Playbook 1
Wire-transfer fraud & deepfake principal impersonation
A capital call, distribution, closing, or “principal's urgent instruction” is spoofed — by email compromise, a lookalike domain, or an Arup-style deepfake of the principal or CFO.
The money moves in minutes; the recall window is the first hour, not the first week.
The first hour
- 1
Freeze and verify: stop any pending release and pull the actual wire details before anything else.
- 2
Call the bank's fraud desk immediately and request a recall — the SWIFT/ACH recall window is measured in hours.
- 3
File with FBI IC3 to trigger the Financial Fraud Kill Chain (in Canada, notify CAFC and the bank).
- 4
Verify out-of-band with the real principal on a known number — never the number in the message.
- 5
Notify the counterparty and custodian so the receiving side can freeze funds.
- 6
Document every timestamp and instruction — the claim depends on it.
Stop the next one
- Dual approval on every first-time wire and every banking-detail change.
- Callback-to-known-number protocol, using numbers stored before the request.
- A verbal passphrase for principal instructions the finance team can demand.
- Wire-desk cooling-off rules for new payees and out-of-pattern amounts.
- Deepfake-resistant verification norms trained into the finance team.