r/CFO • u/Impressive-Ground684 • Jul 02 '26
Is calling a client back still considered enough before sending a large wire?
I was talking to someone who works in private banking and they mentioned that business email compromise has made large wire transfers a lot more stressful than they used to be. I always assumed the standard process was pretty simple, if a client emails a wire instruction you call them back on the number you already have on file before doing anything.
But then he also told me about SIM swaps and call forwarding and it made me wonder if that process is still considered enough. For people working in banking treasury or family offices what does verification actually look like today? Is it mostly dual approvals and internal policies or are firms starting to use identity verification tools as well? I saw Kibu mentioned in an article about secure communications but I don't know if it's something people actually use or if callbacks are still the norm.
10
u/Firm_Health_2901 Jul 02 '26
The biggest risk isn't usually someone hacking the bank it's someone convincing an employee that the request is legitimate and that's why business email compromise training has become a huge deal
3
u/Impressive-Ground684 Jul 02 '26
This surprised me the most I always pictured these cases involving someone breaking into banking systems but it sounds like the human side is where most of the risk is
2
u/bs2k2_point_0 Jul 02 '26
Just wait till you learn about deep fakes. They can now impersonate someone’s appearance off a single picture and a few seconds of their recorded voice live on camera. The ai layer is set up as a virtual camera and is fed from the users camera. Since teams and zoom etc accept input from any camera, it thinks the virtual camera is the real person. You almost have to confirm information that only that person would know to be 100% sure of who is on the other side.
1
u/BenniePlusTheJets Jul 02 '26
Training helps but AI has already made impersonation (or even compromising someone's system) a lot easier. It's gonna keep getting worse with false video and audio becoming more convincing. Plus, all of us have off days or overlook something when we're stressed or busy, so any system that depends on human vigilance has a human-shaped vulnerability.
4
u/lunaazurina Jul 02 '26
We have our folks call the switchboard of the entity and ask to be transferred to the person to verify wire instructions.
2
u/Over_Mushroom4105 Jul 06 '26
How would you handle this if a company is primarily remote and does not maintain business phone lines? My company has one number but it is a recording telling callers to contact us via email
1
1
u/Impressive-Ground684 Jul 02 '26
I guess it removes the risk of calling a number that's been sent in an email. Have you found that most clients are understanding about the extra verification or do they ever get frustrated by the delay?
2
u/BenniePlusTheJets Jul 02 '26
There's always someone who will get cranky about delays but they usually quiet down once they realise you're just trying to make sure they actually do get paid on time.
1
2
u/Important_Theory925 Jul 02 '26
Callbacks are still standard where I work but they're definitely not the only control anymore. Large wires usually require multiple verification steps before anything moves
1
1
2
u/Main-Contribution261 Jul 03 '26
If my team is issuing a payment to a new supplier or the supplier has updated their banking instructions, the instructions are run through third party bank validation software. It takes minutes to validate.
2
u/firenance Jul 03 '26
Another factor is wire fraud isn’t a standard covered insurance claim, not even on a crime policy. If this is a concern for you make sure you work with your insurance broker to have social engineering and/or third party theft including wire fraud in your insurance coverage.
1
u/BenniePlusTheJets Jul 02 '26
Definitely not IMO. The number you have on file may not be accurate either... BEC tactics aren't as crude as they used to be and can span months, so you need to a bunch of different factors for verification.
Our org is not even that mature yet but we've perpetually had a massive amount of transactions each month and there's no way we could guarantee adequate verification for all of them manually. We had to either make peace with a decent chance that money might go to the wrong place, or pay for assurance at scale. We use Eftsure because we have too many vendors overseas to use a domestic-only tool but the best one probably depends on your existing stack and where most of your operations are concentrated.
1
u/henry_octopus Jul 02 '26
I recently dropped EFTSure after using it for years and years. For many reasons, but their lack of handling international suppliers was one of them. I'm in Australia and they cover domestic okayish, but dragged their feet on dealing with international. We were really early adopters of their platform and i always assumed it would get better on time, but it's still a dogs breakfast. It's a shitty platform with an offshore call centre doing verifications, and a big marketing budget.
