The Wire You Can’t Get Back

Happy Friday the 13th. Let’s talk about something actually scary.

A friend of mine owns a building supply distributor. About forty employees, solid margins, been around twenty years. A while back his longtime bookkeeper got an email from one of their biggest suppliers. Same logo. Same signature block. Same rep’s name. It was even a reply on a real thread about a real order they’d placed.

The email said the supplier had switched banks and attached updated wiring instructions on what looked like company letterhead. Please use the new account for all future payments. Thanks so much, have a great weekend.

She updated the vendor record. Two invoices went out over the next three weeks. A little over $180,000 total.

Then the real supplier called. Where’s our money?

It turned out the supplier’s email had been hacked weeks earlier. The criminals had been sitting in that inbox, reading every message, learning how the rep wrote, waiting for an invoice big enough to be worth the trouble. When the moment came, they replied on the real thread, from what looked exactly like the real address.

The bank got back a small piece of it. Most of it was gone. And the bookkeeper, who had worked for him for eleven years and never made a mistake that mattered, felt so sick about it she almost quit.

Here’s the part that still bugs him. Nobody broke a rule, because there wasn’t one. No written policy. No phone call to verify. No second approval. Just a good person doing her job the way she’d always done it, in a world that changed underneath her.

In April, the FBI’s Internet Crime Complaint Center released its annual report for 2025, and it was the worst year it has ever recorded. More than a million complaints. Nearly $20.9 billion in reported losses, up 26 percent from the year before.

Business email compromise was the second most expensive crime on the whole list, behind investment fraud, at about $3 billion in losses. Ransomware gets the headlines, but the quiet stuff is what’s actually draining bank accounts.

And it’s not just big companies. The Association for Financial Professionals surveys finance teams every year, and its 2026 Payments Fraud and Control Survey found that 76 percent of organizations dealt with attempted or actual payments fraud in 2025. According to a breakdown from U.S. Bank, 74 percent of organizations ran into business email compromise last year.

Three out of four. If you think your company is too small to be a target, you’re doing the criminals’ job for them.

For the first time, the FBI’s report broke out complaints that involved artificial intelligence as their own category. More than 22,000 of them, with about $893 million in losses. AI writes the emails now, and they don’t have typos anymore. The old advice to “watch for bad grammar” is dead.

It goes further than email. In early 2024, a finance employee at Arup, the global engineering firm behind the Sydney Opera House, joined a video call with the company’s CFO and several colleagues. The CFO told him to make a series of confidential transfers. He did. Fifteen of them, about $25 million in total.

Every other person on that call was a deepfake.

Now think about how much video and audio of you is floating around online. Podcast interviews. Webinars. Social videos. Your voicemail greeting. A criminal doesn’t need much to make a passable version of you calling your bookkeeper on a Friday afternoon, sounding stressed, asking her to push a wire before the bank closes.

Would she question you? Would anyone on your team question the owner?

That’s exactly what they’re counting on.

Look at the next six weeks from a criminal’s point of view.

People are out of the office. Approvals get rushed so things don’t sit over a long weekend. Year end bills and bonuses mean more money moving than usual. Vendors are sending final invoices. Everybody’s distracted, tired, and trying to close things out before the break.

That’s the perfect environment for one urgent email to slip through. Which is why you lock this down now, not in January.

You don’t need to become a cybersecurity expert. You need to recognize the handful of plays that show up over and over.

1. The vendor bank change. The one that got my friend. A real or fake vendor emails new payment instructions. Every future payment goes to the criminal.

2. The fake boss. An email, text, or call that looks like it’s from you or a partner, asking someone to send money, buy gift cards, or pay an “urgent” invoice. Usually with a reason it has to be quiet and fast.

3. The payroll switch. An email that looks like it’s from an employee asking HR to change where their paycheck gets deposited. Next payday, the check goes to the criminal and your employee gets nothing.

4. The fake invoice. A bill from a company that sounds legitimate, for something nobody ordered, sent to whoever pays the bills. It slides through because it looks routine.

5. The real estate or closing wire. If you’re buying a building, a house, or another business, criminals watch for closings and send fake wiring instructions right before the money moves.

Notice the pattern. Every one of them is about changing where money goes, and every one of them leans on urgency and trust. The defense is the same for all five.

