Wire transfer fraud in an equipment purchase works through the payment instructions. A criminal compromises or imitates the email of someone in the deal. The criminal then sends instructions that point the buyer's wire to an account the criminal controls. The bank executes a transfer that appears legitimate, and FinCEN's 2019 advisory notes that such transfers are often irrevocable.
The defenses that agencies describe against wire fraud are procedural. The core one is to confirm payment instructions through a separate, trusted channel before money moves. In practice that means call-backs to known numbers, dual approval and close attention to any change of account. Those steps sit alongside the money and wire controls on SecondWatt's How We Work page.
Key Takeaways
- Manufacturing and construction ranked first among BEC-targeted sectors. It drew 25% of reported BEC cases in FinCEN's July 2019 advisory, ahead of commercial services (18%) and real estate (16%).
- BEC was the second-costliest crime type in IC3's 2025 report. BEC complaints reported $3,046,598,558 in losses, behind only investment fraud.
- A known payee's new account in emailed instructions is a FinCEN red flag. So are "Urgent," "Secret" or "Confidential" markings and a sender address altered by one or more characters.
- Agencies say to confirm account changes through a second, trusted channel. IC3 names secondary channels or two-factor authentication; Commerce OIG's grant-payment alert adds known-contact calls or videoconferences, and dual approval.
- After a misdirected wire, time is of the essence. The FBI's Financial Fraud Kill Chain froze 58% of $1,163,919,846 in attempted theft in 2025.
How wire transfer fraud reaches equipment deals#
Fraud of this kind is known as business email compromise (BEC). In one of the two schemes that FinCEN's 16 July 2019 advisory FIN-2019-A005 defines as email compromise fraud, criminals compromise victims' email accounts "to send fraudulent payment instructions to financial institutions or other business associates in order to misappropriate funds or value." BEC is the type that targets operational entities, including commercial ones. Criminals may break into the real account, spoof its address, or use an address altered by one or more characters.
The sectors around equipment deals rank high. Among BEC schemes affecting US financial institutions and their customers, manufacturing and construction ranked first at 25% of reported cases, ahead of commercial services (18%) and real estate (16%). FinCEN gives no year range for that split. In its account of attacks on schools and universities, large-scale construction and renovation projects "have repeatedly been targets of high-dollar thefts."
Risk concentrates where money moves. Down payments and "the final transfer of proceeds upon closing" are the attractive targets in FinCEN's real estate example. Applied to an equipment purchase, the matching moments are the deposit and the final payment. The used gas turbine cost guide covers comparing packages before a deposit commits a project to one candidate.
The scale of the problem#
Complaints to the FBI's Internet Crime Complaint Center (IC3) reached 1,008,597 in 2025, with $20.877 billion in reported losses, according to the 2025 IC3 Annual Report. Investment fraud was the largest component of those losses, "followed by business email compromises and tech support scams."
BEC accounted for 24,768 complaints in 2025, up from 21,442 in 2024. Wire transfer/ACH takes 86% of the BEC pie in the report's chart of "the most frequent ways complainants reported financial losses."
$3,046,598,558 — business email compromise losses reported to IC3 in 2025, up from $2,770,151,146 in 2024.
Worked example, average reported loss per complaint in 2025, with both sides calculated as reported losses divided by complaints:
$3,046,598,558 ÷ 24,768 = $123,005 per BEC complaint. Across all 2025 complaints, $20.877 billion ÷ 1,008,597 = about $20,699, the 2025 average IC3 prints. Then 123,005 ÷ 20,699 = 5.9. A BEC complaint carried about 5.9 times the average reported loss.
The same division for 2024 gives $2,770,151,146 ÷ 21,442 = $129,193. BEC losses rose about 10.0% from 2024 to 2025 and complaints about 15.5%, so the average loss per BEC complaint fell about 4.8%.
These are complaint figures, and they can move. Appendix C of the 2025 IC3 report notes that descriptive data such as crime type or loss "can evolve based upon investigative or analytical proceedings."
How the scheme works in a purchase#
FinCEN's 6 September 2016 advisory FIN-2016-A003 breaks a BEC scheme down into three stages. Criminals compromise the victim's information and email accounts, transmit fraudulent transaction instructions, then trick an employee or financial institution into executing the transfer. Applied to an equipment purchase, the steps run in this order:
- Compromise or spoof. The criminal takes over a mailbox or registers a look-alike domain, such as "Vednor.com" for "Vendor.com" in JPMorgan Chase's example.
