricing, and keep the full hosted reference open at the Wire Fraud Red Flags cheat sheet on WireWatch. Questions or orders: ask Ingenious AI on WhatsApp or email orders@getingeniousai.com.

Run the free check on WireWatch → Open the hosted cheat sheet →