Wire instructions travel by email every day. A closing memo goes out with account numbers attached, a vendor replies to an old thread with “updated banking details,” and an investor sends routing numbers to a shared inbox because that’s what the subscription form told them to do. None of it feels risky while it’s happening, which is exactly why it works so well for the people trying to steal the money.

So is it safe to email bank account details? No. Email is not a safe way to send bank account details, wire instructions or payment changes. That includes the body of the message, the PDF attached to it and the link to an encrypted portal.

Our CEO, Robert White, spent twenty years in municipal finance before starting Basefund, and he doesn’t put the blame on the people hitting send. “This is the pattern I’ve seen repeatedly in wire fraud cases,” he writes in When Money Moves, “not because people are careless, but because transactions sit in an uncomfortable space.” They involve enough people to be complicated and happen often enough to feel routine. Email makes that worse. It was built for conversation, and it has no way to prove who sent a message, whether an attachment changed on the way or who has opened it since.

Why email is the wrong place for bank details

Business email compromise (BEC) has gone from an occasional scare to something most finance teams run into every year. Seventy-four percent of U.S. organizations were hit by it in 2025, according to the 2026 AFP Payments Fraud and Control Survey, up from 63% the year before, and 85% received spoofed emails. The FBI’s 2025 Internet Crime Report put BEC losses at more than $3 billion across 24,768 complaints. Only investment fraud cost victims more.

Those losses trace back to three weaknesses that show up whenever an account number goes into an email.

Someone else is reading the inbox

Most attacks don’t involve breaking anything. A reused password or one convincing phishing link gets an attacker into a mailbox, and then they do what a good analyst would do: they read.

Who approves payments. Which law firm sends the closing memo. What day the money moves. By the time they send new instructions, they’re sending them from a real account, in the right tone, on the right day.

The address only has to pass a glance

When attackers can’t get inside, they register a domain one letter off and send from there. The FBI tells people to watch for misspelled domains and check the full sender address, especially on a phone. It’s good advice, but it rests the whole defense on someone spotting a swapped character at 4:45 on closing day.

The old emails are still there

This is the one that gets overlooked. An email with account details gets copied to everyone on the CC line, forwarded to counsel, saved to a shared drive, synced to a few phones and kept in backups for years because retention rules require it. Anyone who gets into one of those mailboxes inherits years of real account information. They also inherit a style guide: the names, formats and timing a fake instruction needs to copy.

Why encryption, PDFs and callbacks don’t close the gap

Most teams know email is risky, so they bolt something onto it. An encrypted email service. A password on the PDF. A rule that someone calls back before any wire goes out. Each of those helps a little, and none of them answers the two questions that decide whether money lands in the right place: is this person who they claim to be, and does this account actually belong to them?

Encrypted email and locked PDFs

Encryption keeps a message private while it travels, and that’s all it does. If the sender’s mailbox has been taken over, the attacker’s instructions arrive encrypted too. And once anyone opens the attachment, it’s a regular file again, free to be saved, renamed and forwarded. The book compares encrypted email to “locking your car doors while driving 70 mph on the highway.” The real exposure comes after the car is parked. (We get into this in Why “Encrypted” Emails and Call-Backs Give a False Sense of Security.)

A fake PDF can carry the right logo and the right letterhead. What it can’t carry is a history of where it came from and who touched it, which is the subject of our post on wire instructions and a forged Vermeer.

Callbacks

Calling to confirm is the most common control, and it beats doing nothing. The trouble is that the phone number often comes from the same place as the instructions. In 2013, staff at Apache Corporation got a request to change a vendor’s bank account and did call to check it, according to the court record. They dialed the number printed on the letterhead the fraudster had emailed them, and the change seemed to check out.

A familiar voice doesn’t prove much anymore either. INTERPOL says attackers can build convincing digital clones from just 10 seconds of audio. So a callback tells you someone picked up. It can’t tell you who.

There’s a legal angle as well. The bank-to-bank side of a wire is tightly controlled. The instructions that decide where it goes still come in by email and phone. Whether that counts as “commercially reasonable” under UCC Article 4A is a question most organizations only get asked after something goes wrong.

What this looks like in public finance

Public finance has a problem most industries don’t. Official statements, which name the deal size, the parties and often the expected closing date, are posted to EMMA for public disclosure. An attacker never has to guess when the money will move. (We dig into this in The MuniOS Attack: When Your Transparency Becomes Their Roadmap.)

White Lake Township, Michigan

In late November 2024, White Lake Township was about to close on roughly $29 million in general obligation bonds for a new public safety building and township hall. An attacker got into the township’s email system, impersonated a township official and altered the messages carrying the wiring instructions, according to Troutman Pepper. The underwriter wired the purchase price to the attacker. About $23.6 million came back. The rest didn’t, the sale was canceled, the underwriter sued the township and the SEC opened an investigation.

Robert opens When Money Moves with this case. His read: “The breach wasn’t a failure of attention. It was a failure of structure.” The attacker “just needed one correctly timed email in a busy inbox.” Read our full breakdown of the White Lake Township case.