- Observe the deal. FinCEN's 2019 advisory says criminals identify vulnerable processes and "insert themselves into communications by impersonating a critical player."
- Change the instructions. A new account number arrives, apparently from the seller.
- Add urgency. Requests marked "Urgent," "Secret," or "Confidential" are on FinCEN's list of red flags.
- Wire. The buyer pays a real invoice to the wrong account.
Timing is part of the method. A 9 June 2023 IC3 public service announcement warns that inside a real estate participant's email, criminals "are able to monitor the real estate proceeding and often time the fraudulent request." The request is for a change in payment type or bank account. JPMorgan Chase's 2022 bank guide, Defending against business email compromise, notes that inbox forwarding rules can make the watching automatic, copying emails containing "payment" or "invoice" to the criminal.
Warning signs before a payment#
Written for financial institutions in 2016, the BEC red flags "remain relevant," FinCEN said in 2019. Several of those listed in FIN-2016-A003 describe what a buyer's accounts payable desk sees too:
- Emailed instructions "contain different language, timing, and amounts" than earlier authentic ones.
- The sender's address resembles a known one but is altered "by adding, changing, or deleting one or more characters."
- Instructions "direct payment to a known beneficiary; however, the beneficiary's account information is different from what was previously used."
- Delivery leaves "limited time or opportunity to confirm the authenticity" of the request.
- A request for further payments follows "immediately" after a successful payment to a new account.
One flag alone proves little: "no single transactional red flag necessarily indicates suspicious activity," and the surrounding facts matter.
Four kinds of request should be treated as high risk until independently confirmed through another trusted contact method: changing payment instructions, accelerating a payment, bypassing normal controls, or providing payment confirmation. That guidance comes from a Commerce Department inspector general fraud alert on diverted federal grant payments. Its check is a call or videoconference to a known contact through a previously established method, never a number in the request.
A late change of payment details also pauses a SecondWatt opportunity. The live How We Work page, under "What pauses an opportunity," lists this case: "A deposit is requested outside the agreed escrow, or payment details change late."
Controls that stop it#
Wire fraud prevention rests on controls set before the first invoice arrives. The table lists each control, what it stops and who performs it, as the cited source assigns the task.
Payment controls against business email compromise, with the party each source assigns (IC3, FinCEN, FTC, Commerce OIG and JPMorgan Chase documents)#
| Control | What it stops | Who performs it, per the source |
|---|---|---|
| Call back on a number from a system of record, never one in the email | A spoofed or hijacked email confirming its own instructions | Payments staff and other treasury employees (JPMorgan Chase guide, bank guidance) |
| Confirm requests to change account information through secondary channels or two-factor authentication | A late switch to a new account number | Individuals and businesses, under "How to Protect Yourself/Business" in an 11 September 2024 IC3 announcement |
| Treat a known payee's new account details in emailed instructions as a red flag | A known payee's account replaced by the criminal's | Financial institutions (FinCEN red flags, FIN-2016-A003) |
| Dual approval and separation of duties for banking changes and wire payments | One deceived employee releasing a wire | No party named; the alert covers federal grant and contractor payments (Commerce OIG fraud alert) |
| Clear procedures for approving purchases and invoices | Phony invoices paid on the assumption they are real | The business and its staff (FTC small-business guide, July 2023) |
| Refuse an emailed last-minute change of account; contact the lender or real estate professional at a number or email address known to be real | An email impersonating the professional that redirects closing funds | The home buyer, in August 2022 FTC mortgage guidance written for home closings |
The call-back itself needs a procedure. Staff place an outbound call on a known or trusted number for a system of record. They speak to "the party who is personally accountable for the change in instructions." One warning in the JPMorgan Chase guide applies throughout: "Never presume that a callback was performed."
How a payment is requested matters too. The FTC's July 2023 guide Scams and Your Small Business says businesses should "Pay attention to how someone asks you to pay" and tell staff to do the same. Payment terms belong in the purchase documents from the start. The gas turbine RFQ checklist already asks bidders to state payment milestones.
SecondWatt's money and wire controls#
Under "How we are paid," the How We Work page says: "We do not hold deposits or purchase funds." The next line reads: "Payments follow the transaction documents, and independent escrow with written disbursement instructions is our default."
The four lines under "Money and wire controls" read:
- "Wire instructions are confirmed by a call-back on contact details already on file, never from an email alone."
- "A late change to account details stops the payment until it is confirmed."
- "Payments go to the account the transaction documents name, not to an intermediary."
- "Nothing is released on emailed instructions, side wires or 'send it now and we'll sort the paperwork later.'"
