How BEC Wire Fraud Works (and Why Email Approval Fails)
Published November 7, 2026 · Reviewed November 2026 · By the Ingenious AI team
The short answer
BEC wire fraud works by sending a believable payment instruction — impersonating a CEO, vendor, or bank over email, WhatsApp, or voice — with new bank details and urgency, then collecting a normal approval. Email approval fails because it happens inside the attacker's own thread. The ceremony breaks it: a score of 20 or more holds the payment, and release needs an out-of-band callback plus two approvers on separate devices. Attack shapes and scores from WireWatch's drill library and rules engine, November 2026.
How does the attack unfold, step by step?
| Attack step | What the attacker does | The ceremony break point |
|---|---|---|
| 1. Impersonate | Poses as the CEO, a vendor, or the bank over a spoofable channel — email, WhatsApp, or voice (a cloned voice is enough). | Channel and sender are scored, not trusted: WhatsApp/voice adds 15, an unknown sender adds 15. |
| 2. Change the destination | Introduces a new beneficiary, or "updated" bank details for a real vendor. | The two heaviest signals in the engine: new beneficiary +45, changed bank details +35. Either alone holds. |
| 3. Apply pressure | "Wire it today." Secrecy, a meeting the boss cannot leave, a deal that will collapse. | Urgency adds 10 — and changes nothing about the process. The hold and callback happen anyway. |
| 4. Collect the approval | Gets an employee to approve inside the same thread, often pre-blocking verification ("don't call me, I'm in a board meeting"). | An in-thread approval releases nothing. Release requires a callback to a number on file plus two approvers on separate devices. |
Why exactly does email approval fail?
Approval is supposed to be an independent check. In a BEC thread it is not independent of anything: the instruction, the bank details, the supporting invoice, and the voice on the follow-up call can all be the same actor. The approver is diligent — they read the thread, the thread looks right, they approve. WireWatch's design starts from that failure. Its engine never tries to judge whether a message looks fraudulent (no ML, no voice detection); it scores the situation — new destination, changed details, spoofable channel, unknown sender, pressure, size — and any score of 20 or more moves the decision out of the thread entirely, into a callback ceremony the attacker cannot attend.
What do the drill scenarios teach?
WireWatch's drill library is the attack catalogue, taught safely. Fake CEO WhatsApp: "Wire $48,500 to our new vendor today. Don't call me, I'm in a board meeting." — impersonation, a new beneficiary, urgency, and a pre-blocked callback in four sentences. Vendor bank-detail change by email: a lookalike domain, a correct-looking invoice, and details that differ from the last verified set. Urgent voice call from "the bank": a director's cloned voice saying the supplier changed banks. Each drill is scored on ceremony discipline out of 100 — hold (+40), callback (+30), dual approval (+30) — because the defence is a habit, not a detector. What a payment-verification hold is explains the mechanism each drill exercises; how the ceremony works is the full walkthrough. More from Ingenious AI at getingeniousai.com.
Frequently asked questions
How does BEC wire fraud work?
Business email compromise wire fraud works by instruction, not intrusion: an attacker impersonates a CEO, vendor, or bank over email, WhatsApp, or voice, introduces new or changed bank details, adds urgency, and gets an employee to approve a payment through the normal process. WireWatch's drill library teaches the shapes with three scenarios — a fake CEO WhatsApp message, a vendor bank-detail change by email, and an urgent voice call from 'the bank'.
Why does email approval fail against BEC?
Because the approval happens inside the attacker's channel. If the instruction arrived by a spoofed or compromised email thread, the person 'approving' it is confirming details the attacker supplied, with the attacker watching the thread. WireWatch's rules treat that as a risk signal, not reassurance: an unknown sender on a spoofable channel adds 15 points toward a hold, and release requires an out-of-band callback plus approval from two people on separate devices — evidence the thread cannot fake.
What are the warning signs of a BEC wire attempt?
The signals WireWatch's deterministic engine scores: the beneficiary is not in your vendor master (+45), the bank details differ from the last verified set (+35), the instruction arrived over WhatsApp or voice (+15), the sender does not match the known-good contact on file (+15), the message demands urgency (+10), and the amount is $10,000 or more (+10). Any combination reaching 20 holds the payment.
Why do attackers add urgency to wire fraud messages?
Urgency is the tool that skips verification. WireWatch's scoring names it directly — 'message demands urgency: pressure is the attacker's tool' — and adds 10 points for it. In the fake-CEO drill scenario the message even pre-blocks the callback: 'Don't call me, I'm in a board meeting.' A ceremony makes urgency useless, because the hold and the callback happen anyway.
What stops a BEC payment if the instruction looks perfect?
Process, not detection. WireWatch does not try to detect a cloned voice or a forged email; it makes the forgery irrelevant by forcing the instruction through a hold, an out-of-band callback to a number verified before the message existed, and dual approval on separate devices. A perfect fake still has to survive a phone call to the real vendor — and it cannot.
Check an instruction — free · The callback ceremony, step by step