Here’s what I’d put in place this week. None of it is expensive. Most of it is just writing down rules and enforcing them.

Write this down and tell everybody who touches money. Any change to bank details, from any vendor, employee, or client, gets verified by phone, using a number you already had on file. Not the number in the email. Not the number in the signature block. The number in your system from before this request showed up.

Call. Talk to a person you know. Confirm the change. Write down who you spoke to and when. If you can’t reach them, the payment doesn’t go out.

This one rule would have saved my friend $180,000.

Pick a dollar amount. For a lot of small businesses, $5,000 is a good starting point. Anything above that needs a second person to approve before it leaves. Most business banking platforms let you set this up so the bank itself enforces it.

The person who sets up a new vendor or changes payment details should never be the same person who approves the payment.

When a vendor’s bank details change and you’ve verified it, hold the first payment to the new account for a day or two and confirm again. Real vendors don’t mind. Criminals hate it, because their whole game depends on speed.

Tell your team this out loud, in a meeting: “I will never ask you to send money, buy gift cards, or skip a step through email, text, or a surprise call. If you ever get a request like that from me, it’s not me. Call me back on my cell and verify. You will never get in trouble for checking.”

That last sentence matters most. Your team needs to know that slowing down and verifying will make you proud, not annoyed. If they’re afraid of you, they’ll send the wire.

For the deepfake era, set up a verbal code word with anyone who can move money for you. Your bookkeeper, your controller, your business partner, your spouse. If someone calls sounding like you and asking for money, they ask for the code word. Keep it something that would never appear online.

Do the same at home. Grandparent scams that use a cloned voice of a grandkid are real, and an older parent hearing your “voice” panicking on the phone will do almost anything.

Most of these scams start with somebody’s email getting taken over. Close the easy doors:

People get tired and miss things, especially in December. Systems don’t.

I set up a simple automation in Make that watches the inboxes where invoices and payment requests land. Any email that contains phrases like “bank details,” “wire instructions,” “new account,” “routing number,” or “updated payment” gets flagged and sent straight to me and my bookkeeper in a separate channel with a reminder to call and verify. It doesn’t block anything. It just makes sure a human with a phone in his hand looks at every one of those emails before money moves.

Takes about an hour to build. It’s the cheapest insurance policy you’ll ever buy.

Time is everything. Write this plan down now, while you’re calm, and put it where the people who handle money can find it.

Minute one: Call your bank’s fraud department and ask them to recall the wire or reverse the payment. Don’t email them. Call. Ask for someone with authority to start a recall.

Same day: File a complaint with the FBI’s Internet Crime Complaint Center at ic3.gov with every detail you have. The FBI runs a process called the Financial Fraud Kill Chain that can help freeze stolen funds, and the window matters. Reporting within 72 hours gives you the best realistic shot at getting money back. After that, the odds drop fast.

Next: Change passwords on any account that might be compromised. Call the real vendor, employee, or client through a known number and tell them what happened. Their email may be the one that’s been hacked.

Then: File a local police report, call your insurance agent, and save every email, invoice, and record. Ask your agent whether your policy actually covers social engineering fraud. A lot of standard policies don’t, or they cap it way lower than you’d expect. Find out now, not after.

“We’re too small. Nobody’s targeting us.”

Small businesses are the favorite target, because they have real money and almost no controls. Criminals aren’t picking you out of a lineup. They’re running thousands of emails and waiting for one bookkeeper to say yes.

“My people are smart. They’d catch it.”

My friend’s bookkeeper was smart. Eleven years with him and never a mistake that mattered. The email was a reply on a real thread from the real vendor’s actual hacked account. Smart doesn’t beat a process. A process beats it.

“Calling every vendor is a pain.”

You only call when bank details change. That happens a few times a year. Two minutes on the phone versus a six figure hole. Easy math.

“I don’t want my team second guessing me.”

Yes, you do. You want them to second guess anyone, especially you, when money is moving in a strange way. That’s the whole point.

Before you leave for the weekend:

Then sleep a little better this holiday season. Criminals go where it’s easy. Your job is to not be easy.

Sunday we’re talking about the empty chair at your Thanksgiving table. Not the one for somebody who passed. The one for somebody who’s still here.

Refined. Relentless. Unapologetic.

Marcus