Out-of-band wire verification confirms a wire instruction through a communication channel that is separate from the one that delivered the instruction. If a lender receives wire details by email, the callback must use a phone number sourced from a pre-existing record – never a number embedded in that email. Skipping this step is the exact gap wire-fraud schemes exploit.

Why this matters for private lenders

Business email compromise (BEC) is the leading source of wire-fraud losses reported to the FBI Internet Crime Complaint Center. The attack is straightforward: a fraudster intercepts or spoofs an email thread, substitutes their own banking details, and waits. The defense is equally straightforward in principle but requires disciplined execution on every single transaction – not just large ones or unusual ones.

Private lenders move principal balances on every closing. A single compromised wire can erase the return on months of origination work. The five-step protocol below closes the most common failure points.

Step 1: Identify the delivery channel of the wire instruction

Before doing anything else, note exactly how the wire instruction arrived – email, loan-management system message, closing portal, borrower portal, or a direct phone call. That channel is now off-limits for verification. The confirmation must travel through a completely separate path that is not under the control of whoever sent the original instruction.

This distinction is critical because a compromised email account can generate a convincing confirmation reply just as easily as it generated the original instruction. Replying to the same email thread or calling a number listed in the email signature does not constitute out-of-band verification under any definition.

Step 2: Source a pre-existing contact record

Pull a phone number for the counterparty from a record that predates the current transaction. Acceptable sources include the borrower’s original loan application, the title company’s standing closing-instructions file, a vendor’s W-9 on file, or a fully executed contract. The key test is that the record must have existed independently before this wire instruction arrived.

Never use a phone number printed on the incoming wire instruction itself, listed in the email footer that delivered it, or provided in any follow-up message tied to the same communication thread. Fraudsters who control the email also control every piece of contact information contained in it.

Step 3: Run the callback and confirm every wire detail

Call the pre-existing number and verbally confirm each element of the wire instruction: the wire amount, the recipient bank name, the routing number, the account number, the name on the receiving account, and any loan or transaction reference number associated with the wire.

Voicemail does not satisfy this step. Verification requires a live response from a person who can confirm the details item by item. If the contact is unavailable, hold the wire until a confirmed callback is received. A delayed closing is recoverable. A payment wired to a fraudulent account is not.

Expert Take

The most common failure point is not skipping verification entirely – it is performing a partial verification. A lender calls the right number, confirms the bank name, and stops there. Routing and account numbers are where the substitution actually occurs. Every element must be read back and confirmed individually on every wire, without exception. Urgency is a social-engineering tool; a time-pressure argument from any party is a reason to slow down, not speed up.

Step 4: Document the verification before the wire releases

Before approving the wire, record three elements in the loan file: the date and time of the verification call, the exact phone number called and its source – naming the specific pre-existing record it came from – and a written confirmation that the counterparty verbally verified each wire detail listed in Step 3.

This documentation creates an audit trail that protects the lender in the event of a dispute and satisfies the record-keeping discipline that regulators and insurers increasingly expect from private mortgage operations. An undocumented verification is indistinguishable from a skipped one when a claim or examination arises. For documentation standards applicable to private mortgage servicing files, see 10 Record-Keeping Requirements for Private Mortgage Note Servicers.

Step 5: Apply dual control to every wire approval

The person who enters the wire instruction into the banking platform must be a different individual from the person who authorizes its release. The approving party independently reviews the wire amount, the recipient details, and the Step 4 verification documentation before releasing the payment.

Dual control is a standard internal-controls requirement across institutional lending. For private lenders operating lean teams, this means building the role separation into banking platform permissions and written SOPs – not relying on informal agreement. A two-person rule that exists only on paper is not a control. For more on building these controls into a private lending operation, see 10 Critical SOPs Every Hard Money Lender Needs for Compliance and Growth.

Common mistakes that undermine the protocol

• Treating an email reply as out-of-band confirmation. Replying to the same thread is in-band by definition. If the account is compromised, the attacker can confirm back.
• Using the callback number from the wire instruction. This is the most exploited gap. A fraudulent instruction includes a fraudster-controlled phone number that answers the confirmation call and confirms everything.
• Stopping short on Step 3. Confirming the bank name but not the routing number and account number leaves the most critical substitution undetected.
• Completing verification but skipping documentation. No written record means no audit trail – and no defense if a dispute follows.
• Bypassing dual control under time pressure. Manufactured urgency is a core social-engineering technique. Pressure to move fast on a wire is a red flag, not a reason to compress the approval process.

For a broader look at fraud indicators in private loan origination, see A Broker’s Guide to Detecting and Reporting Suspicious Activity in Private Loan Origination and A Private Lender’s Guide to AML and Red Flags.

Related reading

• A Broker’s Guide to Detecting and Reporting Suspicious Activity in Private Loan Origination
• A Private Lender’s Guide to AML and Red Flags
• 10 Record-Keeping Requirements for Private Mortgage Note Servicers
• 7 Compliance Mistakes Private Lenders Make
• 10 Critical SOPs Every Hard Money Lender Needs for Compliance and Growth

This article is educational and does not constitute legal, financial, or cybersecurity advice. Private lenders should consult qualified legal counsel, an insurance broker, and a cybersecurity adviser regarding their specific wire-fraud prevention requirements. Suspected wire fraud should be reported to the FBI Internet Crime Complaint Center at ic3.gov.

Sources

• FBI Internet Crime Complaint Center. ic3.gov.
• FBI Domestic Financial Fraud Kill Chain. fbi.gov.
• FinCEN Business Email Compromise Advisories. fincen.gov.
• FFIEC IT Examination Handbook – Wholesale Payment Systems. ithandbook.ffiec.gov.
• CISA Business Email Compromise Advisories. cisa.gov.