Best practice-avoid wire fraud

In recent months there have been an increasing number of instances of wire fraud targeting investment advisors and brokerage accounts. You probably know someone who has had their email account compromised. Once this occurs, the information stored in the email account is no longer private or secure. Criminals will email financial professionals impersonating the account holder, and ask for a wire transfer out of the account. An advisor may be accustomed to clients using email and make the mistake of filling the request. As a best practice, avoid accepting wire transfers over email, or confirm them via a follow-up phone call to a phone number you know and trust.

Excerpt from Risk Management Newsletter, Vol. 3 - Spring 2012

Be alert. Be aware. Learn from these real life examples.

Wire fraud example #1

I had a client that had his email account hijacked and where the person submitted a fraudulent wire transfer request to me via email in 2013 for an IRA distribution from the client’s account.

However, I did not realize the request did not come from the client. I prepared a custodian wire request form to be signed by the client, which included the client’s name, IRA account number and their social security number as required by the custodian. I posted the form to a secure file-share site, but the signature was forged by the person trying to commit the fraud.

Although the IRA distribution form was not processed by the custodian and no funds were distributed from the IRA account, the form had the client’s name, IRA account number and social security number, so the client was concerned that he could be subject to identity theft. He did not blame me nor did he file any complaint nor did he ever even hint that he might file a complaint as he understood what had transpired. I did reimburse the client for a one-year credit monitoring service to help monitor and protect against any further ID theft activity.

Approximately one month later, the client transferred the custodial IRA account assets to another firm and is no longer a client of mine.
 
As a result of this event, we updated my internal procedures and documented in my compliance manual to verbally confirm with the client any wire transfer request or check request submitted via email that is payable to a third party or to an account/mailing address that is not the client account authorized to receive wire transfers or the client’s address of record.

Wire fraud example #2

Trent House received an email the morning of May 30th, 2012 at 10:03 from client Julie Townes. The email requested a wire transfer to be processed and had a letter of instruction attached and signed by both Clem and Milt Townes.

We sent the request to our custodian for the wire to be processed after verifying their signatures. Once the request was sent, Trent House called Clem Townes to confirm…even though her email said she would be busy and to email her. We exchanged a few messages.

In her last email, Clem said she did not send the wire request. We immediately called our custodian to stop the wire. Unfortunately the transaction was already processed and the wire had been released. They immediately called the receiving bank of wire to alert of fraudulent activity. The receiving bank said they red-flagged that account and the funds wouldn’t be able to be withdrawn. Basically, the wire was received but monies were not yet withdrawn at that time. The receiving bank said it would take at least 24 hours to confirm that they can return the monies to the custodian.

We spoke to our client and she called the police. A police report has been filed and all emails and information has been given to them as well as to the custodian to investigate. We also checked with our email provider to assure that it was not our email account that was compromised.

The custodian will change all account numbers for this client to assure security for them.