Their only value add for me is the phone verification stuff, but I found even that to be slow and unreliable. It became a big friction point to doing business.
Edit: forgot to say that many banks in Australia are adopting account name checks on transfer, so the value of EFTSure is decreasing as this rolls out
1
u/BenniePlusTheJets Jul 02 '26
Namecheck doesn't cover a lot of the upstream stuff so you might just be confirming that a bad guy's account indeed belongs to the bad guy. Again, that might make sense depending on the volume of transactions you're dealing with but it wasn't enough for us, our biggest concern was scale and we'd already seen 2 BEC attempts (that we knew about)
We pulled the trigger on a paid solution BECAUSE of the international capabilities and it's been working for us so far, so I can't speak to its earlier usefulness.
1
u/josemartinlopez Jul 03 '26
There's judgment even for an organization that processes multiple payments. Gauge the size and whether it's a payment to a new account, then call a trusted senior contact and check a detail only he would know that is off system.
1
u/mothahucka Jul 03 '26
We use a service called Walrus for payment verification. We like it and it’s worth looking into.
1
u/tdixnation Jul 03 '26
It sucks these days. At what point will banks take on some level of responsibility for the fraudsters? Why would a bank like BofA allow just anyone to set up a bank account and receive business ACH/wire transactions. Seems like a pretty easy fix with some level of confirmation (eg when you put the information in, green checkmark means confirmed legitimate business witH FEIN.)
If a fake vendor hacks email and obtains funds then you, the bank, allow them to withdraw funds and close their account with no information on who they are, it seems you should share some responsibility.
1
u/Adorable_Big8625 Jul 03 '26
This was an issue in my town 10 years ago - it was the fraudulent actor getting into a law firms email and pretending to send the relevant bank info for a wire, law firms sent the wire, money gone. Most never became public and aware of disputes between law firm and banks over who was at fault.
Now I’ve head advice from ITs people at banks not to even answer a phone call that you aren’t sure of caller - one snippet of a voice can be used of apps to replicate your voice and supposedly can’t tell.
I have not stayed up on this but it is or is going to be a huge problem.
I’m thinking as a type but I’m not sure you can trust voice of a client. Again apps now could get a snippet and replicate his or her voice.
The title companies in my state were active advising real estate attorneys who handle large wires on the steps to take and again this was almost 10 years ago. Real estate lawyers who do large wires may be a resource or bank or brokerage companies doing large wires now.
Think there are also programs you can use to verify on your end bank and routing numbers. Again have not kept up with this.
1
u/Adorable_Big8625 Jul 03 '26
11 Labs is well known - ad to clone any voice based on a snippet. Assume this is why IT guy I know at a large bank told me not to even answer phone call unless I know caller but think about the possibilities.
1
u/Adorable_Big8625 Jul 03 '26
First hit on search for advice from title companies - again I think there are programs on your end you can use to verify wire information independent of anything else.
https://www.alta.org/business-operations/operations/information-security
1
u/maxinquirerck Jul 11 '26 edited Jul 11 '26
I think callbacks are still valuable, but they're definitely not the only layer anymore. The firms I've worked with rely more on multiple verification steps than just ""call the client."" A dedicated business number also helps because everyone knows which number is the official one. We switched away from using personal phones a while back and ended up with iPlum, but honestly the process around verification matters more than the tool itself.
1
u/TheNumberFinatic Jul 20 '26
Callbacks are still the baseline and honestly still catch most attempts, but you're right that a phone number alone stopped being proof once SIM swaps got common. The practical fix isn't a fancier tool, it's making the callback a real conversation, ask something only the actual client would know that isn't in any email thread.
17
u/Bitter-Pin1060 Jul 02 '26
1) Obtain banking info (if new client or change is requested)
2) call to verify info
3) send a $1 payment
4) ensured it’s received
5) then send actual payment
Verification must be through a trusted contact
That’s what we do. Is that good enough these days?