Wire Fraud and Client-Trust Compromise: The BEC Pattern That's Costing Accounting Firms Six Figures

The money that disappears from accounting firms almost never disappears because of malware. It disappears because a staff accountant updated a refund routing number, processed a payroll wire on a Friday afternoon, or replied to a vendor with "new bank confirmed" — and nobody picked up the phone.

Once you have seen the pattern, you stop arguing about whether it could happen at your firm and start asking what is in place to catch it.

Why CPA firms sit in the worst seat for BEC

A CPA firm sits between two parties moving money on almost every engagement. Client to IRS. Client to payroll provider. Client to vendor. Client to a fiduciary account the firm administers. Every one of those is a wire instruction or routing number that touches the firm's email.

The attacker does not need to compromise the firm to win. They only need to compromise the email of any party in a thread the firm reads. That structural exposure is why this attack keeps producing six-figure losses at firms that thought they were too small to be interesting.

The number of CPAs on staff does not matter. The dollar amount on a single payroll wire or high-net-worth refund does.

The three patterns that drive the losses

Pattern 1: Tax refund redirect

Tax-season specific and brutally simple. The attacker compromises a client's email weeks before filing. When the firm-client thread about refund destination opens, they reply from inside the client's mailbox with a new routing number — "switched banks last month."

The preparer updates the return, files it, the refund deposits to the attacker's account via ACH, and the client discovers it only when the refund never lands. Losses commonly run $4,000 to $50,000. Recovery odds are low — ACH is harder to claw back through the Financial Fraud Kill Chain than a wire.

Pattern 2: Payroll or vendor wire interception

The year-round pattern, and the one with the biggest losses. The attacker compromises the client's email or a vendor's, then watches the firm assist with payroll funding or vendor payment. At the right moment — usually the day before funding — a reply lands: "Our bank changed, please update."

The firm processes the new instruction. The wire goes. Losses commonly run $25,000 to $500,000. Recovery depends entirely on speed — FFKC and IC3 reporting in the first 24 hours give you a real chance; by the next business day the money is layered out.

Pattern 3: Firm mailbox compromise

The most damaging pattern, because the malicious email genuinely comes from the firm's real domain. DMARC, DKIM, and SPF will not save the recipient — the message authenticates because it actually is from your firm.

The attacker phishes a partner or staff accountant using an AiTM kit — EvilProxy, Tycoon, NakedPages, or Mamba 2FA. The kit captures both the password and the post-MFA session token.

The attacker logs in from a foreign IP, sets an inbox rule hiding mail containing "wire", "ACH", "refund", or "EFT", and waits for a wire-instruction thread.

When one surfaces, they reply with "updated" details. Losses commonly run $50,000 to $500,000 or more.

A composite incident

A composite — not one specific firm — but every beat has happened at real CPA practices recently.

Wednesday afternoon. A staff accountant at a twelve-preparer Midwest firm opens an email that looks like an IRS CP-2000 notice — "your client's account is under review." The link prompts her to authenticate with Microsoft 365. She enters credentials, approves the Authenticator prompt, a generic IRS-looking page loads, and she moves on.

She entered credentials on a proxy. An AiTM kit forwarded the password to the real Microsoft login, captured the MFA prompt, and captured the post-authentication session cookie.

Thursday morning. The attacker logs in from Lithuania using the captured token. Because the cookie is post-MFA, the tenant treats them as fully authenticated. They create an inbox rule: any message containing "wire", "ACH", "refund", "routing", or "EFT" — forward externally, mark as read, move to RSS Subscriptions.

Thursday afternoon. The attacker watches an active thread about the client's Q2 estimated payment — an $87,000 wire scheduled for Friday. The rule routes copies to the attacker and hides the originals.

Friday, 11 a.m. Posing as the staff accountant on a reply to the live thread, the attacker sends "updated" wire instructions from the firm's real mailbox.

Friday, 1 p.m. The client wires $87,000.

The following Tuesday. The IRS reports the estimated payment was never received. The staff accountant pulls the thread and finds the attacker's reply hiding in RSS Subscriptions. The floor falls out.

Why MFA didn't save anyone

MFA is necessary. But the version most CPA firms have — push notification or six-digit code — does not stop adversary-in-the-middle.

Public AiTM kits like EvilProxy, Tycoon, NakedPages, and Mamba 2FA have been widely documented across 2024 and 2025. They proxy the real Microsoft login and capture the session cookie issued after MFA is satisfied. Once replayed, the tenant cannot tell the attacker apart from your staff accountant.

The factors that resist this cleanly are phishing-resistant — FIDO2 keys, Windows Hello for Business, or certificate-based authentication. Most small and mid-size firms are not there yet. Treat MFA as one layer and add at least one more.

The technical controls that actually catch this

This is where managed identity threat detection earns its keep. The signal pattern in the composite above is loud if anyone is watching:

• A sign-in from a country no one in the firm has traveled to, minutes after a US-based sign-in (impossible travel).
• A session token used from an IP that does not match the original device fingerprint (token replay).
• A new mailbox rule hiding messages containing "wire", "ACH", "refund", or "EFT" — the single most specific BEC indicator in Microsoft 365.
• An OAuth consent grant to a third-party app the firm has never used, often right after the IRS-themed lure.

