Wire controls

Why a wire is riskier than a check

A check can be stopped. Call the bank before it clears and the payment does not go through. A wire transfer does not work that way. Once you send it, the money is gone, sent bank to bank, usually the same day, with no automatic reversal.

That is exactly why wires are a favorite target for fraud. Whether an association gets its money back after a fraudulent wire often comes down to a narrow legal question: did the bank offer a strong security procedure, and did the association actually use it? Courts weigh the security options your bank offered against what your association chose to use, and the outcome depends on the specific agreement between your association and your bank. Ask your bank in writing what it offers, before you need the answer.

Verify the sender, not just the request

A message that looks like it came from your board president or treasurer is not proof that it did. The FBI calls this business email compromise: a scam that hijacks or fakes a real email account to talk someone into sending money.

"a subject compromises legitimate business e-mail accounts through social engineering or computer intrusion techniques to conduct unauthorized transfers of funds."

Source: Business E-mail Compromise: The 5 Billion Dollar Scam, FBI Internet Crime Complaint Center

A "fake board president" urgent wire request is this exact scam. The FBI's own prevention advice applies directly: verify by phone using a number you already have, not one in the email, and never reply to the message in question. Forward it instead, so you are not writing back to the fraudster's address.

What to ask your bank

Two controls are worth asking your bank about directly. Dual control means one person initiates a wire and a separate person must release it before the money moves; nobody can send a wire alone. Ask whether your bank's online system supports it for your account.

"multifactor authentication or controls of equivalent strength can effectively mitigate customer and user unauthorized access."

Source: Bulletin 2021-36, FFIEC Statement on Authentication and Access to Financial Institution Services and Systems, Office of the Comptroller of the Currency

For vendor bank-change requests specifically, verify by phone before paying anything, using the number your association already has on file.

"A fraudster who can email you fake bank details can just as easily supply a fake 'verification' phone number that rings their own desk."

Source: A vendor emailed new bank details, how do I verify a bank change request safely?, Stampli