Business Email Compromise Wire Transfer and Recovery
Northstar Logistics' controller received an email that appeared to come from the CEO's address, instructing an urgent $850,000 wire to a new vendor, 'Apex Global Supply,' for an acquisition deposit. The email said the CEO was in meetings and could not be reached. The controller initiated the wire; the bank's callback verification reached a phone number in the email signature, which was answered by a person claiming to be the CEO. Funds were sent to an account at a regional bank. Three days later, the real CEO denied the request. Northstar's bank traced $600,000 to a second account at an offshore bank, $150,000 withdrawn in cash, and $100,000 frozen in the initial account. Northstar's crime policy has a $500,000 limit with a $25,000 deductible. The bank's wire agreement includes a commercially reasonable security procedure. Northstar wants to know recovery prospects and whether the bank is liable.
1. Trace the funds and calculate Northstar's potential recovery from the frozen funds, insurance, and remaining shortfall. State assumptions.
Read the worked answer
Total wire: $850,000. Known frozen funds: $100,000. Funds traced offshore: $600,000, recovery uncertain. Cash withdrawn: $150,000, likely unrecoverable. Insurance: $500,000 limit less $25,000 deductible = maximum $475,000, subject to policy terms and proof of loss. If the insurer pays on the unrecovered loss after the $100,000 frozen recovery, Northstar's shortfall is $850,000 − $100,000 − $475,000 = $275,000, before any offshore recovery or subrogation. If the offshore $600,000 is recovered, the loss and insurance claim change. Do not count uncertain recoveries as certain.
2. Evaluate whether Northstar's bank is liable under the commercially reasonable security procedure and general UCC Article 4A principles. What facts matter?
Read the worked answer
Under UCC Article 4A, a bank that follows a commercially reasonable security procedure in good faith generally is not liable for a customer-initiated payment order, even if the order was induced by fraud. But the bank must actually follow the agreed procedure, and the procedure must be commercially reasonable. A callback to a phone number supplied in the fraudulent email is weak evidence of verification; the bank should call a pre-established number. Facts that matter: the wire agreement, the bank's actual callback logs, whether the bank knew of prior fraud, the time between the request and execution, and whether Northstar's own controller failed to follow internal controls. The judgment call is allocation of loss between a sophisticated customer and its bank.
3. Recommend controls to prevent recurrence and explain how forensic evidence should be preserved.
Read the worked answer
Controls: dual authorization for wires above a threshold, out-of-band verification using a known number, vendor master verification, payment limits, email authentication (DMARC/SPF), employee training, and a documented callback script. Preserve the original email and headers, server and access logs, bank wire records, callback records, and chain-of-custody documentation. Notify counsel, the insurer, and law enforcement promptly. The forensic issue is proving the fraudster's account and the path of funds, not just showing that an email looked suspicious.