How To Stop Wire Fraud Before It Hits Your Clients

Executive Summary

Most advisors think of wire fraud as a bank problem, something that happens to a client’s checking account and has nothing to do with the advisory relationship. The training, when firms have any, is usually a single slide about phishing emails and a reminder to be careful. That reminder is not a protocol, and the gap between the two is where the money goes.

The FBI’s 2025 Internet Crime Report counted $3.05 billion in business email compromise losses last year, and 86% of that money left through a wire transfer or ACH. Advisory firms sit exactly where that kind of fraud wants to be, holding the authority to move real money on a client’s instruction. What separates the firms that catch it from the firms that wire it is not smarter staff. It’s whether anyone has to pick up a phone before the money leaves.

Dana ran a solo RIA outside Dallas, custodied at Fidelity, about seventy households built over twenty years. One of her longest clients was closing on a lake house and had told her weeks earlier it was coming. So when the email arrived asking her to move $180,000 to a title company account before the closing deadline, it read as expected. Right name, right signature block, even a mention of the property they’d discussed. She sent it.

It wasn’t the client. The email account had been compromised somewhere upstream, and whoever was reading the thread knew enough about the deal to make the request sound ordinary. Dana found out three days later when the actual client called asking why the wire hadn’t gone to the title company he’d used.

Wire Fraud Losses Have Nearly Doubled In A Year

The FBI’s IC3 unit took in just over a million complaints in 2025 and recorded $20.877 billion in losses, a 26% increase over 2024. Business email compromise, the category Dana’s firm fell into, was the second largest loss category on the list at $3.05 billion.

The transaction data inside that number is the part advisors should sit with. 86% of BEC losses moved by wire transfer or ACH. Almost none of it moved by debit card or a peer-to-peer app. It’s the instrument every RIA uses to move client money on a normal Tuesday, which means the fraud isn’t happening on some unfamiliar channel. It’s riding the exact process a firm already runs correctly a hundred times before it runs it wrong once.

Account takeover, the category closest to an advisor’s login or a client’s email being hijacked outright, added another 4,700 complaints and $359.7 million in losses on its own. Smaller than BEC, and still real money, and still built on the same failure: somebody acted on an instruction without confirming who actually sent it.

Why Small RIAs Are The Easiest Targets

Fraud like this isn’t picking firms at random. It’s picking firms with nobody positioned to catch it.

Of the Texas RIA firms in our own database that report an adviser headcount, 12,290 of 16,457, 74.7%, operate as a single investment adviser representative. One person handling the relationship, the paperwork, and the wire request, often from a home office with no compliance staff and no second signature required on anything. It’s the exact shape a fraud attempt is built to exploit, because there’s no colleague down the hall to ask “did you actually talk to him.”

Dana’s firm was one of those 12,290. She had no compliance officer, no operations person, and no rule requiring a callback before a large wire went out. The instruction looked legitimate and nobody else was in a position to check it. Fixing that doesn’t take a full compliance department. It takes requiring a second person, whoever that is, to be part of every wire before it leaves.

What The SEC And FINRA Are Actually Telling Advisors To Do

Regulators have been direct about this, and the advice is aimed at investors as often as it’s aimed at firms, which tells you how common the impersonation angle has gotten.

The SEC’s December 2024 investor alert, issued jointly with the FBI, tells investors to independently verify they’re communicating with an investment professional at a registered firm, using contact information pulled from the firm’s own Form CRS on Investor.gov rather than any number or address the other party supplies. That’s the same principle a firm needs to run internally. Verify through a channel the fraudster doesn’t control, never through the one they just handed you.

FINRA’s investor alert on imposter scams makes the same point from the other direction, walking through how convincing an impersonation attempt can look once someone has read a few real emails in the thread. And the SEC’s 2021 alert on fraudsters posing as advisers is now four years old, which means this isn’t a new problem regulators are still figuring out. It’s a known pattern with a known fix that a lot of firms still haven’t put in writing. NASAA’s advisory on impersonation scams adds the same warning at the state level, aimed at investors who are getting these calls directly.

The Four-Point Wire Check Every RIA Should Run

None of this requires new software or a compliance hire. It requires a rule that gets followed every time, including the time it’s inconvenient.

1. Call the client back on the number already in your CRM, never a number that arrived in the same email or text asking for the wire. If the request came by phone, hang up and call the number on file instead of continuing the call you’re on.
2. A second person, a part-time admin or a spouse who helps with the books, independently confirms the instruction before the wire is released. One person acting alone is exactly the gap fraud is built to use.
3. Any wire going to an account that’s never received money from this client before gets held, even against a real deadline, until steps one and two are both done. A closing date is not a reason to skip verification. It’s usually the reason the fraud attempt was timed the way it was.
4. Every changed instruction gets a dated note in the client’s file, whether or not it turns out to be legitimate. One odd request looks random. Three odd requests across different clients in the same month look like a pattern, and the log is the only thing that shows it to you.

Dana’s firm added all four after the incident. The following spring, a second attempt came through, same style of email, different client, and the callback caught it before anything moved. The protocol doesn’t stop the attempts from arriving. It stops them from working.

What Your Custodian Will And Won’t Catch For You

Custodians run their own fraud checks, and it’s tempting to treat that as coverage. It isn’t, not for the kind of fraud that starts with a compromised email instead of a hacked account.

A custodian’s system is built to flag account-level anomalies, a login from an unfamiliar device, a withdrawal pattern that doesn’t match history, a destination account with a bad reputation. None of that catches a wire that looks completely normal from the custodian’s side because the request came through the advisor, who believed it was real. Dana’s wire didn’t trip anything at Fidelity. It looked like an advisor moving client money for a legitimate reason, because as far as the system could tell, that’s exactly what was happening.

It’s a gap between two different jobs. The custodian is checking whether the account looks like it’s being taken over. The advisor is the only one positioned to check whether the person asking for the money is actually the client, and that check has to happen before the instruction ever reaches the custodian’s system. Firms that assume the custodian has this covered are the ones still relying on a single slide about phishing.

What This Actually Costs You To Build

The honest objection is time. A callback on every wire feels like friction on a business that already runs lean, and for a firm choosing between Schwab, Fidelity, and the newer custodians, wire policies and same-day cutoffs already vary enough to track without adding a manual step.

It’s a few minutes per wire. Most firms that size are already weighing whether to bring on an administrator for exactly this kind of task load, and a documented verification step is one of the easiest things to hand to that person on day one. It doesn’t need judgment. It needs someone willing to make the call and note the answer, every time, without an exception for the client who’s in a hurry.

The math that actually matters is the other direction. $180,000 sent to the wrong account doesn’t come back most of the time. A ten-minute callback that happens on every wire, including the ones that turn out routine, costs a fraction of what one successful attempt takes.

Our goal is to make sure firms have a written process in place before the request that tests it arrives, not after.

Grab twenty minutes and walk through what your firm’s process actually looks like right now: https://calendly.com/mark-ritzstevens/consultation

Sources: FBI Internet Crime Complaint Center, 2025 Internet Crime Report, opened directly at ic3.gov. U.S. Securities and Exchange Commission and FBI, joint investor alert on impersonation fraud, December 2024. SEC, 2021 investor alert on fraudsters posing as advisers. FINRA, imposter investment scam alert. NASAA, impersonation scam advisory. Texas single-IAR share from our own analysis of SEC IAPD Form ADV filings, 12,290 of 16,457 firms reporting an adviser headcount as of the current feed.

Wire fraud is one operational risk among several. We cover the rest of what keeps a growing RIA running cleanly on our practice management page.