A routine payment can turn into a serious financial loss in minutes. A criminal intercepts an email thread or impersonates a trusted business contact, and the business wires money to an account it believes belongs to a supplier, only to learn later that the banking details were fraudulent. Business email compromise wire fraud recovery is possible in some cases, but it depends heavily on how quickly the business responds, where the money went, and who may be legally responsible. The short answer: call your bank and report to the FBI immediately, then evaluate claims against the recipients, your bank, your trading partner, and your insurer.
What Is Business Email Compromise?
Business email compromise (BEC) happens when criminals manipulate business communications to divert legitimate payments. They might hack a supplier’s email account, impersonate an executive, or send a convincing message claiming that a vendor’s banking details have changed. The FBI’s Internet Crime Complaint Center (IC3) describes BEC as a sophisticated scam that targets both businesses and individuals who perform legitimate transfer-of-funds requests. The FBI has explained that the scam is often carried out by compromising legitimate business email accounts through social engineering or computer intrusion techniques in order to conduct unauthorized transfers of funds.
The challenge with BEC is that the payment may appear completely legitimate to the person who sends it. By the time anyone realizes the payment was fraudulent, the money may already have moved through several accounts.
What Should You Do Immediately if You Suspect Wire Fraud?
Time is the single most important factor in recovering diverted funds. The FBI advises victims to act as soon as the fraud is recognized, and its own results show that funds are far easier to freeze before they leave the first receiving account.
- Call your bank’s fraud department. Request an urgent recall of the wire, provide the transfer details, and explain that the payment resulted from fraud. Your bank can contact the receiving bank and ask it to hold the funds. Recovery is never certain.
- File a complaint with IC3 at ic3.gov. The FBI urges victims to file regardless of the amount lost. The IC3 Recovery Asset Team, created in 2018, works with financial institutions and FBI field offices to freeze funds sent to domestic accounts, and IC3 reports that most of the freezes the team initiates involve BEC.
- Report to local law enforcement and notify your trading partner through a known, verified phone number, not by replying to the suspicious email.
- Preserve the evidence. Keep the emails (with full headers), payment instructions, wire confirmations, invoices, and all correspondence with your bank. These records matter for insurers, investigators, and any later lawsuit.
What Legal Options Are Available?
If the initial recovery efforts fail or only partially succeed, several legal avenues may be worth exploring.
A Claim Against Your Bank
Business wire transfers are governed by Article 4A of the Uniform Commercial Code, which Michigan has adopted at MCL 440.4601 et seq. Whether a bank can be held responsible depends first on whether the payment order was authorized.
A payment order is the customer’s authorized order if the customer authorized it or is otherwise bound by it under agency law (UCC 4A-202; MCL 440.4702(1)). In the classic BEC scenario, an employee is tricked into sending the wire. That order is authorized, even though it was induced by fraud, so the business generally bears the loss as between it and its bank. This is why bank claims are usually hardest in the most common BEC fact pattern.
The analysis is different when criminals take over the business’s online banking credentials and send a wire themselves. If the bank and customer agreed to a security procedure, an unauthorized order is still treated as the customer’s if the procedure is commercially reasonable and the bank accepted the order in good faith and in compliance with the procedure and any written customer instructions (MCL 440.4702(2)). Commercial reasonableness is a question of law for the court (MCL 440.4702(3)). If the bank cannot meet those requirements, it may be required to refund the payment. A customer who wants a refund of an unauthorized payment must act promptly: a customer is precluded from objecting unless it notifies the bank within one year after receiving notice reasonably identifying the payment order (UCC 4A-505; MCL 440.4955).
When a payment order identifies the beneficiary by both name and account number and they refer to different persons, a receiving bank that does not know of the mismatch may rely on the account number and has no duty to check whether the name and number match (UCC 4A-207; MCL 440.4707(2)(a)). Claims against the receiving bank are therefore difficult, though the specific facts, including what the bank actually knew, still matter.
Claims Against Those Involved in the Fraud
If investigators identify the people or businesses that received or moved the money, a business may sue them. Depending on the circumstances, claims may include fraud, conversion, unjust enrichment, and civil conspiracy.
