Wire transfer fraud is uniquely unforgiving: unlike card payments, wires have no chargeback mechanism, and recovery odds collapse within roughly 72 hours as funds hop across accounts and jurisdictions. Prevention isn't one control among several — it's essentially the whole game. For how VerifyTheCall enforces this, see Wire Transfer Fraud Prevention.

The controls, ranked by effectiveness

1. Callback verification (out-of-band)

Before releasing any wire initiated or modified by a request received over email or phone, call the requester back on a number already on file — never a number provided in the request itself. This single control defeats most vishing, CEO fraud, and vendor-impersonation attacks, because the attacker doesn't control the registered number.

2. Dual authorization — and its blind spot

Dual authorization requires two independent approvers above a threshold. It's necessary and insufficient: attackers who research your company size the request below the threshold. Sub-threshold wires typically get single-signature treatment and surface only at reconciliation, long after the recovery window.

3. Vendor master data discipline

Most fraudulent wires exploit a changed bank detail rather than a new payee. Lock vendor bank-detail changes behind the same callback rule, with a cooling-off period before the first payment to new details.

4. Payment file integrity

Restrict who can create and who can release payment batches (segregation of duties), and alert on any edit between approval and release.

5. Compliance measurement

The uncomfortable question: what percentage of last quarter's wires had a documented callback? A policy without measurement is a suggestion. Hold payments until the callback is logged, and report compliance as a number.

If a fraudulent wire has already gone out

  1. Hour zero: call your bank's fraud line and request a recall/SWIFT gpi stop — speed matters more than paperwork.
  2. Same day: file with law enforcement (in the US, the FBI's IC3, whose Recovery Asset Team can freeze domestic transfers if engaged fast).
  3. Within 48h: notify insurers, preserve all call and email records, and freeze any related pending payments.
Protocol tipWrite your callback rule with no floor. "All payment-affecting requests received by phone or email require callback verification" costs minutes; a threshold-based rule publishes your own attack surface.