We are seeing an increasing number of fraudulent wires being sent by our customers, after either the customer or someone in their email thread has had their email hacked. The wire beneficiary's bank/account info gets changed midstream, etc. We are not out any money, because we have sent the wire to the account our customer specified, and have verified with them that the information is where they want it to go. But our customer is out money, and it's time-consuming for bank staff to deal with the aftermath.

What are other banks doing to try to prevent this as part of your procedures? Personally, I'd like to be able to read through the entire email thread to see if our customer missed where a fraudster possibly changed the bank information but obviously that's not really a workable solution for every wire

Education is your best defense. Bank newsletter, alerts on your website, customer service calls to your commercial clients from their account representative, etc.

The number of banks accepting wire orders via e-mail are in significant decline, even with call back procedures. Many only allow encrypted on-line banking platform transactions. At some point of time, a customer is going to sue the bank claiming this process no longer represents commercially reasonable security procedures and the bank is going to find itself on the other side of the UCC-4A..

In the scenario the OP describes, the wire could be made in person. The new twist is that a vendor/client of the bank's customer has their email hacked and a fake email is sent to the bank's customer saying "Hey, we've updated our account info. Please remit your outstanding invoice here..."

The bank's customer comes into the bank, fills out a wire request in person and off the money goes to the wrong place. The bank is not out any funds, but the bank customer who acted on the fake email is. This will trigger investigations, SARs, etc. Short of asking every customer, "Did you receive these wire instructions via email and if so, did you call and verify with the sender in person...?" our options are limited.

Hence my suggestion to share advice like that with all your clients on a larger scale to open their eyes to potential red flags.

Oh - good point. Sort of misread that I guess. Blame it on cabin fever.

we ask a number of questions for wires not created using our online portal (and i'm paraphrasing for brevity):

1. do you know and have done business with the recipient before
2. how did you get the wire instructions
3. did you call a known number to verify or use the number in the email
4. were you told not to let anyone know about this wire
5. were you promised goods or services in conjunction with this wire
6. is this wire in relation to something you are selling, a mystery shopper job, or an overpayment received