The page states these controls without naming who performs each one. The buyer route page repeats all four. Under "Your diligence and purchase decision," it places diligence with the buyer: "Your appointed advisers assess suitability, condition, title and transaction risk."
Under "Your information and relationships," the page also describes the opportunity record. It is "Built as the work happens, before the money moves: who each party is, who represented whom and with what authority, what was reviewed, what was agreed, and where funds were directed."
If a wire goes to the wrong account#
The first call goes to the bank. IC3's business email compromise page says to contact the originating financial institution "as soon as fraud is recognized to request a recall or reversal." Then file a detailed complaint at ic3.gov, with the banking information. Speed matters: "If you discover a fraudulent transfer, time is of the essence," the 2025 IC3 report says.
IC3's Recovery Asset Team (RAT), set up in 2018, works with banks and FBI field offices "to assist in the freezing of funds." It covers fraudulent domestic and international transactions through the Financial Fraud Kill Chain (FFKC). For international ones, it coordinates with FinCEN's Rapid Response Team and FBI legal attaché offices. The kill chain is not limited to BEC: in 2025 it saw a rise in tech support and account takeover initiations.
$679,013,183 — funds frozen through the Financial Fraud Kill Chain in 2025, out of $1,163,919,846 in attempted theft across 3,900 incidents, a 58% success rate.
In August 2025, individuals closing on a home wired over $449,000 after an email impersonating their attorneys. Once their IC3 complaint arrived, the RAT initiated the FFKC to request a freeze. The recipient bank reported the full amount still in the account and on hold. Recovery "is not assured," but FinCEN's advisory FIN-2019-A005 reports greater success when victims or banks report fraudulent wires to law enforcement within 24 hours.
Sellers carry exposure too. FinCEN's supplier scenario in FIN-2016-A003 shows how: when a criminal impersonates the supplier, the buyer's payment goes to the criminal's account instead. The used gas turbine seller's guide suggests comparing offers on payment milestones and release timing.
FAQ: wire fraud in equipment purchases#
What is business email compromise?#
Appendix B of the 2025 IC3 report defines it as a scam targeting businesses or individuals working with suppliers, and businesses that regularly make wire transfer payments. The scam runs through compromised email and "other forms of communication such as phone numbers and virtual meeting applications." Email account compromise (EAC), a separate type in FinCEN's 2019 advisory, targets personal email accounts belonging to an individual.
Can a wire transfer be reversed?#
Sometimes, through a recall. The 2025 IC3 report describes an April 2025 case. A freeze already on the recipient account led that bank to alert the originating bank of an Oregon city government office. The originating bank was able to issue a recall for the $6 million wire.
For a bank transfer, the FTC's June 2026 guide What To Do if You Were Scammed says to report it to the bank immediately and ask for a reversal. The JPMorgan Chase guide warns that once a payment is released, "there are no guarantees the funds will be recovered."
What is vendor impersonation?#
It is BEC in which a criminal poses as a supplier. In FinCEN's 2016 scenario "Criminal Impersonates a Supplier," the criminal tells a company that "future invoice payments should be sent to a new account number." FinCEN's 2019 advisory says fraudulent vendor and client invoices are generally tied to larger BEC amounts than CEO fraud. Vendor impersonation also often routes the first flow of funds to foreign intermediary beneficiaries.
Can a title company be impersonated?#
Yes. IC3's June 2023 announcement says the BEC scam in real estate "targets all participants" in the transaction, title companies and agents among them. In a March 2025 case from the 2025 IC3 report, a victim closing on a property received a compromised email from the "title company." It carried wire instructions for over $1.3 million to a fraudulent account.
The reverse case in FIN-2016-A003 runs through a realtor: a criminal uses a hacked realtor email to tell an escrow company to redirect commission proceeds.
Who bears the loss when a wire goes to a fraudster?#
Sometimes the bank: FinCEN's 2016 advisory notes that in some US cases, "financial institutions have absorbed losses through reimbursing customers victimized by e-mail compromise fraud." IC3's business email compromise page notes that a recall request to the originating bank can also ask for a Hold Harmless Letter or Letter of Indemnity. Help with recovery varies: the 2025 IC3 report notes that "Different financial institutions have varying policies," so it pays to know what your own bank will provide. This article gives no legal advice on liability.
Before the money moves#
SecondWatt publishes equipment research and helps buyers source power equipment; it earns a fee when a sale it arranges closes. If you are planning a purchase, send a request that states the deposit and payment structure you expect. For questions about how a specific deal would be handled, contact SecondWatt.