Warren County, New York

Warren County shows that email is only one way in. In December 2025, the county treasurer’s office sent two ACH payments, about $2.1 million and $1.2 million, to a fraudster. According to the sheriff, a man called several county departments, picked up details about a road paving supplier, then called back posing as that supplier and was pointed to a web form to set up a new vendor account. Nobody checked who he was. The county later recovered the $1.2 million.

Phone calls and a web form, no email at all, and the same outcome. Switching channels doesn’t help when nothing in the channel proves who’s on the other end or who owns the account.

When insurance doesn’t pay

Some organizations assume insurance will cover the gap. Apache, the company from the callback example above, wired about $7 million to that fraudulent account in 2013. It got much of the money back and filed a claim for the rest. In 2016, a federal appeals court ruled the loss wasn’t covered, because Apache had authorized the transfers itself.

Robert tells a story in the book about an underwriter who explained the business to him with a pencil and two boxes. One said “Losses caused by criminals.” The other said “Losses caused by you.” Then he drew an arrow between them. “The debate,” the underwriter said, “is where that arrow lands.” That debate still decides claims, which we cover in Why Your Cyber Insurance Won’t Save You from Wire Fraud.

How to share bank account details safely

The fix is mostly a process change. Robert’s framing is that the better question isn’t how to protect documents in transit, it’s “why documents need to be in transit at all.” When people come to the instructions, instead of instructions going out to people, most of the openings an attacker relies on close.

In practice, that means:

  1. Write the policy down. Something as plain as “We don’t send or accept bank account information by email,” shared with every vendor, investor and deal participant before the transaction starts. Once it’s stated, an emailed instruction is a red flag by default.
  2. Collect instructions in one place that requires a login, so nothing gets attached, forwarded or saved to a desktop.
  3. Verify the person, and their authority to act for the payee, before you accept anything they submit.
  4. Validate the account. Confirm it’s open and that it belongs to the payee, not just that the routing number exists.
  5. Treat every change as a brand-new request. Most fraud comes in through change (a new account, a new contact, a new email address), so re-verify through channels already on file and never through the ones in the request. That goes double for long-standing relationships, because those are the ones nobody questions.
  6. Clear out old threads, attachments and shared-drive files that hold account numbers, as far as your retention policy allows.
  7. Read your insurance policy for social engineering sublimits and “voluntary parting” exclusions before you ever need to file a claim.

If you can’t get off email yet

Some counterparties will keep emailing no matter what your policy says. Until that changes, a few habits from the GFOA (summarized by Troutman Pepper) and the FBI lower the risk:

  • Never act on an emailed instruction by itself.
  • Call back on a number you already had, not one in the message.
  • Check the full sender address, not just the display name.
  • Before a large wire, send a small test payment and confirm the exact amount by phone.
  • Turn on multi-factor authentication for every mailbox that touches payments.

All of that helps. All of it also depends on a tired person catching something under deadline pressure, and that’s the moment attackers plan around.

A better way: stop sending instructions, start granting access

We built Basefund so bank instructions never have to go out by email. Payees enter their details once, on a secure page, and every payment runs through the same checks before any money moves. We verify the person with KYC and KYB checks plus OFAC and watchlist screening. We validate the account, so you know it’s active and the payee actually has access to it. Then the transfer is insured, with transaction-level coverage through Lloyd’s of London that’s bound to that specific payment.

The usual pushback is that vendors and investors won’t bother with another portal. They don’t have to change much. A payee submits details once, and the money still lands in the same bank account it always has. The book describes it as verified disbursement “without requiring counterparties to change anything about how they receive funds.”

There’s nothing sitting in an inbox to steal. Every check is logged, so when an auditor or insurer asks how a payment was approved, the answer already exists. Robert describes the design goal as making “the right behavior the default, so that doing verification correctly requires less effort than skipping it.” More than 500 institutions use Basefund today, and it has secured over $75 billion in transactions.

If your team still emails wire instructions, see how Secure Transactions works or talk to us.

Frequently asked questions

Is it safe to send wire instructions by email?

No. Email can’t prove who sent a message or whether its contents were changed, and an attacker who takes over or spoofs a mailbox can send instructions that look identical to the real thing. Use a secure portal that verifies the sender and validates the account instead.

Is encrypted email safe for bank account details?

It’s safer in transit and no safer anywhere else. Encryption doesn’t verify the sender or the account, a compromised mailbox can send encrypted messages too, and the copies stay in inboxes once they’re opened.

What about emailing a voided check or a bank letter as a PDF?

Same risk as typing the numbers into the email. PDFs are easy to forge or alter, and once opened they get stored and forwarded like any other file.

What is the safest way to share bank account information with a vendor or counterparty?

Have the payee submit their details through a secure system that confirms who they are and checks that they own the receiving account. Skip email, text messages and attachments entirely.

Is a callback enough to verify wire instructions?

Only if you dial a number you already had on file. Callbacks fail when the number comes from the same email as the instructions, and they’re weaker now that voices can be cloned. Use one as a single check inside a larger process, not as the process.

What should I do if I already wired money based on a fraudulent email?

Call your bank immediately and ask it to recall the wire, then file a complaint with the FBI at ic3.gov. Hours matter here, because stolen funds are usually moved out of the receiving account fast. Our business fraud recovery guide covers what comes next.