Courts can also act quickly to preserve assets. A business may ask for a temporary restraining order or preliminary injunction freezing an identified account, and in some circumstances may seek prejudgment remedies, such as attachment, that hold property while the case proceeds. These remedies require a strong evidentiary showing and fast action. Finding the right defendants and locating recoverable funds can be difficult, especially when the perpetrators operate overseas, which is why working with an experienced civil litigation attorney early can make a real difference.
Claims Against a Vendor or Business Partner
Often the fraudulent instructions came from a vendor’s or customer’s compromised email account. When that happens, the two innocent businesses may dispute who should absorb the loss. The answer can depend on the parties’ contract, any payment-verification terms, whether the buyer still owes the invoice, and which party was in a better position to prevent the fraud. In Beau Townsend Ford Lincoln, Inc. v. Don Hinds Ford, Inc., 759 F. App’x 348 (6th Cir. 2018), the Sixth Circuit reversed a judgment that had put the entire loss on the buyer of twenty vehicles, holding that a factfinder must decide which dealer was in the better position to prevent the fraud, drawing on principles from UCC Article 3, including its imposter rule, and on agency law. A partner whose lax email security enabled the fraud may also face claims related to its data breach liability.
An Insurance Claim
Commercial crime and cyber policies may cover certain wire fraud losses, but the policy language controls. Many crime policies now offer a “social engineering fraud” endorsement (sometimes called fraudulent instruction coverage) written for exactly this situation, usually with a lower sublimit and a condition that the insured verified the instructions. Standard “computer fraud” coverage is less certain. Courts have split on whether it reaches BEC losses. The Second Circuit found coverage in Medidata Solutions Inc. v. Federal Insurance Co., 729 F. App’x 117 (2d Cir. 2018), and the Sixth Circuit, applying Michigan law, did as well in American Tooling Center, Inc. v. Travelers Casualty & Surety Co. of America, 895 F.3d 455 (6th Cir. 2018). The Fifth Circuit reached the opposite result in Apache Corp. v. Great American Insurance Co., 662 F. App’x 252 (5th Cir. 2016), concluding that the email was merely incidental to a loss caused by the authorized transfer. Review your policies promptly, because most require quick notice and proof of loss.
How Can Businesses Prevent BEC Losses?
- Verify every new or changed payment instruction by calling a known phone number already on file, never a number in the email requesting the change.
- Require dual approval for wires and for changes to vendor banking details.
- Turn on multi-factor authentication for email and online banking.
- Use the security procedures your bank offers, and put payment-verification terms in your vendor contracts.
If a compromised mailbox exposed customer data, the business may also have data breach notification obligations.
Frequently Asked Questions
Is my bank responsible if an employee was tricked into sending a wire?
Usually not. Under UCC Article 4A, a wire sent by your own authorized employee is an authorized payment order even if it was induced by fraud. Bank claims are stronger when someone else sent the order and the bank did not follow a commercially reasonable security procedure.
How fast do I need to report BEC wire fraud?
Immediately. Contact your bank and file an IC3 complaint the same day you discover the fraud. The chance of freezing funds drops quickly as time passes. For unauthorized orders, Article 4A also gives a customer only one year after notice to object to the debit.
Can I sue the person whose account received the money?
Yes, if the recipient can be identified. Claims may include fraud, conversion, and unjust enrichment, and a court may freeze the account through a temporary restraining order or other relief while the case proceeds.
Will insurance cover a business email compromise loss?
It depends on the policy. A social engineering fraud endorsement is the most direct coverage. Computer fraud coverage may or may not apply, and courts have reached different results.
Contact the Business Attorneys at Revision Legal
If your business has lost a significant sum to business email compromise, the experienced attorneys at Revision Legal can assess potential claims against recipients, banks, business partners, and insurers, coordinate with investigators, and help determine whether litigation is practical. Learn more about how we help victims of online scams, contact us, or call (855) 473-8474.
This post is general information and is not legal advice.