Managed ITDR surfaces all four as monitored signals for the security operations team to triage when it is connected and monitored. The mailbox-rule anomaly is among the highest-confidence detections in identity security, because real users almost never hide financial keywords from themselves.

The process controls that catch it when the tech doesn't

Our guidance is to verify changed wire instructions with a phone call to a known number.

• Out-of-band callback verification, no exceptions. Any change to wire or payment instructions requires a phone call to the client, vendor, or payroll provider on a number from the original engagement letter — not the signature. Attackers can edit signatures. They cannot edit your old engagement file.
• Dual approval over a threshold. Wires above $10,000 to $25,000 require a second person to sign off.
• Vendor and client master-data change protocol. A new bank account on any record is treated like a new vendor — a second person verifies before it is saved.
• A documented wire procedure trained to every staff accountant and seasonal contractor. Seasonal hires are the soft spot — most transactions, least training, most likely to skip verification under tax-season pressure.
• Phishing simulation tuned to CP-2000 lures, payroll-provider lookalikes, and refund-redirect scenarios — that is what Managed SAT is for.
• For refund redirects: always verify the deposit destination by phone before filing. Especially if it changed since last year. This single rule eliminates Pattern 1.

If you implement the callback rule and nothing else, you eliminate most of the realistic loss path.

The first four hours after you realize

The next four hours decide how much money you get back and how clean the response is:

1. Call the receiving bank immediately. Ask for the wire to be recalled and for them to initiate the Financial Fraud Kill Chain. Domestic wires meeting FFKC criteria can sometimes be recovered if the request reaches the receiving bank before funds are layered out.
2. File at IC3.gov the same day. IC3 is the FBI's entry point for FFKC.
3. Notify the IRS Stakeholder Liaison if tax data was accessed. IRS Publication 4557 expects prompt notification. The Liaison can flag affected client accounts against fraudulent filings. See our IRS Publication 4557 and FTC Safeguards Rule walkthrough for the full framework.
4. Notify your cyber insurance carrier. Most policies require notification within 24 to 72 hours, and the crime sublimit often will not pay if you miss the window. See cyber insurance readiness for what carriers expect.
5. Preserve the evidence — do not delete the malicious inbox rule. Forensics needs the rule, sign-in logs, audit trail, and OAuth consents before anything is reset. Tell IT explicitly: do not "clean up" the mailbox.
6. Force a password reset and revoke all sessions on the compromised mailbox. In Microsoft 365 that is a password change plus "Sign out of all sessions." The sign-out kills the stolen session cookie.
7. Review the Microsoft 365 audit log. What else did the attacker access — other client records, prior-year returns, transcripts, K-1s, payroll files? That is where the FTC Safeguards and IRS notification picture starts to form.

The FTC Safeguards Rule angle most firms miss

If the compromised mailbox contained customer information — and at any accounting firm, it almost certainly did — the firm has obligations under the FTC Safeguards Rule's incident response provisions in § 314.4(h). Under the 2024 amendments, events affecting 500 or more consumers trigger a 30-day FTC notification clock from discovery.

Be conservative when the count is uncertain — assume the count is above the threshold and prepare notification while forensics narrows it down. Missing the window because you were waiting for a tidy number is worse than filing an initial notification later refined. The rule also requires the incident response plan to exist in writing before the incident.

Two insurance buckets, not one

A wire-fraud loss typically pulls from two parts of the insurance stack:

• The crime rider or social engineering fraud sublimit pays the actual wire loss. Commonly $25,000 to $250,000 — far below the headline cyber limit. Confirm on renewal that social-engineering fraud (an employee tricked into authorizing a transfer) is covered, not just direct-funds-transfer fraud.
• The cyber policy pays forensics, the mailbox investigation, breach counsel, IRS and FTC notification costs, and client notification work.

Both should be triggered. Call the broker the same day.

The lesson the partners walk away with

The partners who have lived through one of these cases almost always say the same thing: it was not really a technical failure. It was a process failure — no callback verification — compounded by a credential-theft event. Both ends needed fixing.

The credential theft is what MDR and ITDR are for — Managed Detection and Response on endpoints, Managed ITDR on Microsoft 365 identities. The process failure is what the callback policy, dual-approval rule, and Managed SAT program are for. A firm with both layers is a hard target. A firm with neither is the case study in next quarter's incident report.

Where Obsidian Ridge fits

Managed ITDR, included in every business tier from Ridge Core up, matters for accounting firms because inbox-rule and foreign-sign-in detections are among the strongest controls against this pattern.

Creating a hidden "wire/ACH/refund/EFT" forwarding rule is itself a monitored event, and the detection is designed to surface it well before a fraudulent wire would otherwise be initiated.

We pair it with Managed SAT tuned to IRS impersonation, refund-redirect themes, and payroll-platform lookalikes, focused on the staff accountants and seasonal contractors. And we run a short tabletop on the callback policy so that when the moment comes in February or April, nobody is making it up in real time.

If you are not sure where your firm stands, that is the conversation to have before a Friday afternoon arrives with an $87,000 client wire on it. Talk to us about Managed ITDR, review your cyber insurance readiness, or Talk with us.

Last updated: September 30, 2026.