Wire Fraud Callback Verification: The Ceremony That Stops BEC
Published November 7, 2026 · Reviewed November 2026 · By the Ingenious AI team
The short answer
Wire fraud callback verification is the ceremony step where your team calls the beneficiary on the known-good number already on file — never a number from the payment message — and records who called, when, and whether the code matched. In WireWatch a held payment releases only after that callback, two approvals from distinct people on distinct devices, and no reject. Ceremony as implemented in WireWatch's rules engine, November 2026.
What are the steps of the ceremony?
| Step | What happens | What blocks release |
|---|---|---|
| 1. Hold | The instruction is scored 0–100 by deterministic rules (beneficiary novelty × bank-detail change × channel × sender × urgency × amount). Score ≥ 20 holds, before any money moves. | Nothing — the hold is automatic. |
| 2. Callback | Your team calls the known-good number on file (never the number in the message) and records the caller, the time, and whether the confirmation code matched. | No recorded callback, or a code that does not match. |
| 3. Dual approval | Two approvers, with distinct emails, on distinct devices, each approve the release. | One approver, two approvals from one device, or any reject. |
| 4. Release | The payment is released and every step — hold, callback, approvals, release — is written to the SHA-256 hash-chained audit ledger. | — |
This table is the ceremony template: print it, pin it, and run every scored-risky instruction through it in order. Skipping a row is what the fraud is counting on.
Why does the callback have to be out-of-band?
Because in business email compromise, the channel is the weapon. The instruction arrives by email, WhatsApp, or voice — WireWatch's docs call the WhatsApp/voice shape "the Fideuram pattern" — and everything inside that message, including any "call me on this number" line, was written by whoever wants the money. A callback inside the same thread verifies nothing; it asks the attacker to confirm the attack. The number in your vendor master was verified when nobody was under pressure, which is exactly why it counts as evidence and the message's number never can. How BEC wire fraud works walks the attack this step breaks, and what a payment-verification hold is covers the pause that makes room for the call.
How do you know the ceremony is being followed?
By the ledger, and by drills. Every ceremony step lands in a hash-chained audit ledger — each event stores the previous event's hash plus its own — so a missing callback or a single-device approval is visible after the fact, not just against the rules. WireWatch's drill mode (Pro) scores the team's discipline on the same three acts, out of 100: hold immediately (+40), perform the callback to the known-good number (+30), dual-approve on separate devices (+30). The three drill scenarios are the three shapes BEC actually takes: a fake CEO WhatsApp message, a vendor bank-detail change by email, and an urgent voice call from "the bank". The full normative walkthrough is how the ceremony works; the rest of the Ingenious AI fleet is at getingeniousai.com.
Frequently asked questions
What is wire fraud callback verification?
It is the step in a payment-verification ceremony where your team calls the beneficiary back on the known-good number already on file — never a number supplied in the payment message — and records who called, when, and whether the confirmation code matched. In WireWatch, a recorded callback with a matching code is one of the conditions that must be met before a held payment can be released.
Why must the callback use a number already on file?
Because the message asking for money may itself be the fraud. Business email compromise works by sending believable instructions through email, WhatsApp, or voice; any phone number inside that message is part of the attacker's script. The number in your vendor master was verified before the pressure existed, which is what makes the callback out-of-band evidence instead of a conversation with the attacker.
What are the steps of the verification ceremony?
Four, in order: the instruction is scored by deterministic rules and held at a score of 20 or more; your team performs the out-of-band callback to the known-good number and records it; two approvers on separate devices both approve, with any reject blocking release; and the payment is released, with every step written to a SHA-256 hash-chained audit ledger.
Can one person complete the ceremony alone?
No. Release requires two approvals from distinct approver emails and two distinct device labels — two approvals from one person, or from one phone, cannot release a payment. That separation is deliberate: a single compromised mailbox or a single pressured employee is never enough to move money.
Does WireWatch make the callback call for us?
No. WireWatch never calls anyone on your behalf. The callback is your team's step; WireWatch records it as evidence in the ledger. The platform is a process control — it enforces the ceremony and keeps the proof — not a detection tool, and it does not guarantee the outcome.